lukaszraczylo/gohoarder
1
0
Fork 0
mirror of https://github.com/lukaszraczylo/gohoarder.git synced 2026-10-18 01:17:46 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(frontend): override vulnerable transitive dependencies (#150)

Browse Source 
Dependabot security updates report update_not_possible because the
vulnerable packages are transitive and their parents pin them. The
Dependabot job fails on every run.

pnpm overrides raise minimatch to 9.0.9, esbuild to 0.28.2 and
postcss-selector-parser to 6.1.4. All three versions are older than the
seven day minimum release age. pnpm audit reports no known
vulnerabilities. The build and the 47 tests pass.

Co-authored-by: copilot-swe-agent[bot] <[email protected]>
This commit is contained in:
lukaszraczylo
2026-10-03 00:56:29 +01:00
committed by GitHub
co-authored by copilot-swe-agent[bot] <198982749+[email protected]>
parent 48c12a4869
commit b172788741
2 changed files with 34 additions and 61 deletions
Download Patch File Download Diff File Expand all files Collapse all files
frontend/pnpm-workspace.yaml
+4 -3
View File
@@ -1,7 +1,8 @@
allowBuilds:
esbuild: true
vue-demi: true
# Patched versions of transitive dependencies that Dependabot cannot raise on its own.
overrides:
"esbuild@<0.28.1": "^0.28.1"
"minimatch@<9.0.7": "^9.0.7"
"postcss-selector-parser@<6.0.11": "^6.0.11"
"minimatch@<9.0.9": ^9.0.9
"esbuild@<0.28.2": ^0.28.2
"postcss-selector-parser@<6.1.4": ^6.1.4