Dependency security
Review dependency advisories without hiding affected paths.
pnpm check:security runs the registry audit and prints every advisory. security-advisories.json records each affected version and dependency path, the reachable operation, the blocked parent update and a review deadline.
A review covers only those paths and versions. New findings, higher severity, new paths and expired reviews fail CI. An audit that cannot reach the registry fails too. Fix compatible dependencies first; an upstream constraint needs an explicit assessment rather than an untested override. The three-day release cooldown remains in force.
Direct Actions and reusable workflows use immutable commit SHAs with version comments. Dependabot maintains the pairs. action-pins.test.ts prevents floating references from returning. Central workflow bodies belong to the workflows repository; a pinned caller does not make their floating transitive Actions immutable.
Reviewed security overrides target individual parent dependencies in pnpm-workspace.yaml. They remain subject to the release cooldown and compatibility checks. Nuxt DevTools also needs the compatibility patch because simple-git 4 exposes a named factory instead of its previous default export. Remove a pin and its related patch when the parent accepts a patched release.
These settings apply only to this workspace: installing @kirchdev/duxt does not transfer them to your project. Consumers must apply the relevant overrides in their own package manager's root configuration, including the DevTools patch if they upgrade its simple-git dependency. Check the installed graph with an audit and test the actual build and deployment adapter; this repository's passing audit is not a consumer audit. See pnpm's override scope.