From 0f101bdd39d149df1991ae642c7b19bd834ac1ba Mon Sep 17 00:00:00 2001
From: Lucas Berger <me@lucasberger.ca>
Date: Sat, 13 Jun 2026 05:17:13 -0400
Subject: [PATCH] chore(16-02): seed audit allowlist (esbuild GHSA waiver) +
 outdated pin reasons

- audit-allowlist.json: GHSA-gv7w-rqvm-qjhr waiver (esbuild dev transitive via drizzle-kit/vitest/vite; not in production runtime)
- outdated-pins.json: intentional pin reasons for eslint, @eslint/js, zod, @types/node
---
 scripts/audit-allowlist.json | 7 +++++++
 scripts/outdated-pins.json   | 6 ++++++
 2 files changed, 13 insertions(+)
 create mode 100644 scripts/audit-allowlist.json
 create mode 100644 scripts/outdated-pins.json

diff --git a/scripts/audit-allowlist.json b/scripts/audit-allowlist.json
new file mode 100644
index 0000000..5da1b35
--- /dev/null
+++ b/scripts/audit-allowlist.json
@@ -0,0 +1,7 @@
+{
+  "GHSA-gv7w-rqvm-qjhr": {
+    "reason": "esbuild integrity-check advisory; transitive dev-only via drizzle-kit/vitest/vite; not in the production runtime — esbuild never runs in the shipped image; patched in esbuild >=0.28.1, will resolve when drizzle-kit bumps the transitive pin",
+    "reviewer": "luc",
+    "expires": "2026-09-01"
+  }
+}
diff --git a/scripts/outdated-pins.json b/scripts/outdated-pins.json
new file mode 100644
index 0000000..be43c71
--- /dev/null
+++ b/scripts/outdated-pins.json
@@ -0,0 +1,6 @@
+{
+  "eslint": "ESLint 10 breaks eslint-plugin-react@7.37.5 (jsx-eslint#3977). Unpin when plugin releases ESLint 10 support.",
+  "@eslint/js": "Pinned with eslint — same constraint.",
+  "zod": "zod v4 has breaking API changes. Pin at 3.x until migration is planned.",
+  "@types/node": "Pinned to Node 22 LTS types to match runtime; Node 25 is not LTS."
+}