2 Commits

Include renames

Author	SHA1	Message	Date
SnapOtter	1846d1c7c9	fix(security): add pnpm bundled dependency CVEs to trivyignore ... All 13 HIGH CVEs (glob, minimatch, picomatch, tar) are bundled inside pnpm 9.x itself, not in our application dependencies. pnpm overrides only affect our app's dependency tree, not pnpm's internal modules. All require upgrading to pnpm 10.x.	2026-06-08 16:44:38 +08:00
SnapOtter	012e2136ee	fix(security): resolve 13 HIGH Trivy CVEs in npm dependencies ... - Override glob>=10.5.0 (CVE-2025-64756 command injection) - Override minimatch>=9.0.6 (CVE-2026-26996/27903/27904 ReDoS) - Override tar>=7.5.11 (CVE-2026-23745/23950/24842/26960/29786/31802 path traversal and arbitrary file overwrite) - picomatch>=4.0.4 already overridden (CVE-2026-33671 ReDoS) - Add .trivyignore for pnpm 9.x CVEs (CVE-2025-69262/69263) that require a major version bump to pnpm 10.x - Restore Trivy as a blocking gate with trivyignore support - Restore scan dependency in manifest job	2026-06-08 16:32:52 +08:00