Peter Steinberger
f6131a4fbf
build(deps): remove npm shrinkwrap; mirror pnpm lock into transient package locks ( #114006 )
...
* build(deps): remove npm shrinkwrap; mirror pnpm lock into transient package locks
npm 12 removed shrinkwrap (command + tarball/root loading). Delete all 82
committed npm-shrinkwrap.json files and stop publishing lockfiles; keep
pnpm-lock.yaml as the single reviewed dependency boundary. The generator
becomes scripts/generate-npm-package-lock.mjs and feeds plugin bundling via
a transient package-lock.json + npm ci (works on npm 11 and 12). Tarball
validation treats the published 2026.7.2 beta train as a shrinkwrap
transition; self-update npm detection now uses install topology instead of
the shipped shrinkwrap.
* fix(deps): repair lint, deadcode, and test-type lanes for the npm 12 migration
- sort integrity comparisons with an explicit comparator (oxlint)
- keep resolveBunGlobalNodeModules module-local (knip unused-export gate)
- model npm pack --json as npm<=11 array / npm 12 name-keyed object
- default calver destructuring in the tarball test fixture
2026-07-26 01:29:55 -04:00
joshavant
5d9c010628
ci: add security-sensitive file guard
2026-06-17 12:50:18 +02:00
Dallin Romney
e0aa820257
ci: rename dependency guard workflow ( #87842 )
2026-05-28 18:26:49 -07:00
Peter Steinberger
b1117d9862
refactor: extract gateway client package ( #87797 )
...
* refactor: extract gateway client package
* chore: drop generated gateway package artifacts
* refactor: move gateway protocol package
* refactor: remove old gateway protocol tree
* test: keep auth compat split in run mode
* test: expose gateway wrapper options for internals
* fix: watch moved gateway package sources
* test: normalize slash command import guard
* chore: teach knip gateway package entries
* ci: route gateway client package checks
* fix: reuse ipaddr for gateway client hosts
* fix: sync gateway protocol usage schema
2026-05-29 02:23:42 +01:00
Dallin Romney
c8f2bbf76d
ci: guard dependency graph PR changes ( #87791 )
2026-05-28 18:13:54 -07:00
Vincent Koc
bfa5b39648
fix: cover plugin package locks in dependency review
2026-05-22 12:56:10 +01:00
Peter Steinberger
b6c8807ca0
chore: add shrinkwrap to plugin npm packages
2026-05-22 12:56:10 +01:00
Peter Steinberger
c56067e34f
chore: harden npm shrinkwrap release path
2026-05-22 12:56:10 +01:00
Josh Avant
bd4db5ee62
Add dependency release safety evidence and PR awareness ( #81325 )
...
* test: cover dependency pin guard
* build: add dependency vulnerability gate
* build: add dependency risk report
* build: add dependency drift reports
* build: include dependency ownership surface evidence
* build: rename dependency report commands
* build: respect release age exclusions in risk report
* build: clarify transitive risk accounting
* build: remove transitive risk exception registry
* build: clarify transitive risk signal wording
* ci: attach dependency evidence to release preflight
* ci: extract dependency release evidence generator
* build: rename ownership surface dependency report
* ci: clarify release evidence naming
* build: clarify recently published risk report
* build: reorder transitive risk report sections
* build: fix ownership surface pluralization
* ci: surface dependency changes on PRs
* ci: harden dependency change awareness
* ci: use dependency changed PR label
* build: fix dependency report lint
* docs: add dependency safety changelog
2026-05-13 03:05:09 -05:00
Vincent Koc
d115faa367
chore: update security codeowners team
2026-04-29 15:57:17 -07:00
Vincent Koc
b6a21cde34
ci: schedule android codeql shard ( #73430 )
2026-04-28 01:54:57 -07:00
Vincent Koc
dbab162abd
ci: split codeql quality workflow ( #73404 )
2026-04-28 01:04:59 -07:00
Vincent Koc
432ea11248
Security: add secops ownership for sensitive paths ( #46440 )
...
* Meta: add secops ownership for sensitive paths
* Docs: restrict Codeowners-managed security edits
* Meta: guide agents away from secops-owned paths
* Meta: broaden secops CODEOWNERS coverage
* Meta: narrow secops workflow ownership
2026-03-14 14:16:14 -07:00
Onur Solmaz
5c9fae5adc
chore: add code owners for npm release paths
2026-03-14 13:45:40 +01:00
