mirror of https://github.com/stablyai/orca.git synced 2026-10-30 16:47:34 +00:00

Files

T

Neil 18d25591f9 fix(deps): resolve body-parser and happy-dom security findings (#32983 )

* fix(deps): resolve body-parser and happy-dom security findings

* test(mobile): await rich markdown effect cleanup

2026-10-23 17:35:12 -07:00

package.json

build: pin pnpm 12.14.0 (#30481 )

2026-10-18 19:27:33 -07:00

pnpm-lock.yaml

fix(deps): resolve body-parser and happy-dom security findings (#32983 )

2026-10-23 17:35:12 -07:00

pnpm-workspace.yaml

fix: remediate dependency security advisories across workspaces (#31681 )

2026-10-21 16:31:17 -07:00

README.md

fix(tooling): lock routine dependency audit executables (#30183 )

2026-10-17 22:12:03 -07:00

README.md

Locked audit tools

React Doctor and Knip live in this separate pnpm workspace so application installs and release bundles do not acquire their dependency trees.

Run the existing root commands (pnpm doctor, pnpm audit:react-doctor, pnpm audit:dead-code, or pnpm check:react-doctor:changed). The runner first installs this workspace with --frozen-lockfile --ignore-scripts, then runs the tool's local JavaScript entry point from the repository root. Every run checks the manifest against the lockfile; it never falls back to downloading a CLI through dlx or npx.

To update a tool, change its exact version in this package's manifest, run pnpm --dir config/audit-tools install --ignore-scripts, and review both the manifest and generated lockfile. The workspace enforces a three-day release delay and disables install scripts. Keep its package-manager pin aligned with the root. Run node config/scripts/verify-locked-audit-tools.mjs to exercise both tools.