fix(deps): clear pnpm audit on main (unfixable deepmerge advisory)
Summary
Clears the pnpm audit failure in dependency-audit on main (run 41763096687), ahead of the org ruleset requiring dependency-audit / Audit gate (combsmith/.github#1470, #1406).
| Advisory | Severity | State on main | Action |
|---|---|---|---|
| GHSA-gcqx-w48m-w2h4 deepmerge 4.2.0ā4.3.1 | low | 4.3.1 via @expo/config (SDK 55) and jest-config 29 | Ignored in pnpm-workspace.yaml audit.ignore with a re-evaluation trigger. No patched deepmerge exists on npm (4.3.1 is latest; GitHub lists no patched version), so no upgrade or override can fix it. Only @expo/config 58 drops it, which is an Expo SDK major upgrade. |
| GHSA-g3hv-75wg-m249 minimatch | moderate | no longer matches | None. The advisory range is now >=7.0.0 <11.0.1; the lockfile resolves only minimatch 3.1.5 and 11.0.4 (the existing minimatch@>=9.0.0 <11.0.1 override covers 9.x/10.x). Local pnpm audit no longer reports it. |
deepmerge here merges developer-controlled app/jest config at build and test time, not runtime input.
govulncheck (not fixed here)
The govulncheck job on main is a tool crash, not a finding: panic: unexpected expr: *ast.KeyValueExpr in golang.org/x/tools@v0.29.0/go/ssa while building SSA for ./apps/api. The shared reusable pins govulncheck@v1.1.4 and installs Go stable (now 1.27.3) with GOTOOLCHAIN=local. Reproduced locally with v1.1.4 + Go 1.27.3 targeting linux/amd64; govulncheck v1.9.0 on the same toolchain reports No vulnerabilities found. for apps/api. The fix belongs in combsmith/.github dependency-audit-reusable.yml, so Audit gate on this PR will stay red until that lands.
Local checks
pnpm install --frozen-lockfile,pnpm run lint,pnpm run typecheck,pnpm run test: passpnpm audit --audit-level low: exit 0 (1 low (1 ignored) | 3 high (3 ignored))go vet,go build,go test ./...inapps/api: pass
š¤ Generated with Claude Code