chore(config): scope the qs override and drop dead fallow, worktree and prettier entries - #2535
Merged
Conversation
…prettier entries `qs: 6.15.2` overrode every major, pinning the exact version behind GHSA-x5fp-wj9c-mxmx and GHSA-4mjr-xmp4-gh2g; `qs@6: ^6.16.0` keeps the scoped major and clears both advisories in the mutation tooling tree. `undici@7` now matches the exact 7.29.0 pin in package.json — tsdown bundles undici into the published build, so a caret here let lockFileMaintenance move the shipped bytes under an unchanged pin. The lockfile recorded that: both undici importers disagreeing with their own package.json, now agreeing. `.fallowrc.json` listed two entry roots deleted in 26ac865 and 8889a17, which Fallow drops silently, and `.worktreeinclude` listed an android/multitouch-helper tree that no longer exists. `.prettierignore` duplicated .oxfmtrc.json's ignore list with nothing left reading it.
|
Size Report
Startup median (7 runs, lower is better):
|
Member
Author
|
No code findings at 5f48e47. The scoped qs override and exact undici pin match the lockfile, and the removed entries have no active consumers. Current-head checks pass and there are no conflicts; ready for human review and merge. |
thymikee
added
the
ready-for-human
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Closes #2521. Config and lockfile only.
qs: 6.15.2overrode every major and pinned the exact version behind GHSA-x5fp-wj9c-mxmx andGHSA-4mjr-xmp4-gh2g.
qs@6: ^6.16.0keeps the scoped major and clears both. The caret is deliberatehere and not for undici:
qsreaches the tree only through@stryker-mutator/core → typed-rest-clientand is never bundled, so a caret keeps patching itself;undiciis bundled intothe published build by
tsdown.config.ts:109, so its override is now the exact7.29.0thatpackage.json:328andpackages/provision-kit/package.json:52already declare.The caret had already done damage:
pnpm-lock.yamlrecordedspecifier: ^7.29.0for both undiciimporters, so the lockfile disagreed with their own manifests. The new lockfile records
7.29.0,matching them.
Deleted: two
.fallowrc.jsonentry roots pointing at files removed in26ac865c63and8889a17cf1(Fallow drops absent roots silently), two
.worktreeincludepaths under a nonexistentandroid/multitouch-helper/, and.prettierignore— its six patterns are identical to.oxfmtrc.json'signorePatternsand nothing in the repo reads prettier.The issue suggested a glob "where a directory of runners exists"; neither root sits in one.
scripts/runner-request-count/is gone, andtest/scripts/holds one runner thattest/ci/trusted-fixture-artifact.test.mjsimports statically, so it is already in the graph. All 29remaining
entrypaths exist with brace and glob expansion applied.Validation
pnpm audit— dev tree included — reports no known vulnerabilities (was 2 moderate);pnpm audit --prodwas already clean.pnpm check:affected --runat5f48e47163ran the full59-check plan (a lockfile change fails open) and passed every check except
mutation-model, whichfails identically on a clean
origin/maintree in this worktree: its claim thatsrc/commands/interaction/runtime/gestures.test.tsreaches thescroll-edge-statekernel went stalewhen the scroll path moved to
src/daemon/scroll-runtime.ts. Pre-existing, advisory in CI, unrelatedto this diff.