From c16828714d0e1eb1541dd245409fde899ea28e5c Mon Sep 17 00:00:00 2001 From: Daniel Kantor Date: Sun, 4 Oct 2026 01:22:16 +0200 Subject: [PATCH] ci: temporarily ignore braces advisory until 2026-10-18 --- .github/workflows/ci.yaml | 8 +++++++- pnpm-workspace.yaml | 3 +++ 2 files changed, 10 insertions(+), 1 deletion(-) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 8dd18a27..bd415498 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -116,7 +116,13 @@ jobs: - name: Biome check (format + lint, repo-wide) run: pnpm exec biome check - name: Audit dependencies - run: pnpm audit --audit-level high + run: | + # Temporary: braces has no patch (GHSA-vfj7-8cjw-p6xm). Ignore expires 2026-10-18. + if [[ "$(date +%F)" < "2026-10-18" ]]; then + pnpm audit --audit-level high --ignore GHSA-vfj7-8cjw-p6xm + else + pnpm audit --audit-level high + fi - name: Type-check (tsc) run: pnpm --filter ./enwiro-gui/web exec tsc -b - name: Build frontend diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index cd5757a6..efc86093 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -19,6 +19,9 @@ allowBuilds: # - onlyBuiltDependencies: allowlist of packages permitted to run install/ # lifecycle scripts. pnpm blocks all dependency build scripts by default; # anything needing one must be listed here explicitly. +auditConfig: + ignoreGhsas: + - GHSA-vfj7-8cjw-p6xm minimumReleaseAge: 4320 minimumReleaseAgeExclude: - hono@4.12.25