dependency audit pins become stale between dependency updates
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 176
- Forks
- 66
- Avg merge
- 1d 1h
- Merged PRs (30d)
- 52
Description
Expected Behavior
The required dependency audit passes on an unchanged dependency graph or is refreshed independently of feature work.
Current Behavior
New advisories caused pnpm audit --ignore-registry-errors to fail every pull request until five existing transitive overrides were advanced to newly patched versions.
Possible Solution
Run scheduled dependency-audit remediation that updates override ranges and lockfiles before unrelated pull requests encounter the required check.
Minimal Reproducible Example
Run pnpm audit --ignore-registry-errors after new advisories are published against versions pinned in pnpm-workspace.yaml.
Context
Observed while synchronizing an unrelated payment-offer selection pull request with main.
Logged by Brendan Ryan in wevm/mppx at 47d6df7. Filed by Frog.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with pnpm-workspace.yaml and run pnpm audit --ignore-registry-errors against the current dependency graph. Identify how the five transitive overrides and lockfiles are maintained, then add scheduled remediation so patched ranges are refreshed before unrelated pull requests fail the required audit check.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- devops, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 62/100