[kachawla]

Summary

Adds an npm overrides entry so hugo-extended uses adm-zip ^0.6.1 instead of 0.5.17, and regenerates the lockfile.

Reason for change

hugo-extended 0.168.0 (the latest release) depends on adm-zip ^0.5.17. The open adm-zip alerts are fixed in 0.6.1, which is outside that range, so Dependabot fails with security_update_not_possible. adm-zip is only used by the hugo-extended install step to unpack the Hugo binary. The override can be removed once hugo-extended allows 0.6.x.

GHSA-vwc7-r8mq-g2x9 lists no patched version, but its affected range is <= 0.6.0, so 0.6.1 is outside it.

Fixes #92

How to test

1. npm ci. The hugo-extended postinstall should download and install Hugo 0.168.0.
2. npm ls adm-zip should show adm-zip@0.6.1 under hugo-extended@0.168.0.
3. npm run hugo:version should print hugo v0.168.0 ... +extended.
4. npm run build should finish without errors.

File change summary

File	Summary of change
package.json	Add overrides forcing adm-zip ^0.6.1 for hugo-extended.
package-lock.json	Update adm-zip from 0.5.17 to 0.6.1.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
npm/adm-zip	0.6.1	🟢 5.3	Details Check Score Reason Code-Review ⚠️ 0 Found 1/30 approved changesets -- score normalized to 0 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Maintained 🟢 10 16 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10 Binary-Artifacts 🟢 10 no binaries found in the repo Packaging ⚠️ -1 packaging workflow not detected Security-Policy 🟢 10 security policy file detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ 3 branch protection is not maximal on development and all release branches SAST 🟢 7 SAST tool detected but not run on all commits

Scanned Files

• package-lock.json