chore(16-02): seed audit allowlist (esbuild GHSA waiver) + outdated pin reasons

- audit-allowlist.json: GHSA-gv7w-rqvm-qjhr waiver (esbuild dev transitive via drizzle-kit/vitest/vite; not in production runtime) - outdated-pins.json: intentional pin reasons for eslint, @eslint/js, zod, @types/node
2026-06-13 05:17:13 -04:00
parent b67d757f87
commit 0f101bdd39
2 changed files with 13 additions and 0 deletions
@@ -0,0 +1,6 @@
+{
+  "eslint": "ESLint 10 breaks eslint-plugin-react@7.37.5 (jsx-eslint#3977). Unpin when plugin releases ESLint 10 support.",
+  "@eslint/js": "Pinned with eslint — same constraint.",
+  "zod": "zod v4 has breaking API changes. Pin at 3.x until migration is planned.",
+  "@types/node": "Pinned to Node 22 LTS types to match runtime; Node 25 is not LTS."
+}