mirror of
https://github.com/hanzoai/bot.git
synced 2026-10-30 17:24:26 +00:00
zooqueen
4b7575ca92
The secrets job ends in pnpm audit --prod --audit-level=high, which had 28 high advisories standing in production dependencies. A step that cannot pass reports nothing: a genuinely new advisory looked exactly like the 28 already there. Twenty six of them were a version behind a published fix, held there by a lockfile resolved before the advisory landed. Several overrides named a floor under the fix (hono at 4.12.18, form-data at 2.5.4); the rest had no override at all. Raising each floor and re-resolving clears them. Overrides pin inside the major the tree resolves against. `>=` follows the newest publish across majors, which is how a first pass took linkify-it to 6 and fast-uri to 4 — linkify-it 6 drops the default export that src/markdown/ir.ts imports, and 104 test files stopped loading behind it. hono is declared rather than overridden. Its only copy is an auto-installed peer of an optional dependency, which overrides do not reach; providing it resolves the peer against a version we choose. sharp 0.35 publishes ESM types, so the callable lives on the default export, and failOnError is now failOn. The two advisories with no published fix are named one by one in pnpm.auditConfig.ignoreGhsas, with the reading behind each in docs/ci.md. An advisory that is not on that list still fails the job.