mirror of
https://github.com/outline/outline.git
synced 2026-06-13 11:25:03 +03:00
Tom Moor
c280bddab9
Pin picomatch to ^2.3.2 / ^4.0.4 via resolutions so transitive deps pick up the patched versions, then drop the advisory IDs.
16 lines
579 B
YAML
16 lines
579 B
YAML
nodeLinker: node-modules
|
|
|
|
enableScripts: false
|
|
|
|
npmMinimalAgeGate: 4320
|
|
|
|
npmPreapprovedPackages:
|
|
- outline-icons
|
|
|
|
# Build-time advisories that don't affect runtime request handling.
|
|
# Re-evaluate when bumping the relevant dev/build dep.
|
|
npmAuditIgnoreAdvisories:
|
|
- "1113517" # GHSA-mw96-cpmx-2vgc rollup <2.80.0 path traversal (workbox-build, build-time)
|
|
- "1113686" # GHSA-5c6j-r48x-rmvq serialize-javascript RCE (@rollup/plugin-terser, build-time)
|
|
- "1115805" # GHSA-r5fr-rjxr-66jc lodash-es _.template injection (mermaid; not exposed to user-controlled template keys)
|