2 commits

Author	SHA1	Message	Date
Armin Ronacher	b4c2e92acb	fix: remove vulnerable dependency chains ... Replace build-time shell utilities with Node filesystem operations and retire the native sandbox example in favor of existing isolation options. Upgrade glob matching and worker-test dependencies and refresh the lockfiles.	2026-10-31 17:54:29 +01:00
Armin Ronacher	9fba660cf1	chore: accept unfixable node-forge advisory in npm audit ... The scheduled npm audit failed on GHSA-86w9-cpqp-85rv, which has no fixed node-forge release. node-forge is only reachable through gondolin in the private gondolin example extension, and gondolin only verifies certificates from its own CA with exponent 65537, so the low-exponent forgery does not apply. The audit now runs through scripts/npm-audit.mjs, which fails on any other advisory at or above moderate.	2026-10-02 18:49:34 +02:00