Implement pnpm trustPolicy for secure and delayed dependency updates
#2096 · Go · ★ 614 · Apache-2.0 · updated 4mo ago
Current Limitation Currently, the repository does not implement the 'trustPolicy' setting as recommended by pnpm. This means that dependency updates are not delayed, which exposes the project to supply chain vulnerabilities from rapidly published, potentially malicious package…
6/7 outside PRs mergedhas CONTRIBUTINGnobody circlingsomeone tried before
Cleared 1m ago