Skip to content

chore(repo): prune stale minimumReleaseAge exemptions #1102

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
apollo-ui-release-bot wants to merge 1 commit into from
Closed

chore(repo): prune stale minimumReleaseAge exemptions #1102

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 0 additions & 9 deletions pnpm-workspace.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,15 +22,6 @@ minimumReleaseAgeExclude:
- '@turbo/*' # 2.9.14 — platform binaries co-published with turbo (scope rename from turbo-*), same OIDC provenance ✓
- '@esbuild/*' # 0.28.1 — platform binaries co-published with esbuild in the same OIDC release, vetted 2026-06-16
- '@next/*' # 16.2.11 — swc platform binaries + env co-published with next in the same OIDC release
- 'nanoid@3.3.18' # 3.3.18 — GHSA-2v37-7h3g-55p8 / CVE-2026-67213 (high, infinite loop for zero-size custom generators); supersedes the 3.3.17 exemption, whose fix was incomplete (advisory range widened to <3.3.18 on 2026-08-13), vetted 2026-08-18: provenance ✓, publisher (OIDC, approver ai, unchanged from 3.3.17) ✓, tag+diff (async/index.native.js zero-size guard + default size, README docs line only) ✓, zero dependencies ✓, no install scripts ✓, integrity ✓
- 'dompurify@3.4.13' # 3.4.13 — GHSA-55q2-fjhq-7xh7 (moderate, IN_PLACE hook-removal XSS), vetted 2026-08-11: publisher (cure53, unchanged) ✓, signed tag+diff (security fixes + regression tests; CI-only action bumps excluded from tarball) ✓, zero runtime dependencies ✓, integrity ✓ (no provenance, historically none)
- 'mermaid@11.16.1' # 11.16.1 — GHSA-6x64-9x62-f2gx / GHSA-3rrr-jr9j-h3q3 / GHSA-2v8p-3f2j-5mp7 / GHSA-rhh3-jpg6-66xh (moderate) + GHSA-c4c3-pg64-4m4v (low, config prototype pollution), vetted 2026-08-06: provenance ✓, publisher (OIDC, release by aloisklink) ✓, tag+diff (PR #8022, styles/architecture/xychart/radar/config only) ✓, dependencies identical to 11.16.0 ✓, integrity ✓
- 'fast-uri@3.1.5' # 3.1.5 — GHSA-7p8r-x3mc-p8w7 (high, host confusion via backslash in authority), vetted 2026-08-06: publisher (matteo.collina, unchanged) ✓, tag+diff (v3.1.5, index.js +37/-1 + 136 lines of security tests) ✓, zero dependencies ✓, integrity ✓ (no provenance, historically none for this package)
- 'hono@4.12.34' # 4.12.34 — GHSA-8j4g-w8fx-2239 (moderate, ReDoS in CORS middleware via Access-Control-Request-Headers), vetted 2026-08-06: provenance ✓, publisher (OIDC, approver yusukebe) ✓, tag+diff (v4.12.34, src/middleware/cors/index.ts +1/-1 + test, via private security-fork merge) ✓, zero dependencies ✓, integrity ✓
- 'framer-motion@13.1.0' # 13.1.0 — Motion v13 upgrade (drops v12's @emotion/is-prop-valid dynamic require behind Rspack's critical-dependency warning), vetted 2026-08-12: publisher (popmotion, unchanged since v12) ✓, upstream tag v13.1.0 ✓, deps unchanged (tslib, motion-dom, motion-utils) ✓, no install scripts ✓, integrity ✓ (no provenance, historically none)
- 'motion@13.1.0' # 13.1.0 — wrapper package of framer-motion@13.1.0, vetted 2026-08-12: publisher (popmotion, unchanged since v12) ✓, upstream tag v13.1.0 ✓, deps (tslib, framer-motion) ✓, no install scripts ✓, integrity ✓ (no provenance, historically none)
- 'motion-dom@13.0.0' # 13.0.0 — framer-motion@13.1.0 runtime dep, vetted 2026-08-12: publisher (popmotion, unchanged since v12) ✓, upstream tag v13.0.0 ✓, deps (motion-utils) ✓, no install scripts ✓, integrity ✓ (no provenance, historically none)
- 'motion-utils@13.0.0' # 13.0.0 — framer-motion@13.1.0 runtime dep, vetted 2026-08-12: publisher (popmotion, unchanged since v12) ✓, upstream tag v13.0.0 ✓, zero dependencies ✓, no install scripts ✓, integrity ✓ (no provenance, historically none)
# Refuse transitive git/tarball deps (pnpm 11 default; kept explicit for clarity)
blockExoticSubdeps: true

Expand Down
Loading