Skip to content

Align dependency policy and CI config - #7

Merged
RubenGlez merged 3 commits into
mainfrom
orchestrator/dependency-policy-cleanup
May 20, 2026
Merged

Align dependency policy and CI config#7
RubenGlez merged 3 commits into
mainfrom
orchestrator/dependency-policy-cleanup

Conversation

@RubenGlez

@RubenGlez RubenGlez commented May 20, 2026

Copy link
Copy Markdown
Owner

Summary

  • Migrate the repo from npm lockfile/install commands to pnpm
  • Add pnpm-workspace.yaml with minimumReleaseAge
  • Move CI/release Actions to v5
  • Scope audit to production dependencies
  • Allow required Electron/FFmpeg installer build scripts
  • Bump Electron to mature patched 41.6.1
  • Add pnpm overrides for vulnerable transitive dev tooling packages

Validation

  • pnpm install --frozen-lockfile
  • pnpm tsc
  • pnpm lint
  • pnpm audit --audit-level=low
  • GitHub PR checks: CI and Dependency Review passing

Note

  • blockExoticSubdeps is disabled for this repo because the existing Electron rebuild toolchain depends on @electron/node-gyp via a git tarball.

@RubenGlez
RubenGlez marked this pull request as ready for review May 20, 2026 11:31
@RubenGlez
RubenGlez merged commit 9c46415 into main May 20, 2026
2 checks passed
@RubenGlez
RubenGlez deleted the orchestrator/dependency-policy-cleanup branch May 20, 2026 11:32
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant