mirror of
https://github.com/hanzoai/id.git
synced 2026-10-26 20:59:52 +00:00
4bd16bb6c3
Resolves all 35 open Dependabot alerts on hanzoai/id:
- Delete legacy-nextjs/ (frozen Next.js predecessor, not wired into any
build/Dockerfile/workspace glob; docs slated it for deletion after
v0.1.0 — v0.1.1 has shipped). Removes 31 alerts (next, undici, ws,
picomatch, postcss, js-yaml, cookie, defu, ...).
- pnpm overrides for the 3 active-workspace transitives:
esbuild ^0.28.1 (was 0.27.7) — GHSA-gv7w-rqvm-qjhr (high), GHSA-g7r4-m6w7-qqqr (low)
uuid ^11.1.1 (was 7.0.3/10/x via [email protected]) — GHSA-w5hq-g745-h8pq (medium)
Verified: pnpm install + typecheck (4/4) + build green (vite 7.3.5,
esbuild 0.28.1, 52 modules); 'pnpm audit' → no known vulnerabilities.
Co-authored-by: Antje Worring <[email protected]>
14 lines
347 B
YAML
14 lines
347 B
YAML
packages:
|
|
- "apps/*"
|
|
- "pkgs/*"
|
|
|
|
allowBuilds:
|
|
esbuild: true
|
|
|
|
# Security overrides: force patched transitives (Dependabot alerts).
|
|
# esbuild <0.28.1 → GHSA-gv7w-rqvm-qjhr (high), GHSA-g7r4-m6w7-qqqr (low)
|
|
# uuid <11.1.1 → GHSA-w5hq-g745-h8pq (medium); only pulled by [email protected]
|
|
overrides:
|
|
esbuild: "^0.28.1"
|
|
uuid: "^11.1.1"
|