maximus/simpl-liste
1
0
Fork 0
Code Issues 4 Pull requests Projects Releases 20 Packages Wiki Activity Actions

fix(security): scope http-cache-semantics floor to major 4

Browse source 
Review follow-up on #131: a blanket override would force any future 5.x
consumer down to 4.x. The version-scoped key keeps the floor within the
current major, like postcss-selector-parser. No lockfile change.

Refs #128

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
le king fu 2026-10-05 19:34:25 -04:00
parent 62efdba22e
commit cb53a43422
2 changed files with 2 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
package.json
View file

@ -72,7 +72,7 @@
"uuid": "^11.1.1",
"postcss": "^8.5.18",
"postcss-selector-parser@^6.0.0": "^6.1.3",
"http-cache-semantics": "^4.3.0",
"http-cache-semantics@^4.0.0": "^4.3.0",
"js-yaml@^3.0.0": "^3.15.2",
"js-yaml@^4.0.0": "^4.3.2",
"brace-expansion@^1.0.0": "^1.1.21",

2
tests/smoke.test.cjs
View file

@ -307,7 +307,7 @@ check('every installed undici copy is >= 6.28.1', () => {
});
// --- Override floors (#128, #129) ---
// http-cache-semantics: blanket floor, a single copy (@expo/ngrok > got).
// http-cache-semantics: version-scoped to major 4, a single copy (@expo/ngrok > got).
// postcss-selector-parser: version-scoped to major 6 (tailwindcss@3 pipeline);
// any other major is unexpected and must fail loudly.