security: automated dependency hardening#1226
Conversation
Before: │ critical │ Node-SAML SAML Signature Verification Vulnerability │ unknown After: │ critical │ Node-SAML SAML Signature Verification Vulnerability │ unknown
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
🔒 Release Safety Check Results✅ Safety Checks Passed {"code":"NOT_FOUND","message":"Requested function was not found"} |
🔍 Classification Check Results
|
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: ec134a63bb
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| "pnpm": { | ||
| "overrides": { |
There was a problem hiding this comment.
This adds a new root pnpm override configuration without updating pnpm-lock.yaml. In the CI workflow I checked (.github/workflows/ci.yml:49-50) installs run pnpm install --frozen-lockfile, and pnpm's --frozen-lockfile docs state that mode fails when the lockfile is out of sync with the manifest. Because the lockfile's overrides: section still contains only the previous entries and none of these new selectors, frozen installs for this commit will reject the checkout with an overrides config mismatch; please regenerate and commit pnpm-lock.yaml with the manifest change.
Useful? React with 👍 / 👎.
|
Closed during PR cleanup: mergeable=UNKNOWN base=main. Reopen only with a current verified change. |
1 participant
Automated weekly drift guard.
Before: │ critical │ Node-SAML SAML Signature Verification Vulnerability │
unknown
After: │ critical │ Node-SAML SAML Signature Verification Vulnerability │
unknown
Merges via auto-merge-bot once verified.