security: stricter pnpm config blockExoticSubdeps & trustPolicy by Sheraff · Pull Request #1166 · TanStack/virtual · GitHub
Skip to content

security: stricter pnpm config blockExoticSubdeps & trustPolicy - #1166

Open
Sheraff wants to merge 1 commit into
TanStack:mainfrom
Sheraff:stricter-pnpm-deps-config
Open

Sheraff wants to merge 1 commit into
TanStack:mainfrom
Sheraff:stricter-pnpm-deps-config

Conversation

@Sheraff

@Sheraff Sheraff commented May 17, 2026

Copy link
Copy Markdown
Contributor

Summary

  • Enable pnpm's no-downgrade trust policy.
  • Block exotic transitive dependencies with blockExoticSubdeps.
  • Remove the redundant provenance-action downgrade CI job.

Validation

  • pnpm install --frozen-lockfile

@Sheraff
Sheraff requested a review from a team as a code owner May 17, 2026 14:01
@coderabbitai

coderabbitai Bot commented May 17, 2026

Copy link
Copy Markdown

@nx-cloud

nx-cloud Bot commented May 17, 2026 •

Copy link
Copy Markdown

View your CI Pipeline Execution ↗ for commit 33a653c

Command Status Duration Result
nx affected --targets=test:sherif,test:knip,tes... ✅ Succeeded 7s View ↗
nx run-many --target=build --exclude=examples/** ✅ Succeeded 18s View ↗

☁️ Nx Cloud last updated this comment at 2026-05-17 14:02:34 UTC

@pkg-pr-new

pkg-pr-new Bot commented May 17, 2026

Copy link
Copy Markdown

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant