ducktors / valkeyrie / 27132207653

98%

push

github

fix(deps): resolve Dependabot vulns in transitive dev deps

Add pnpm overrides for tar (>=7.5.11), tmp (>=0.2.6), ip-address
(>=10.1.1), vite (>=6.4.2) and esbuild (>=0.25.0) to clear 10 Dependabot
alerts. All affected packages are dev-only transitives (docs/build
tooling) and never ship in the published package.

Bump validate-package-exports 0.8.0 -> 1.0.1 so its dependency chain
uses tar 7 natively; v1 removed the --verify CLI flag, so the
validate-exports script drops it accordingly.

Verified: build, test and docs:build all pass.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

534 of 549 branches covered (97.27%)

Branch coverage included in aggregate %.

2683 of 2742 relevant lines covered (97.85%)

1064.21 hits per line