reactivando / use-pubsub-js / 28084224865

100%

master: 80%

push

github

chore(security): drive Dependabot/audit alerts to zero via pnpm overrides (#61)

* chore(security): drive Dependabot/audit alerts to zero via pnpm overrides

All open advisories are in dev-only transitive deps pulled in several
levels deep by release-it, vitest, eslint and tsdown. Forced to patched
versions through pnpm-workspace.yaml `overrides` (root + example):

- release-it chain: undici ^7.28.0, tar ^7.5.16 (giget pins tar@^6, so
  it can only be forced here), basic-ftp ^5.3.1, defu ^6.1.5,
  ip-address ^10.1.1
- lint/build chain: handlebars ^4.7.9, js-yaml ^4.2.0, flatted ^3.4.2,
  ajv ^6.14.0, minimatch@3 ^3.1.4 / minimatch@9 ^9.0.7,
  picomatch@2 ^2.3.2 / picomatch@4 ^4.0.4, brace-expansion@1/@2,
  yaml ^2.8.3
- example also overrides @babel/core ^7.29.6

vite is a peer-installed dep (under vitest/@vitest/coverage-v8) that
overrides can't cleanly reach, so it's pinned directly as a root
devDependency at ^8.1.0 (vitest 4 supports vite ^8; fixes the vite
7.x advisories). pnpm 11 auto-added the fresh patched versions to
minimumReleaseAgeExclude.

`pnpm audit` is now clean on both root and example. publint passes;
attw shows only a pre-existing node10 subpath-exports gap (modern
node16/bundler resolution all green) — deferred to the quality PR.
Build + tests (19) + coverage + lint + e2e all green.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* chore(security): trim minimumReleaseAgeExclude and dead override

Review follow-up:
- Drop the inert minimumReleaseAgeExclude entries that listed advisory
  minimum-patch versions (js-yaml@4.1.2, ajv@6.14.0, etc.) which aren't
  installed (overrides resolve to higher, already-aged versions). Keep
  only the genuinely-live ones: vite@8.1.0 (root + example) and
  @vitejs/plugin-react@6.0.3 (example) are still inside pnpm 11's default
  ~1-day release-age window, so removing them breaks resolution.
- Remove the dead brace-expansion@2 override from example (only @1 is
  installed there)... (continued)

11 of 11 branches covered (100.0%)

Branch coverage included in aggregate %.

63 of 64 relevant lines covered (98.44%)

7.98 hits per line