pnpm audit reports 6 advisories (1 moderate, 5 high) in apps/outlook-addon's dev tooling. pnpm audit --prod is clean — none of them is reachable from shipped code, and brace-expansion appears zero times in the built taskpane bundle.
They arrived with the import (#141): the app's own package-lock.json pinned around some, and its overrides block is inert in a workspace member.
They are deliberately not force-overridden. Trying that broke the tree: brace-expansion: '>=5.0.8' pushed every minimatch onto brace-expansion 5, whose namespace export minimatch 3 and 9 both fail to interop with, so any lint run died with TypeError: expand is not a function. adm-zip: '>=0.6.0' and uuid: '>=14.0.0' replace exact pins in office-addin-*, @microsoft/teamsfx-core, sockjs and webpack-dev-server, and adm-zip is pre-1.0 so 0.5 → 0.6 is breaking by its own versioning.
The real fix is moving the tooling off those transitive versions rather than overriding from the root:
office-addin-debugging → office-addin-dev-settings → @microsoft/m365agentstoolkit-cli → @microsoft/teamsfx-core → uuid@8 / adm-zip@0.5eslint-plugin-react / eslint-plugin-react-native → minimatch@3 → brace-expansion@1
Worth checking whether the newer office-addin-* majors drop the teamsfx chain entirely, and whether the react eslint plugins are needed at all in an Office add-in.
Part of encryption4all/postguard#247.
pnpm auditreports 6 advisories (1 moderate, 5 high) inapps/outlook-addon's dev tooling.pnpm audit --prodis clean — none of them is reachable from shipped code, andbrace-expansionappears zero times in the built taskpane bundle.They arrived with the import (#141): the app's own
package-lock.jsonpinned around some, and itsoverridesblock is inert in a workspace member.They are deliberately not force-overridden. Trying that broke the tree:
brace-expansion: '>=5.0.8'pushed every minimatch onto brace-expansion 5, whose namespace export minimatch 3 and 9 both fail to interop with, so any lint run died withTypeError: expand is not a function.adm-zip: '>=0.6.0'anduuid: '>=14.0.0'replace exact pins inoffice-addin-*,@microsoft/teamsfx-core,sockjsandwebpack-dev-server, and adm-zip is pre-1.0 so 0.5 → 0.6 is breaking by its own versioning.The real fix is moving the tooling off those transitive versions rather than overriding from the root:
office-addin-debugging→office-addin-dev-settings→@microsoft/m365agentstoolkit-cli→@microsoft/teamsfx-core→uuid@8/adm-zip@0.5eslint-plugin-react/eslint-plugin-react-native→minimatch@3→brace-expansion@1Worth checking whether the newer
office-addin-*majors drop the teamsfx chain entirely, and whether the react eslint plugins are needed at all in an Office add-in.Part of encryption4all/postguard#247.