replace retired pnpm audit with OSV-Scanner gate - #69
Conversation
|
x402-stellar PR Preview deployed: |
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
|
x402-stellar PR Preview deployed: |
There was a problem hiding this comment.
Pull request overview
Replaces the failing CI dependency audit with OSV-Scanner and updates vulnerable dependencies.
Changes:
- Adds a blocking OSV-Scanner lockfile scan with an advisory exception.
- Updates
esbuildandprotobufjsoverrides and lockfile resolutions.
Reviewed changes
Copilot reviewed 3 out of 4 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
.github/workflows/test.yml |
Replaces pnpm audit with OSV-Scanner. |
osv-scanner.toml |
Configures the temporary advisory exclusion. |
package.json |
Updates dependency overrides. |
pnpm-lock.yaml |
Records updated dependency resolutions. |
Files not reviewed (1)
- pnpm-lock.yaml: Generated file
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| - name: Audit dependencies (OSV-Scanner) | ||
| uses: google/osv-scanner-action/osv-scanner-action@9a498708959aeaef5ef730655706c5a1df1edbc2 # v2.3.8 | ||
| with: | ||
| scan-args: |- | ||
| --config=osv-scanner.toml | ||
| --lockfile=pnpm-lock.yaml |
|
x402-stellar PR Preview deployed: |
npm retired the legacy quick-audit endpoint (410), which
pnpm auditstill calls, so the CI audit step failed hard. This PR replaces it with a blocking OSV-Scanner step that reads pnpm-lock.yaml directly.protobufjs, recommended by dependabot