d7c73f4342
* security: bump lodash, lodash-es, and defu in root lockfile Fixes Dependabot alerts in the root npm workspace lockfile: - GHSA-r5fr-rjxr-66jc (high) lodash <4.18.1 (alert #338) - GHSA-r5fr-rjxr-66jc (high) lodash-es <4.18.1 (alert #335) - GHSA-737v-mqg7-c878 (high) defu <6.1.7 (alert #343) defu (6.1.4 -> 6.1.7) and lodash (4.17.23 -> 4.18.1) were bumped via targeted `npm update`. lodash-es was pinned exactly to 4.17.23 by @chevrotain packages (transitive dep of mermaid in hindsight-docs), so a `lodash-es` override (>=4.18.1) is added to the root package.json to force resolution to the patched 4.18.1. Verified: `npm ci` succeeds with 0 vulnerabilities. Mermaid/chevrotain consumers all dedupe to lodash-es 4.18.1. lodash-es 4.x is semver- compatible. * chore: regenerate hindsight-docs skill Picks up FAQ and best-practice sections added in #905 that were not regenerated at merge time, so that `verify-generated-files` passes for this branch.
37 lines
882 B
JSON
37 lines
882 B
JSON
{
|
|
"name": "hindsight",
|
|
"private": true,
|
|
"workspaces": [
|
|
"hindsight-clients/typescript",
|
|
"hindsight-control-plane",
|
|
"hindsight-docs"
|
|
],
|
|
"scripts": {
|
|
"prepare": "./scripts/setup-hooks.sh"
|
|
},
|
|
"overrides": {
|
|
"qs": "^6.14.2",
|
|
"fast-xml-parser": ">=5.5.6",
|
|
"serialize-javascript": "^7.0.5",
|
|
"minimatch": "^3.1.4",
|
|
"undici": ">=7.24.0",
|
|
"flatted": ">=3.4.2",
|
|
"picomatch": ">=2.3.2 <3.0.0 || >=4.0.4",
|
|
"yaml": ">=1.10.3",
|
|
"svgo": ">=3.3.3",
|
|
"dompurify": ">=3.3.2",
|
|
"@redocly/openapi-core": {
|
|
"minimatch": "^5.1.8"
|
|
},
|
|
"@typescript-eslint/typescript-estree": {
|
|
"minimatch": "^9.0.7"
|
|
},
|
|
"ajv-formats": {
|
|
"ajv": "^8.18.0"
|
|
},
|
|
"handlebars": ">=4.7.9",
|
|
"path-to-regexp": ">=0.1.13",
|
|
"brace-expansion": ">=1.1.13 <2.0.0 || >=2.0.3 <3.0.0",
|
|
"lodash-es": ">=4.18.1"
|
|
}
|
|
}
|