Lotus CIandClaude Opus 5.5
43cbd8409d
The npm advisory database flagged 19 packages in pnpm-lock.yaml. None of them ship in the embedded call bundle (checked against the built dist); they run on developer machines and in CI: - storybook / @storybook/* 10.6.0 -> 10.6.3: critical, dev server code injection from the local network. - vitest 4.1.12 (+ @vitest/ui unpinned to ^4.1.12), tinypool ^2.1.2: mock registration code injection, prototype-pollution RCE. - vite ^8.3.5: dev-server file exposure, launch-editor issues. - Overrides for transitive tooling: brace-expansion, browserslist, smol-toml, source-map-js, postcss-selector-parser, baseline-browser- mapping, fflate, pbkdf2, zod 4; existing qs/js-yaml/undici/dompurify overrides raised to the fixed versions. Left: elliptic (no fixed release, low), zod 3 (no 3.x fix; a dependency pins it). Lotus unit tests 144/144, build:embedded OK. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5
77 lines
3.3 KiB
YAML
77 lines
3.3 KiB
YAML
supportedArchitectures:
|
|
os: [current, linux]
|
|
cpu: [current, arm64]
|
|
libc: [current, glibc]
|
|
minimumReleaseAgeExclude:
|
|
- "@vector-im/compound-design-tokens"
|
|
- "@vector-im/compound-web"
|
|
- matrix-js-sdk
|
|
- matrix-widget-api
|
|
allowBuilds:
|
|
"@parcel/watcher": true
|
|
"@sentry/cli": true
|
|
"@swc/core": true
|
|
"core-js": true
|
|
"esbuild": true
|
|
"matrix-js-sdk@git+https://github.com/matrix-org/matrix-js-sdk.git": true
|
|
"protobufjs": true
|
|
overrides:
|
|
# We need compatible versions of RxJS in our dependencies and LiveKit's dependencies, but
|
|
# LiveKit has pinned it to a very specific version which is now holding us back from updating.
|
|
# See livekit/components-js#1101 for a request for a proper solution.
|
|
"@livekit/components-core>rxjs": "^7.8.1"
|
|
# Dedupe Mediapipe dependencies.
|
|
"@livekit/track-processors>@mediapipe/tasks-vision": "^0.10.18"
|
|
# Security fix: https://security-tracker.debian.org/tracker/CVE-2026-31802
|
|
"tar": "^7.5.11"
|
|
# Security fixes:
|
|
# - https://github.com/advisories/GHSA-7r86-cg39-jmmj
|
|
# - https://github.com/advisories/GHSA-23c5-xmqv-rm74
|
|
"minimatch": "^10.2.3"
|
|
# Security fixes for transitive build/test tooling (none of these ship in the
|
|
# embedded call bundle; checked against the npm advisory database 2026-10-25).
|
|
"tinypool": "^2.1.2"
|
|
"@vitest/mocker": "^4.1.12"
|
|
"brace-expansion@>=4": "^5.0.12"
|
|
"browserslist": "^4.28.7"
|
|
"smol-toml": "^1.8.1"
|
|
"source-map-js": "^1.2.2"
|
|
"postcss-selector-parser@>=7": "^7.1.6"
|
|
"baseline-browser-mapping": "^2.11.0"
|
|
"fflate@<0.5": "^0.4.9"
|
|
"fflate@>=0.8": "^0.8.3"
|
|
"pbkdf2": "^3.1.7"
|
|
"zod@>=4": "^4.6.6"
|
|
# Security fix: https://github.com/element-hq/element-call/security/dependabot/109
|
|
"glob": "^10.5.0"
|
|
# Security fixes:
|
|
# - https://github.com/element-hq/element-call/security/dependabot/110
|
|
# - https://github.com/element-hq/element-call/security/dependabot/122
|
|
# - https://github.com/element-hq/element-call/security/dependabot/179
|
|
"qs": "^6.16.0"
|
|
# Security fixes:
|
|
# - https://github.com/element-hq/element-call/security/dependabot/106
|
|
# - https://github.com/element-hq/element-call/security/dependabot/203
|
|
"js-yaml": "^4.3.2"
|
|
# Storybook declares support for 0.27.0 only but empirically works fine with 0.28.0.
|
|
"esbuild": "^0.28.0"
|
|
# Security fixes:
|
|
# - https://github.com/nodejs/undici/releases/tag/v6.24.0
|
|
# - https://github.com/element-hq/element-call/security/dependabot/201
|
|
# - https://github.com/element-hq/element-call/security/dependabot/199
|
|
"undici": "^6.29.1"
|
|
# Security fix: https://github.com/advisories/GHSA-rf6f-7fwh-wjgh
|
|
"flatted": "^3.4.2"
|
|
# Security fix: https://github.com/element-hq/element-call/security/dependabot/184
|
|
"ws": "^8.21.0"
|
|
# Security fixes:
|
|
# - https://github.com/element-hq/element-call/security/dependabot/191
|
|
# - https://github.com/element-hq/element-call/security/dependabot/190
|
|
# - https://github.com/element-hq/element-call/security/dependabot/192
|
|
# - https://github.com/element-hq/element-call/security/dependabot/194
|
|
# - https://github.com/element-hq/element-call/security/dependabot/198
|
|
# - https://github.com/element-hq/element-call/security/dependabot/196
|
|
# - https://github.com/element-hq/element-call/security/dependabot/195
|
|
# - https://github.com/element-hq/element-call/security/dependabot/193
|
|
"dompurify": "^3.4.17"
|