fix(security): raise transitive dependency floors - #373

Merged

seonghobae merged 18 commits into

mainfrom

fix/security-transitive-overrides-20260820

Aug 25, 2026

Commits on Aug 20, 2026

fix(security): raise transitive dependency floors
seonghobae
committed
724b45b
test(security): define pnpm supply-chain policy
seonghobae
committed
868b88f
test(security): run pnpm supply-chain policy contract
seonghobae
committed
1e1fd96
fix(security): enforce pnpm supply-chain policy
seonghobae
committed
b70fb18
test(security): bound legacy trust-policy compatibility
seonghobae
committed
114315b
fix(security): bound legacy trust-policy compatibility
seonghobae
committed
735d618
test(security): move pnpm policy contract into canonical suite
seonghobae
committed
235535d
fix(ownership): release package manifest writer
seonghobae
committed
637a1c5
fix(ownership): keep security contract in canonical suite
seonghobae
committed
244e205
test(security): avoid dynamic regexp in policy parser
seonghobae
committed
93fab95
test(security): reject duplicate workspace policy scalars
seonghobae
committed
905b291
fix(security): fail closed on duplicate workspace policy keys
seonghobae
committed
6954201
test(package): reject symlinked consumer resolution escapes
seonghobae
committed
b666460
fix(package): canonicalize consumer resolution paths
seonghobae
committed
4a39d8a
test(package): execute symlink escape validators
seonghobae
committed
522200a
fix(package): validate paths before loading consumers
seonghobae
committed
41f9788

Commits on Aug 21, 2026

test(package): pin validated runtime entry loading
seonghobae
committed
3b5446a
fix(package): load validated canonical runtime entries
seonghobae
committed
c2db417