Repository navigation
Repair the docs minimatch audit without disabling the check - #225
Merged
Merged
Conversation
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The docs audit fails on minimatch through Eleventy's asset copier. Pin patched minimatch 11.0.3 only under
@11ty/recursive-copy, whose call site uses the supportedmatch()API. Keep the moderate audit threshold and existing Eleventy version. Declare Node 20 or 22+ for the private docs toolchain to match the resolved dependencies; PHP requirements are unchanged.Fresh
npm ci --ignore-scriptsandnpm audit --audit-level=moderatereport zero vulnerabilities. Local Node 22.22.1 / PHP 8.3.36 qualification passes docs examples, the completecomposer docsbuild, all 374 pages / 16 guide destinations and links, and analytics checks. The unchanged PHP vendor graph was reused read-only; hosted CI retains its normal fresh install, offline link and browser checks on Node 24.Only the docs package manifest and lock change. This main-branch repair is independent of #219's native backend qualification and creates no SDK release.
Fixes #224.