mirror of https://github.com/stablyai/orca.git synced 2026-11-13 17:37:40 +00:00

Files

T

Neil 9c7fe9793e fix(deps): backport minimatch, glob, and deepmerge security fixes (#37981 )

Backport upstream matching and abort fixes plus safe deepmerge property handling across the independent workspaces. Includes installed-package regression tests and audit-tool fixture repair. Agent-reviewed at 83ca381d519e6247d7c1b3f0a52ce2907a9f9a19; CI aggregate passed. Version-based scanner alerts remain open pending documented disposition or compatible upstream releases.

2026-11-03 17:13:11 -08:00

package.json

build: pin pnpm 12.14.0 (#30481 )

2026-10-18 19:27:33 -07:00

pnpm-lock.yaml

fix(deps): backport minimatch, glob, and deepmerge security fixes (#37981 )

2026-11-03 17:13:11 -08:00

pnpm-workspace.yaml

fix(deps): backport minimatch, glob, and deepmerge security fixes (#37981 )

2026-11-03 17:13:11 -08:00

README.md

fix(tooling): lock routine dependency audit executables (#30183 )

2026-10-17 22:12:03 -07:00

README.md

Locked audit tools

React Doctor and Knip live in this separate pnpm workspace so application installs and release bundles do not acquire their dependency trees.

Run the existing root commands (pnpm doctor, pnpm audit:react-doctor, pnpm audit:dead-code, or pnpm check:react-doctor:changed). The runner first installs this workspace with --frozen-lockfile --ignore-scripts, then runs the tool's local JavaScript entry point from the repository root. Every run checks the manifest against the lockfile; it never falls back to downloading a CLI through dlx or npx.

To update a tool, change its exact version in this package's manifest, run pnpm --dir config/audit-tools install --ignore-scripts, and review both the manifest and generated lockfile. The workspace enforces a three-day release delay and disables install scripts. Keep its package-manager pin aligned with the root. Run node config/scripts/verify-locked-audit-tools.mjs to exercise both tools.