chore(16-02): seed audit allowlist (esbuild GHSA waiver) + outdated pin reasons

- audit-allowlist.json: GHSA-gv7w-rqvm-qjhr waiver (esbuild dev transitive via drizzle-kit/vitest/vite; not in production runtime) - outdated-pins.json: intentional pin reasons for eslint, @eslint/js, zod, @types/node
2026-06-13 05:17:13 -04:00
parent b67d757f87
commit 0f101bdd39
2 changed files with 13 additions and 0 deletions
@@ -0,0 +1,7 @@
+{
+  "GHSA-gv7w-rqvm-qjhr": {
+    "reason": "esbuild integrity-check advisory; transitive dev-only via drizzle-kit/vitest/vite; not in the production runtime — esbuild never runs in the shipped image; patched in esbuild >=0.28.1, will resolve when drizzle-kit bumps the transitive pin",
+    "reviewer": "luc",
+    "expires": "2026-09-01"
+  }
+}