Dependabot security updates report update_not_possible because the
vulnerable packages are transitive and their parents pin them. The
Dependabot job fails on every run.
pnpm overrides raise minimatch to 9.0.9, esbuild to 0.28.2 and
postcss-selector-parser to 6.1.4. All three versions are older than the
seven day minimum release age. pnpm audit reports no known
vulnerabilities. The build and the 47 tests pass.
Co-authored-by: copilot-swe-agent[bot] <[email protected]>
Dependabot could not raise esbuild, minimatch and postcss-selector-parser, because their parents pin older ranges. The workspace now overrides them to the patched versions. The frontend builds and its tests pass.
