From 5f48e471638d50740b494fe79cba92b800e9defa Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Micha=C5=82=20Pierzcha=C5=82a?= Date: Sat, 12 Sep 2026 19:57:38 +0200 Subject: [PATCH] chore(config): scope the qs override and drop dead fallow, worktree, prettier entries MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `qs: 6.15.2` overrode every major, pinning the exact version behind GHSA-x5fp-wj9c-mxmx and GHSA-4mjr-xmp4-gh2g; `qs@6: ^6.16.0` keeps the scoped major and clears both advisories in the mutation tooling tree. `undici@7` now matches the exact 7.29.0 pin in package.json — tsdown bundles undici into the published build, so a caret here let lockFileMaintenance move the shipped bytes under an unchanged pin. The lockfile recorded that: both undici importers disagreeing with their own package.json, now agreeing. `.fallowrc.json` listed two entry roots deleted in 26ac865c63 and 8889a17cf1, which Fallow drops silently, and `.worktreeinclude` listed an android/multitouch-helper tree that no longer exists. `.prettierignore` duplicated .oxfmtrc.json's ignore list with nothing left reading it. --- .fallowrc.json | 2 -- .prettierignore | 6 ------ .worktreeinclude | 2 -- pnpm-lock.yaml | 17 +++++++++-------- pnpm-workspace.yaml | 8 +++++--- 5 files changed, 14 insertions(+), 21 deletions(-) delete mode 100644 .prettierignore diff --git a/.fallowrc.json b/.fallowrc.json index 22975c7e2f..c49ae36815 100644 --- a/.fallowrc.json +++ b/.fallowrc.json @@ -19,7 +19,6 @@ "src/daemon.ts", "packages/capture-kit/src/png-worker.ts", "scripts/patch-xcuitest-runner-icon.ts", - "scripts/runner-request-count/run.ts", "packages/capture-kit/src/ios-snapshot-engine/replay.ts", // #1596 regression fixture: runs as a real `node --experimental-strip-types` // subprocess (test/integration/daemon-replace-exit-flush.test.ts), so @@ -31,7 +30,6 @@ "examples/sdk/contracts-result.ts", "examples/sdk/batch-orchestration.ts", "examples/sdk/ai-sdk-tools.ts", - "test/scripts/metro-prepare-packaged-smoke.mjs", "test/integration/*.test.ts", "website/docs/404.mdx", "website/rspress.config.ts" diff --git a/.prettierignore b/.prettierignore deleted file mode 100644 index 7bedd3adcb..0000000000 --- a/.prettierignore +++ /dev/null @@ -1,6 +0,0 @@ -.claude/** -dist/** -node_modules/** -**/*.md -scripts/maestro-conformance/corpus/** -fallow-baselines/** diff --git a/.worktreeinclude b/.worktreeinclude index ab3089cbba..4bb4760629 100644 --- a/.worktreeinclude +++ b/.worktreeinclude @@ -10,8 +10,6 @@ examples/test-app/.expo/ DerivedData/ android/snapshot-helper/build/ android/snapshot-helper/dist/ -android/multitouch-helper/build/ -android/multitouch-helper/dist/ # Tool caches .fallow/ diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 4dba7545f8..db4648d7cb 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -5,11 +5,11 @@ settings: excludeLinksFromLockfile: false overrides: - undici@7: ^7.29.0 + undici@7: 7.29.0 brace-expansion@5: ^5.0.9 fast-uri: 3.1.6 postcss: 8.5.23 - qs: 6.15.2 + qs@6: ^6.16.0 react-router: 7.18.2 react-router-dom: 7.18.2 @@ -168,7 +168,7 @@ importers: specifier: ^7.0.2 version: 7.0.2 undici: - specifier: ^7.29.0 + specifier: 7.29.0 version: 7.29.0 vite: specifier: ^8.2.1 @@ -473,7 +473,7 @@ importers: specifier: ^2.5.0 version: 2.5.0 undici: - specifier: ^7.29.0 + specifier: 7.29.0 version: 7.29.0 packages/replay-test: @@ -3442,8 +3442,8 @@ packages: pure-rand@8.4.2: resolution: {integrity: sha512-vvuOGgcuPJAirlHvuQw1TrOiw7ptaIXXmIbNuiNOY6lNGJJH49PQ1Kj4nd783nPdQhQdicgOjVI2yI/9BD6/Ng==} - qs@6.15.2: - resolution: {integrity: sha512-Rzq0KEyX/w/tEybncDgdkZrJgVUsUMk3xjh3t5bv3S1HTAtg+uOYt72+ZfwiQwKdysThkTBdL/rTi6HDmX9Ddw==} + qs@6.16.0: + resolution: {integrity: sha512-h6fhOIaRrID2CbEY2fqs+7t+UXZo+MLAnU5gRIq85uFtdiUPCdsApMlHhXogKVM4HM2DVbIjGNTTYH2OcmP1vA==} engines: {node: '>=0.6'} quansync@1.0.0: @@ -7067,8 +7067,9 @@ snapshots: pure-rand@8.4.2: {} - qs@6.15.2: + qs@6.16.0: dependencies: + es-define-property: 1.0.1 side-channel: 1.1.1 quansync@1.0.0: {} @@ -7500,7 +7501,7 @@ snapshots: dependencies: des.js: 1.1.0 js-md4: 0.3.2 - qs: 6.15.2 + qs: 6.16.0 tunnel: 0.0.6 underscore: 1.13.8 diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index 95aec9dfe5..69676f789f 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -11,12 +11,14 @@ minimumReleaseAgeExclude: # @limrun/api pins undici to an exact vulnerable version (7.24.7) even in its # latest release, so a direct bump can't clear the Dependabot alerts. Override # the transitive resolution instead; scoped to major 7 so any future undici 8 -# elsewhere in the tree is untouched. +# elsewhere in the tree is untouched. Exact, matching the direct pin in +# package.json: tsdown bundles undici into the published build, so a caret here +# would let lockFileMaintenance move the shipped bytes under an unchanged pin. overrides: - undici@7: '^7.29.0' + undici@7: 7.29.0 brace-expansion@5: '^5.0.9' fast-uri: 3.1.6 postcss: 8.5.23 - qs: 6.15.2 + qs@6: ^6.16.0 react-router: 7.18.2 react-router-dom: 7.18.2