Repository navigation
Update dependencies to avoid compromised versions - #8
Merged
Merged
Conversation
Mirror the uv exclude-newer setting from the Python template so new npm releases are only accepted after 30 days. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Set engines.node to >=26.12.1 (October 2026 security release) and engine-strict for npm. Add pnpm minimumReleaseAge (30 days) next to the npm min-release-age setting, and document both in the README. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
TS: pin pnpm and all devDependencies to exact versions that are at least 30 days old, within their current major versions. Python: require uv >= 0.13.4 (eMudhra/emSign CA incident), exempt certifi from exclude-newer, and update pre-commit-hooks to v6.0.0. Document how to exempt urgent security fixes from the release delay. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Move pnpm, ESLint, TypeScript, secretlint, knip, jscpd and lint-staged to the newest major versions that are at least 30 days old. This removes the braces advisory (GHSA-vfj7-8cjw-p6xm) that reached the template through fast-glob. TypeScript stays at 6.0.3 because typescript-eslint 8.x does not support TypeScript 7. Also untrack an accidental .DS_Store. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
jvdgoltz
force-pushed
the
ts-npm-min-release-age
branch
from
October 22, 2026 12:44
e7c06e4 to
6b1e5a8
Compare
- secretlint: replace secretlint.config.mjs, which secretlint never loads, with .secretlintrc.json. - ESLint: use defineConfig from eslint/config instead of the deprecated tseslint.config, and disable type-aware rules for .mjs config files. - Knip: drop the redundant @typescript-eslint/parser and eslint-plugin packages (typescript-eslint provides them) and declare the secretlint preset, which only the rc file references. - Prettier: ignore the generated pnpm-lock.yaml and format the configs. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
sannewielinga-kai
left a comment
sannewielinga-kai
left a comment
Contributor
There was a problem hiding this comment.
Good that you're implementing these defaults, thank you :)
I left some suggestions/comments. The main one is that right now this PR would block Node 24, which is still supported until 2028, and Vercel uses it.
And while I was testing this I came across two minor things that could be useful for a follow-up:
- currently get-started deletes
templates/, but.github/dependabot.ymlstill points at/templates/pyand/templates/ts - root config files such as
vitest.config.tsare outsidetsconfig.json, which will cause typed linting to fail
Mainly to allow Node 24 Co-authored-by: sannewielinga-kai <sanne.wielinga@kickstartai.org>
- get-started: after moving the template files, keep only the chosen stack's Dependabot entry and set its directory to /. - TS template: include *.config.ts in tsconfig.json so typed linting works for root config files such as vitest.config.ts. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Collaborator
Author
|
Accepted your suggestions. Wasn't aware that vercel doesn't support Node26 yet. Also pushed a commit with the two other findings. |
sannewielinga-kai
previously approved these changes
Oct 23, 2026
- Add a GitHub workflow that runs the Python and TypeScript template checks. Actions are pinned to commit SHAs. - Add CHANGELOG.md for 0.1.0 and 0.2.0, and a rule in AGENTS.md to keep it current. - Add version 0.2.0 to the Python and TypeScript templates. - get-started: adapt the workflow to the project, set the project name and reset the version to 0.1.0 with an empty changelog. - Fix missing final newlines and trailing whitespace found by the hooks.
Branch protection requires a check named validate. Add a validate job that fails when the python or typescript job fails, is cancelled or is skipped.
The protect-main ruleset now requires the python and typescript checks directly.
npm audit reported GHSA-mrhx-c7xc-m3w5 (zod, via knip) and GHSA-w74x-v6f9-j3xg (fast-uri, via ajv). The fixed versions are newer than 30 days. pnpm exempts the exact fixed versions; npm only supports package names. AGENTS.md now says to remove such exemptions once the fixed version is older than the delay.
certifi releases are trust-store fixes, so the short delay stays. The AGENTS.md rules now apply only to temporary exemptions.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.