Repository navigation
fix(deps): clear the audit findings instead of ignoring them - #171
Merged
Merged
Conversation
- drop auditConfig.ignoreGhsas (37 GHSAs, 28 no longer match the lock) - vite ^7.3.7 at the workspace root, so vitest 5 resolves its peer to a patched release - override esbuild to ^0.28.2 for tsup 8.5.1 (GHSA-g7r4-m6w7-qqqr)
rennf93
added
dependencies
github-actions
Bot
added
the
build
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #170
pnpm audit --audit-level=lownow passes with no ignore list:No known vulnerabilities found.Changes:
pnpm-workspace.yaml: theauditConfig.ignoreGhsasblock (37 GHSAs) is gone. Without it master audits to 9 advisories; the other 28 no longer match the lock.package.json:vite ^7.3.7as a root dev dependency. vitest 5 takes vite as a peer and pnpm auto-installed 7.3.1; an override only rewrites the peer range (unmet peer vite@^7.3.7: found 7.3.1), a root dependency resolves it. The lock now has vite 7.3.7 only.pnpm-workspace.yaml: overrideesbuild@<0.28.1: ^0.28.2. tsup 8.5.1 asks for^0.27.0; tsup 9 has^0.28.2but needs Node 22.18+, and CI builds on 18 and 20. esbuild 0.28's only breaking change is the install-time binary integrity check.Behavior change in the build output (not in the source): the dist is built by esbuild 0.28.2 instead of 0.27.4. Two things change in
packages/core/dist/index.cjs: TypeScript parameter properties get class field declarations (define semantics, esbuild 0.27.5 #4421, the same as tsc for ES2022), and the__esmhelper rethrows a failed module init (#4461). Chunk names change with the content.Verified locally (Node 24, pnpm 10.25.0, Redis 7 on 6379):
pnpm build,pnpm lint: exit 0pnpm test: core 2284, express 113, nestjs 94, fastify 87, hono 85, all passed; conformance gates pipeline 35/0, events 37/0, pattern_safety 29/0, redis_interop 5/0 (passed/failed)pnpm test:coverage: 100 / 97.35 / 100 / 100 (statements / branches / functions / lines), thresholds 100 / 96 / 99 / 100The 12 open Dependabot PRs for
docs/fail only ondependency-audit, and that job audits the pnpm workspace, notdocs/. They get their own PR.