stacklok / toolhive-studio / 25722380061

68%

main: 70%

Pull #2218

github

fix(security): ignore @tanstack/history malware advisory (false positive on 1.161.6)

Follow-up to the previous commit. Drop the pnpm.overrides pin for
@tanstack/history; the malicious 1.161.9 / 1.161.12 releases have
already been unpublished from npm, and the lockfile resolves to the
clean 1.161.6.

The advisory keeps an open-ended `>=0` range, so `pnpm audit` keeps
failing CI with a false positive against 1.161.6. Add
`pnpm.auditConfig.ignoreGhsas: [GHSA-rmmr-r34h-pfm5]` so the audit
step in `_security-checks.yml` passes without masking real findings.

Also revert the @tanstack/history entry from `.grype.yaml` since
nothing is being pinned for it anymore.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

4712 of 7478 branches covered (63.01%)

7033 of 10349 relevant lines covered (67.96%)

120.52 hits per line