admin/tool-evaluator
1
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
2f66fff993ec8b07d40a8f4426070b2942cd6e60
tool-evaluator/pnpm-workspace.yaml
T
opencode 2f66fff993
Build & Push Docker Image / build (push) Failing after 1m18s
Details
chore(deps): upgrade all dependencies to latest and pin exact 
Policy: every direct dependency is now an exact pin; lockfile + --frozen-lockfile keep builds reproducible; save-exact=true enforced.

Toolchain:
- pnpm 10.26 -> 11.18 (lockfile migrated; supportedArchitectures moved to pnpm-workspace.yaml)
- typescript 5.9 -> 7.0, vite 7 -> 8, @vitejs/plugin-react 5 -> 6
- esbuild override 0.27.3 -> 0.28.1 (closes GHSA-g7r4-m6w7-qqqr); added @esbuild/darwin-arm64 for local dev
- orval 8.9 -> 8.23, regenerated clients

Backend (prod image):
- openid-client 5.7 -> 6.8 (rewritten OIDC flow in routes/auth.ts: discovery + functional API, PKCE/state, fetchUserInfo, buildEndSessionUrl)
- pino 9 -> 10, pino-http 10 -> 11, thread-stream 3 -> 4
- zod 3.25 -> 4.4 (catalog; supported by drizzle-zod 0.8.3)
- pg 8.20 -> 8.22; removed deprecated @types/bcryptjs

Frontend:
- react/react-dom 19.1.0 -> 19.2.8 (catalog pin lifted; expo note removed)
- react-day-picker 9 -> 10 (table classname -> month_grid)
- recharts 2 -> 3 (TooltipContentProps + DefaultLegendContentProps typing; safe keys)
- react-resizable-panels 2 -> 4 (Group/Separator rename)
- date-fns 3 -> 4, @hookform/resolvers 3 -> 5, lucide-react 0.545 -> 1.28
- all @radix-ui/*, tailwind, types, and remaining patch/minor deps bumped to latest

Security/process:
- overrides for body-parser >=2.3.0 (GHSA-v422-hmwv-36x6) + markdown-it/linkify-it/brace-expansion/fast-uri (dev tooling)
- pnpm audit now reports 0 vulnerabilities (prod and full)
- CI audit gate added to build.yaml; docs/dependency-policy.md; renovate.json
- Dockerfile pins node:24.18.1-alpine and pnpm@11.18.0
2026-08-03 12:56:00 +02:00

180 lines
6.8 KiB
YAML
Raw Blame History

# ============================================================================
# SECURITY: Minimum release age for npm packages (supply-chain attack defense)
# ============================================================================
#
# This setting requires that any npm package version must have been published
# for at least 1 day (1440 minutes) before pnpm will allow installing it.
# This is a critical defense against supply-chain attacks. In most cases,
# malicious npm releases are discovered and pulled within hours, so a 1-day
# delay provides a strong safety buffer.
#
# DO NOT DISABLE THIS SETTING. Removing or setting it to 0 is considered
# extremely dangerous and leaves the entire workspace vulnerable to supply-
# chain attacks, which have been the #1 vector for npm ecosystem compromises.
#
# If you absolutely need to install a package before the 1-day window has
# passed (e.g. an urgent security bugfix), you can add it to the
# `minimumReleaseAgeExclude` allowlist below. Only consider doing this for
# packages released by trusted organizations with an impeccable security
# posture (e.g. Replit packsges, react from Meta, typescript from Microsoft). Even then,
# remove the exclusion once the 1-day window has passed.
#
# Example:
# minimumReleaseAgeExclude:
# - react
# - typescript
#
# ============================================================================
minimumReleaseAge: 1440
supportedArchitectures:
os:
- current
- linux
cpu:
- current
- x64
minimumReleaseAgeExclude:
# Exclude @replit scoped packages from the minimum release age check.
# These are published by Replit and trusted — the supply-chain attack vector
# this setting guards against does not apply to our own packages.
- '@replit/*'
- stripe-replit-sync
packages:
- artifacts/*
- lib/*
- lib/integrations/*
- scripts
catalog:
'@replit/vite-plugin-cartographer': 0.6.1
'@replit/vite-plugin-dev-banner': 0.1.2
'@replit/vite-plugin-runtime-error-modal': 0.0.6
'@tailwindcss/vite': 4.3.3
'@tanstack/react-query': 5.101.4
'@tanstack/react-virtual': 3.14.9
'@types/node': 26.1.2
'@types/react': 19.2.18
'@types/react-dom': 19.2.4
'@vitejs/plugin-react': 6.0.5
class-variance-authority: 0.7.1
clsx: 2.1.1
drizzle-orm: 0.45.2
framer-motion: 12.43.0
lucide-react: 1.28.0
react: 19.2.8
react-dom: 19.2.8
tailwind-merge: 3.6.0
tailwindcss: 4.3.3
tsx: 4.23.1
vite: 8.2.0
wouter: 3.10.0
zod: 4.4.3
autoInstallPeers: false
onlyBuiltDependencies:
- '@swc/core'
- esbuild
- msw
- unrs-resolver
overrides:
# replit uses linux-x64 only, we can exclude all other platforms
"esbuild>@esbuild/darwin-arm64": "-"
"esbuild>@esbuild/darwin-x64": "-"
"esbuild>@esbuild/freebsd-arm64": "-"
"esbuild>@esbuild/freebsd-x64": "-"
"esbuild>@esbuild/linux-arm": "-"
"esbuild>@esbuild/linux-arm64": "-"
"esbuild>@esbuild/linux-ia32": "-"
"esbuild>@esbuild/linux-loong64": "-"
"esbuild>@esbuild/linux-mips64el": "-"
"esbuild>@esbuild/linux-ppc64": "-"
"esbuild>@esbuild/linux-riscv64": "-"
"esbuild>@esbuild/linux-s390x": "-"
"esbuild>@esbuild/netbsd-arm64": "-"
"esbuild>@esbuild/netbsd-x64": "-"
"esbuild>@esbuild/openbsd-arm64": "-"
"esbuild>@esbuild/openbsd-x64": "-"
"esbuild>@esbuild/sunos-x64": "-"
"esbuild>@esbuild/win32-arm64": "-"
"esbuild>@esbuild/win32-ia32": "-"
"esbuild>@esbuild/win32-x64": "-"
"esbuild>@esbuild/aix-ppc64": '-'
"esbuild>@esbuild/android-arm": '-'
"esbuild>@esbuild/android-arm64": '-'
"esbuild>@esbuild/android-x64": '-'
"esbuild>@esbuild/openharmony-arm64": '-'
"lightningcss>lightningcss-android-arm64": "-"
"lightningcss>lightningcss-darwin-arm64": "-"
"lightningcss>lightningcss-darwin-x64": "-"
"lightningcss>lightningcss-freebsd-x64": "-"
"lightningcss>lightningcss-linux-arm-gnueabihf": "-"
"lightningcss>lightningcss-linux-arm64-gnu": "-"
"lightningcss>lightningcss-linux-arm64-musl": "-"
"lightningcss>lightningcss-linux-x64-musl": "-"
"lightningcss>lightningcss-win32-arm64-msvc": "-"
"lightningcss>lightningcss-win32-x64-msvc": "-"
"@tailwindcss/oxide>@tailwindcss/oxide-android-arm64": "-"
"@tailwindcss/oxide>@tailwindcss/oxide-darwin-arm64": "-"
"@tailwindcss/oxide>@tailwindcss/oxide-darwin-x64": "-"
"@tailwindcss/oxide>@tailwindcss/oxide-freebsd-x64": "-"
"@tailwindcss/oxide>@tailwindcss/oxide-linux-arm-gnueabihf": "-"
"@tailwindcss/oxide>@tailwindcss/oxide-linux-arm64-gnu": "-"
"@tailwindcss/oxide>@tailwindcss/oxide-linux-arm64-musl": "-"
"@tailwindcss/oxide>@tailwindcss/oxide-win32-arm64-msvc": "-"
"@tailwindcss/oxide>@tailwindcss/oxide-win32-x64-msvc": "-"
"@tailwindcss/oxide>@tailwindcss/oxide-linux-x64-musl": "-"
"rollup>@rollup/rollup-android-arm-eabi": "-"
"rollup>@rollup/rollup-android-arm64": "-"
"rollup>@rollup/rollup-darwin-arm64": "-"
"rollup>@rollup/rollup-darwin-x64": "-"
"rollup>@rollup/rollup-freebsd-arm64": "-"
"rollup>@rollup/rollup-freebsd-x64": "-"
"rollup>@rollup/rollup-linux-arm-gnueabihf": "-"
"rollup>@rollup/rollup-linux-arm-musleabihf": "-"
"rollup>@rollup/rollup-linux-arm64-gnu": "-"
"rollup>@rollup/rollup-linux-arm64-musl": "-"
"rollup>@rollup/rollup-linux-loong64-gnu": "-"
"rollup>@rollup/rollup-linux-loong64-musl": "-"
"rollup>@rollup/rollup-linux-ppc64-gnu": "-"
"rollup>@rollup/rollup-linux-ppc64-musl": "-"
"rollup>@rollup/rollup-linux-riscv64-gnu": "-"
"rollup>@rollup/rollup-linux-riscv64-musl": "-"
"rollup>@rollup/rollup-linux-s390x-gnu": "-"
"rollup>@rollup/rollup-linux-x64-musl": "-"
"rollup>@rollup/rollup-openbsd-x64": "-"
"rollup>@rollup/rollup-openharmony-arm64": "-"
"rollup>@rollup/rollup-win32-arm64-msvc": "-"
"rollup>@rollup/rollup-win32-ia32-msvc": "-"
"rollup>@rollup/rollup-win32-x64-gnu": "-"
"rollup>@rollup/rollup-win32-x64-msvc": "-"
"@expo/ngrok-bin>@expo/ngrok-bin-darwin-arm64": "-"
"@expo/ngrok-bin>@expo/ngrok-bin-darwin-x64": "-"
"@expo/ngrok-bin>@expo/ngrok-bin-freebsd-ia32": "-"
"@expo/ngrok-bin>@expo/ngrok-bin-freebsd-x64": "-"
"@expo/ngrok-bin>@expo/ngrok-bin-linux-arm64": "-"
"@expo/ngrok-bin>@expo/ngrok-bin-linux-arm": "-"
"@expo/ngrok-bin>@expo/ngrok-bin-linux-ia32": "-"
"@expo/ngrok-bin>@expo/ngrok-bin-sunos-x64": "-"
"@expo/ngrok-bin>@expo/ngrok-bin-win32-ia32": "-"
"@expo/ngrok-bin>@expo/ngrok-bin-win32-x64": "-"
# drizzle-kit uses esbuild internally on an older version that's vulnerable, this overrides it
"@esbuild-kit/esm-loader": "npm:tsx@4.23.1"
esbuild: "0.28.1"
# Fix GHSA-q8mj-m7cp-5q26: qs DoS via stringify with null/undefined in comma-format arrays
qs: ">=6.15.2"
# Fix GHSA-v422-hmwv-36x6: body-parser DoS via invalid limit value (express dep)
body-parser: ">=2.3.0"
# Build-time tooling (orval/typedoc) advisories: force patched versions
markdown-it: ">=14.1.2"
linkify-it: ">=5.0.2"
brace-expansion: ">=5.0.8"
fast-uri: ">=3.1.4"
allowBuilds:
esbuild: set this to true or false
Reference in New Issue View Git Blame Copy Permalink