Skip to content

Fix production dependency audit vulnerabilities#28

Open
shanebionic wants to merge 1 commit into
mainfrom
fix/dependency-audit
Open

Fix production dependency audit vulnerabilities#28
shanebionic wants to merge 1 commit into
mainfrom
fix/dependency-audit

Conversation

@shanebionic

Copy link
Copy Markdown
Owner

Summary

Fix production dependency audit failures caused by vulnerable transitive dependencies.

Changes

  • Moved pnpm overrides to pnpm-workspace.yaml
  • Updated PostCSS to patched 8.5.18
  • Retained Sharp 0.35.0 override to resolve critical libvips vulnerability
  • Updated pnpm configuration for current pnpm versions
  • Restricted native package build permissions to required dependencies only

Validation

Passed:

  • pnpm audit --prod
  • frozen lockfile installation
  • supply-chain policy verification
  • TypeScript checks
  • ESLint
  • production build
  • API tests

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant