SnapOtter 012e2136ee fix(security): resolve 13 HIGH Trivy CVEs in npm dependencies ...

- Override glob>=10.5.0 (CVE-2025-64756 command injection)
- Override minimatch>=9.0.6 (CVE-2026-26996/27903/27904 ReDoS)
- Override tar>=7.5.11 (CVE-2026-23745/23950/24842/26960/29786/31802
  path traversal and arbitrary file overwrite)
- picomatch>=4.0.4 already overridden (CVE-2026-33671 ReDoS)
- Add .trivyignore for pnpm 9.x CVEs (CVE-2025-69262/69263) that
  require a major version bump to pnpm 10.x
- Restore Trivy as a blocking gate with trivyignore support
- Restore scan dependency in manifest job

2026-06-08 16:32:52 +08:00

..

actions/setup

fix(security): comprehensive security audit and hardening

2026-05-13 21:33:50 +08:00

DISCUSSION_TEMPLATE

feat: add community roadmap infrastructure

2026-05-20 14:59:25 +08:00

ISSUE_TEMPLATE

chore(release): 1.17.1

2026-05-18 19:10:56 +08:00

workflows

fix(security): resolve 13 HIGH Trivy CVEs in npm dependencies

2026-06-08 16:32:52 +08:00

dependabot.yml

chore: ignore major version bumps in dependabot for pip and docker

2026-05-01 14:16:32 +08:00

FUNDING.yml

docs: add GitHub Sponsors CTAs across README, landing, and docs

2026-05-16 19:38:12 +08:00

labels.yml

feat: add community roadmap infrastructure

2026-05-20 14:59:25 +08:00

pull_request_template.md

fix: address review issues in contribution infrastructure

2026-05-16 16:08:16 +08:00