mirror of
https://github.com/callstack/agent-device.git
synced 2026-09-14 20:06:34 +08:00
Michał Pierzchała
973b74cc14
`qs: 6.15.2` overrode every major, pinning the exact version behind GHSA-x5fp-wj9c-mxmx and GHSA-4mjr-xmp4-gh2g; `qs@6: ^6.16.0` keeps the scoped major and clears both advisories in the mutation tooling tree. `undici@7` now matches the exact 7.29.0 pin in package.json — tsdown bundles undici into the published build, so a caret here let lockFileMaintenance move the shipped bytes under an unchanged pin. The lockfile recorded that: both undici importers disagreeing with their own package.json, now agreeing. `.fallowrc.json` listed two entry roots deleted in26ac865c63and8889a17cf1, which Fallow drops silently, and `.worktreeinclude` listed an android/multitouch-helper tree that no longer exists. `.prettierignore` duplicated .oxfmtrc.json's ignore list with nothing left reading it.
25 lines
892 B
YAML
25 lines
892 B
YAML
packages:
|
|
- 'website'
|
|
- 'packages/*'
|
|
# Keep non-interactive checks from downloading tooling or reinstalling dependencies implicitly.
|
|
pmOnFail: warn
|
|
verifyDepsBeforeRun: warn
|
|
allowBuilds:
|
|
fallow: true
|
|
minimumReleaseAgeExclude:
|
|
- '@chenglou/freerange@0.0.4'
|
|
# @limrun/api pins undici to an exact vulnerable version (7.24.7) even in its
|
|
# latest release, so a direct bump can't clear the Dependabot alerts. Override
|
|
# the transitive resolution instead; scoped to major 7 so any future undici 8
|
|
# elsewhere in the tree is untouched. Exact, matching the direct pin in
|
|
# package.json: tsdown bundles undici into the published build, so a caret here
|
|
# would let lockFileMaintenance move the shipped bytes under an unchanged pin.
|
|
overrides:
|
|
undici@7: 7.29.0
|
|
brace-expansion@5: '^5.0.9'
|
|
fast-uri: 3.1.6
|
|
postcss: 8.5.23
|
|
qs@6: ^6.16.0
|
|
react-router: 7.18.2
|
|
react-router-dom: 7.18.2
|