Lucas Berger
0f101bdd39
- audit-allowlist.json: GHSA-gv7w-rqvm-qjhr waiver (esbuild dev transitive via drizzle-kit/vitest/vite; not in production runtime) - outdated-pins.json: intentional pin reasons for eslint, @eslint/js, zod, @types/node
8 lines
345 B
JSON
8 lines
345 B
JSON
{
|
|
"GHSA-gv7w-rqvm-qjhr": {
|
|
"reason": "esbuild integrity-check advisory; transitive dev-only via drizzle-kit/vitest/vite; not in the production runtime — esbuild never runs in the shipped image; patched in esbuild >=0.28.1, will resolve when drizzle-kit bumps the transitive pin",
|
|
"reviewer": "luc",
|
|
"expires": "2026-09-01"
|
|
}
|
|
}
|