mirror of
https://github.com/nocodb/nocodb.git
synced 2026-10-28 08:35:22 +08:00
Pranav CandClaude Fable 5.1
5ed96edb49
- drop orphan packages/nocodb-sdk/pnpm-lock.yaml (workspace installs never use it; 78 alerts incl. proxy-addr / shell-quote) - refresh root pnpm.overrides to current patched versions (dompurify 3.4.17, next 15.5.28, body-parser 1.20.9, multer 2.5.0, nodemailer 10.1.4, hono 4.13.11, happy-dom 21.0.4, js-yaml 3.15.2/4.3.2, brace-expansion, svgo, toml 5, uuid 11, vite 8.2.4, vitest 4.1.12, ...) and bound the minimatch / nanoid selectors that had resolved across majors - scope zod 4.6.6 override to the MCP packages so @ai-sdk peer ranges stay intact; bump nocodb's zod-v4 alias - add body-parser, multer, serialize-javascript, happy-dom to minimumReleaseAgeExclude (patches published inside the 7-day window) - direct bumps: nocodb-sdk-v2 axios 1.20.0, nc-gui nuxt ^4.6.2 / katex ^0.19.0, nc-secret-mgr figlet ^1.11.3 - noco-integrations: same override refresh + nocohub parity overrides Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
34 lines
1.3 KiB
YAML
34 lines
1.3 KiB
YAML
packages:
|
|
- "packages/nocodb-sdk"
|
|
- "packages/nocodb-sdk-v2"
|
|
- "packages/nc-gui"
|
|
- "packages/nc-mail-templates"
|
|
- "packages/nocodb"
|
|
|
|
- "packages/nc-secret-mgr"
|
|
|
|
# Supply chain security settings (pnpm 10.16+)
|
|
# Quarantine newly published versions for 7 days before allowing install.
|
|
# Blocks fast-acting attacks (Axios 1.14.1 was live ~3h, Shai-Hulud ~12h).
|
|
# Use minimumReleaseAgeExclude to bypass for emergency security patches.
|
|
minimumReleaseAge: 10080
|
|
# undici 6.28.1 / 7.29.1 / 8.10.2 fix CVE-2026-84961 and CVE-2026-85152 (CVSS 9.1)
|
|
# plus three WebSocket / retry-interceptor issues; released 2026-09-04.
|
|
minimumReleaseAgeExclude:
|
|
- undici
|
|
# Security patches published inside the 7-day window (Oct 2026 Dependabot sweep):
|
|
# body-parser 1.20.9 / 2.4.0, multer 2.5.0, serialize-javascript 7.1.3, happy-dom 21.0.4
|
|
- body-parser
|
|
- multer
|
|
- serialize-javascript
|
|
- happy-dom
|
|
|
|
# Detect when a package loses its provenance guarantees (e.g. previously
|
|
# published via CI, now published from a local machine — signals account compromise).
|
|
# NOTE: Re-enable once oxc-* packages restore provenance attestations.
|
|
# trustPolicy: no-downgrade
|
|
|
|
# Prevent transitive dependencies from pulling code via git+ssh, https tarballs,
|
|
# or other non-registry protocols. Only direct dependencies may use exotic sources.
|
|
blockExoticSubdeps: true
|