mirror of
https://github.com/okieselbach/AutopilotMonitor.git
synced 2026-10-24 12:42:38 +00:00
Oliver Kieselbach
d8ab70b166
ajv-cli 5.0.0 is the latest release and still declares fast-json-patch ^2.0.0, so neither Dependabot nor npm audit fix can move past CVE-2021-4279. An npm override forces 3.1.1 into the lockfile; the 3.x API is backward compatible and the validate command used in combine-rules.yml never touches the package. Verified: npm ci from the lockfile plus all four ajv validate steps pass locally. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
13 lines
350 B
JSON
13 lines
350 B
JSON
{
|
|
"name": "autopilot-monitor-rules-tooling",
|
|
"private": true,
|
|
"description": "Validator tooling for rules/ - combine-rules.yml installs from the lockfile so nothing unpinned reaches a job that pushes to main.",
|
|
"devDependencies": {
|
|
"ajv-cli": "5.0.0",
|
|
"ajv-formats": "3.0.1"
|
|
},
|
|
"overrides": {
|
|
"fast-json-patch": "3.1.1"
|
|
}
|
|
}
|