From 14edd48422595cd1b2f5eb23bcff82e7f521f792 Mon Sep 17 00:00:00 2001 From: "k.hiro1818" Date: Sat, 5 Sep 2026 22:31:16 +0000 Subject: [PATCH] chore: switch packageImportMethod to auto and add audit ignorePrune pnpm v12 defaults to auto; clone-or-copy is no longer needed. Enable audit ignorePrune to auto-remove resolved GHSA entries. Co-Authored-By: Claude Opus 4.6 Claude-Session: https://claude.ai/code/session_01LpBu3jvGWLNEeyWVL2PQZT --- pnpm-workspace.yaml | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index 5a0345d91..3571db6b8 100755 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -11,7 +11,7 @@ engineStrict: true resolutionMode: highest # necessary for a PNPM bug: https://github.com/pnpm/pnpm/issues/5152#issuecomment-1223449173 strictPeerDependencies: false -packageImportMethod: clone-or-copy +packageImportMethod: auto # Security configuration: supply chain attack mitigation # Delay the adoption of newly released packages to allow detection of malicious code @@ -33,6 +33,10 @@ minimumReleaseAgeExclude: # Prevent transitive dependencies from Git/Tarball sources (enhanced security) blockExoticSubdeps: true +# Auto-remove GHSA entries from audit reports when they no longer appear +audit: + ignorePrune: true + # Security overrides: force transitive dependencies to patched versions # See: Issue #3761 overrides: