mirror of
https://github.com/outline/outline.git
synced 2026-06-13 11:25:03 +03:00
Tom Moor
88d871e463
Pin lodash and lodash-es to ^4.18.1 via resolutions so transitive deps pick up the patched versions, then drop the advisory ID. Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
15 lines
456 B
YAML
15 lines
456 B
YAML
nodeLinker: node-modules
|
|
|
|
enableScripts: false
|
|
|
|
npmMinimalAgeGate: 4320
|
|
|
|
npmPreapprovedPackages:
|
|
- outline-icons
|
|
|
|
# Build-time advisories that don't affect runtime request handling.
|
|
# Re-evaluate when bumping the relevant dev/build dep.
|
|
npmAuditIgnoreAdvisories:
|
|
- "1113517" # GHSA-mw96-cpmx-2vgc rollup <2.80.0 path traversal (workbox-build, build-time)
|
|
- "1113686" # GHSA-5c6j-r48x-rmvq serialize-javascript RCE (@rollup/plugin-terser, build-time)
|