Repository navigation

Commit 21319ff

and

committed

fix(cli): pin fast-uri to the patched Ajv-compatible v3 range

The >=3.1.2 floor is open-ended, so the lockfile resolved fast-uri@4.0.0 on the production Ajv path - outside the ^3.0.1 range ajv@8 declares. Constrain it to >=3.1.6 <4: the smallest range that keeps Ajv 8 compatibility and excludes every reported vulnerable v3 release. Closes #463 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BZF7CTRvfq3FWDqaCWhkCJ

1 parent 42f572c commit 21319ffCopy full SHA for 21319ff

2 files changed

cli
- pnpm-lock.yaml
- pnpm-workspace.yaml

`‎cli/pnpm-lock.yaml‎`

Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

`‎cli/pnpm-workspace.yaml‎`

-Original file line number
+Diff line change
 # security floors were silently ignored while the lockfile still recorded them, which is
 # the ERR_PNPM_LOCKFILE_CONFIG_MISMATCH every `cli` install answered with.
 overrides:
 -  fast-uri: '>=3.1.2'
 +  fast-uri: '>=3.1.6 <4'
   picomatch: '>=4.0.4'
   postcss: '>=8.5.10'
   qs: '>=6.15.2'

Comments

(0)