Skip to content

[Snyk] Fix for 1 vulnerabilities #1179

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
onsails wants to merge 1 commit into
base: dev
Choose a base branch
from
Open

[Snyk] Fix for 1 vulnerabilities #1179

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 18 additions & 0 deletions .snyk
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,18 @@
# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.
version: v1.25.1
ignore: {}
# patches apply the minimum changes required to fix a vulnerability
patch:
SNYK-JS-LODASH-567746:
- tailwind > datasette > lodash:
patched: '2026-02-12T13:52:47.935Z'
id: SNYK-JS-LODASH-567746
path: tailwind > datasette > lodash
- tailwind > lodash:
patched: '2026-02-12T13:52:47.935Z'
id: SNYK-JS-LODASH-567746
path: tailwind > lodash
- tailwind > flaschenpost > lodash:
patched: '2026-02-12T13:52:47.935Z'
id: SNYK-JS-LODASH-567746
path: tailwind > flaschenpost > lodash
11 changes: 7 additions & 4 deletions package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@
"lint": "pnpm exec nx run-many --target lint --verbose",
"test": "pnpm exec nx run-many --target test --verbose",
"format": "pnpm exec prettier --write '**/*.{ts,js,tsx,jsx,cjs,mjs,css,json,md,mdx,html}'",
"prepare": "pnpm exec husky",
"prepare": "pnpm run snyk-protect && pnpm exec husky",
"tolgee": "dotenv -e .env -- tolgee",
Comment on lines +18 to 19
Copy link

Copilot AI Feb 12, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This PR changes package.json (adds @snyk/protect, scripts, and snyk: true) but does not update pnpm-lock.yaml (the repo has one). Please regenerate and commit the updated lockfile so installs/CI pick up the same dependency graph and the new prepare step doesn’t reference missing binaries.

Copilot uses AI. Check for mistakes.
"tolgee:compare": "pnpm tolgee compare --config ./apps/shell/.tolgeerc.js",
"tolgee:sync": "pnpm tolgee sync --config ./apps/shell/.tolgeerc.js",
Expand All @@ -24,7 +24,8 @@
"tolgee:extract:check": "pnpm tolgee extract check --config ./apps/shell/.tolgeerc.js",
"tolgee:extract:print": "pnpm tolgee extract print --config ./apps/shell/.tolgeerc.js",
"storybook": "pnpm exec nx storybook storybook",
"build-storybook": "pnpm exec nx build-storybook storybook"
"build-storybook": "pnpm exec nx build-storybook storybook",
"snyk-protect": "snyk-protect"
},
"dependencies": {
"@auth0/auth0-react": "2.3.0",
Expand Down Expand Up @@ -91,7 +92,8 @@
"vanilla-cookieconsent": "2.9.2",
"viem": "2.43.1",
"wagmi": "2.17.5",
"zod": "3.24.2"
"zod": "3.24.2",
"@snyk/protect": "latest"
Copy link

Copilot AI Feb 12, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@snyk/protect is set to "latest", which breaks reproducible installs and conflicts with the repo’s save-exact=true setting. Please pin this to an explicit version (and keep it updated via normal dependency bumps) instead of using latest.

Copilot uses AI. Check for mistakes.
},
"devDependencies": {
"@commitlint/cli": "19.7.1",
Expand Down Expand Up @@ -196,5 +198,6 @@
"@isaacs/brace-expansion@<=5.0.0": ">=5.0.1",
"webpack@>=5.49.0 <=5.104.0": ">=5.104.1"
}
}
},
"snyk": true
}
Loading