mirror of
https://github.com/callstack/agent-device.git
synced 2026-09-14 20:06:34 +08:00
Michał Pierzchała
4f95ca8881
* fix(daemon): timing-safe token comparison and daemon.json permission hardening Use crypto.timingSafeEqual (via SHA-256 digests, length-independent) for the three daemon token checks, and chmod daemon.json to 0600 after writes since writeFileSync only applies mode on creation. https://claude.ai/code/session_01LXZXzxi55sZ11DSyqWyBA2 * fix(deps): clear CVE-2026-9277 by overriding shell-quote to >=1.8.4 in test-app Override added to examples/test-app/pnpm-workspace.yaml (package.json-level overrides are silently ignored for this nested app, see the comment there). Lockfile change is limited to shell-quote 1.8.3 -> 1.8.4; pnpm audit is clean. https://claude.ai/code/session_01LXZXzxi55sZ11DSyqWyBA2 --------- Co-authored-by: Claude <noreply@anthropic.com>
16 lines
771 B
YAML
16 lines
771 B
YAML
# This file exists so examples/test-app is treated as its own pnpm workspace
|
|
# root. pnpm only honors `overrides` from a workspace root, and because this
|
|
# app is nested under the repo-root pnpm-workspace.yaml (without being a member)
|
|
# its overrides were silently ignored when declared in package.json, letting the
|
|
# lockfile drift back to vulnerable transitive versions (see PR #649). Keeping
|
|
# them here ensures they actually apply. These pin transitive deps to versions
|
|
# that clear Dependabot security alerts; ws/brace-expansion are scoped to the
|
|
# vulnerable major so the non-vulnerable ws@7 / brace-expansion@1 copies stay.
|
|
overrides:
|
|
'@xmldom/xmldom': 0.8.13
|
|
postcss: 8.5.12
|
|
uuid: 14.0.0
|
|
ws@8: ^8.20.1
|
|
brace-expansion@5: ^5.0.6
|
|
shell-quote: '>=1.8.4'
|