Huang Xin
f6fbbf59f2
Resolve a batch of transitive Dependabot alerts on the web lockfile via pnpm-workspace overrides. Bumped existing overrides: - vite >=7.3.5 (#244 high, #245 med; GHSA path within 7.3.x) <- was 7.3.2 - dompurify >=3.4.9 (#249-#255; clears #252 <=3.4.6 by leaving the range) - protobufjs >=7.6.3 <8 (#233, #247, #248); bounded <8 to stay on the patched 7.x line (a bare floor let pnpm jump to the 8.x major) - ws >=8.21.0 (#241 high) <- was pinned 8.20.1 Added overrides: - form-data >=4.0.6 (#246 high) - js-yaml >=4.2.0 (#243 med) - '@babel/core' >=7.29.6 (#242 low) - '@opentelemetry/core' >=2.8.0 (#256 med) Not auto-fixable here: #236 @ai-sdk/provider-utils (<=3.0.97, no recorded fix; the installed 3.0.25 is pinned via a local patchedDependencies patch). Verified: pnpm test (5685 passed), pnpm lint, pnpm build-web (exit 0). Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
58 lines
1.4 KiB
YAML
58 lines
1.4 KiB
YAML
packages:
|
|
- apps/*
|
|
- apps/readest-app/workers/send-email
|
|
- apps/readest-app/extensions/*
|
|
- packages/foliate-js
|
|
|
|
allowBuilds:
|
|
core-js: true
|
|
edgedriver: true
|
|
esbuild: true
|
|
geckodriver: true
|
|
protobufjs: true
|
|
sharp: true
|
|
workerd: true
|
|
|
|
onlyBuiltDependencies:
|
|
- sharp
|
|
|
|
patchedDependencies:
|
|
'@ai-sdk/provider-utils@3.0.25': patches/@ai-sdk__provider-utils@3.0.25.patch
|
|
'@ai-sdk/provider-utils@4.0.27': patches/@ai-sdk__provider-utils@4.0.27.patch
|
|
mdast-util-gfm-autolink-literal@2.0.1: patches/mdast-util-gfm-autolink-literal@2.0.1.patch
|
|
|
|
overrides:
|
|
glob: '>=11.1.0'
|
|
jws: '>=4.0.1'
|
|
vite: '>=7.3.5 <8'
|
|
esbuild: '>=0.28.1 <0.29'
|
|
srvx: '>=0.11.13'
|
|
rollup: '>=4.59.0'
|
|
undici: '>=7.24.0'
|
|
flatted: '>=3.4.2'
|
|
body-parser: '>=2.2.1'
|
|
dompurify: '>=3.4.9'
|
|
i18next-http-backend: '>=3.0.5'
|
|
picomatch: '>=4.0.4'
|
|
path-to-regexp: '>=8.4.0'
|
|
protobufjs: '>=7.6.3 <8'
|
|
serialize-javascript: 7.0.5
|
|
fast-xml-parser: '>=5.7.0'
|
|
lodash: '>=4.18.0'
|
|
lodash-es: '>=4.18.0'
|
|
postcss: 8.5.14
|
|
basic-ftp: '>=5.3.0'
|
|
qs: '>=6.15.2'
|
|
shell-quote: '>=1.8.4'
|
|
form-data: '>=4.0.6'
|
|
js-yaml: '>=4.2.0'
|
|
'@opentelemetry/core': '>=2.8.0'
|
|
'@babel/runtime': '>=7.26.10'
|
|
'@babel/helpers': '>=7.26.10'
|
|
'@babel/core': '>=7.29.6'
|
|
mdast-util-gfm-autolink-literal: 2.0.1
|
|
uuid: '>=14.0.0'
|
|
ws: '>=8.21.0'
|
|
'@emnapi/core': 1.8.1
|
|
'@emnapi/runtime': 1.8.1
|