mirror of
https://github.com/stablyai/orca.git
synced 2026-11-13 17:37:40 +00:00
Neil
9c7fe9793e
Backport upstream matching and abort fixes plus safe deepmerge property handling across the independent workspaces. Includes installed-package regression tests and audit-tool fixture repair. Agent-reviewed at 83ca381d519e6247d7c1b3f0a52ce2907a9f9a19; CI aggregate passed. Version-based scanner alerts remain open pending documented disposition or compatible upstream releases.
32 lines
1.0 KiB
YAML
32 lines
1.0 KiB
YAML
minimumReleaseAge: 4320
|
|
|
|
allowBuilds:
|
|
esbuild: true
|
|
sharp: true
|
|
|
|
overrides:
|
|
# Vercel still requires Zod 3; pin the version with our security backport.
|
|
zod@>=3 <4: 3.25.76
|
|
zod@>=4 <4.6.6: 4.6.7
|
|
path-to-regexp@>=4.0.0 <6.3.0: 6.3.0
|
|
# Vercel still pins vulnerable Undici 5, including in its latest release.
|
|
'@vercel/node>undici': 6.29.1
|
|
'@vercel/python-analysis>js-yaml': 4.3.2
|
|
'@vercel/python-analysis>minimatch': 10.2.6
|
|
'vercel>smol-toml': 1.9.1
|
|
'vercel>undici': 6.29.1
|
|
'@vercel/python-analysis>smol-toml': 1.9.1
|
|
'@vercel/rust>smol-toml': 1.9.1
|
|
'@vercel/static-config>ajv': 8.18.0
|
|
'@vercel/backends>path-to-regexp': 8.4.0
|
|
'@vercel/express>path-to-regexp': 8.4.0
|
|
'@vercel/hono>path-to-regexp': 8.4.0
|
|
'@vercel/container>tar': 7.5.22
|
|
'@vercel/container>smol-toml': 1.9.1
|
|
|
|
patchedDependencies:
|
|
zod@3.25.76: ../../config/patches/zod@3.25.76.patch
|
|
braces@3.0.3: ../../config/patches/braces@3.0.3.patch
|
|
glob@13.0.6: ../../config/patches/glob@13.0.6.patch
|
|
minimatch@10.2.6: ../../config/patches/minimatch@10.2.6.patch
|