sscoble/pi-mono
1
0
Fork 0
mirror of https://github.com/badlogic/pi-mono.git synced 2026-11-05 23:37:25 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 4

fix: remove vulnerable dependency chains

Browse source 
Replace build-time shell utilities with Node filesystem operations and retire the native sandbox example in favor of existing isolation options. Upgrade glob matching and worker-test dependencies and refresh the lockfiles.
This commit is contained in:
Armin Ronacher 2026-10-31 17:54:29 +01:00
parent 6de14ec098
commit b4c2e92acb
24 changed files with 260 additions and 857 deletions
Download patch file Download diff file Expand all files Collapse all files

10
scripts/npm-audit.mjs
View file

@ -10,15 +10,7 @@ const auditLevel = "moderate";
const severities = ["info", "low", "moderate", "high", "critical"];
/** @type {Record<string, { package: string; reason: string }>} */
const acceptedAdvisories = {
"GHSA-86w9-cpqp-85rv": {
package: "node-forge",
reason:
"No fixed node-forge release exists. It is only reachable through @earendil-works/gondolin in the private, " +
"unpublished gondolin example extension. Gondolin only verifies leaf certificates against its own locally " +
"generated CA (public exponent 65537), so the low-exponent signature forgery does not apply.",
},
};
const acceptedAdvisories = {};
const result = spawnSync("npm", ["audit", "--omit=dev", "--json"], { encoding: "utf8", maxBuffer: 64 * 1024 * 1024 });
if (result.error) {