chore(deps): bump vite-plus to v0.1.24#8
Conversation
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates the pnpm-workspace.yaml file to use specific preview URLs for vite, vitest, and vite-plus in the catalog. It also introduces a minimumReleaseAge configuration set to 60, along with an exclusion list and blockExoticSubdeps set to false. Feedback on this change highlights that minimumReleaseAge is measured in seconds, meaning a value of 60 represents only one minute, which is insufficient for security purposes; it is recommended to increase this value.
| allowedVersions: | ||
| vite: '*' | ||
| vitest: '*' | ||
| minimumReleaseAge: 60 |
There was a problem hiding this comment.
The minimumReleaseAge configuration in pnpm is specified in seconds. Setting it to 60 (1 minute) is too short to provide any effective protection against newly published malicious packages (supply chain attacks). If the intention was 60 minutes, it should be set to 3600. If it was 24 hours, it should be 86400.
minimumReleaseAge: 3600
commit: |
fengmk2
changed the title
1 participant
Summary
Bump
vite-plusand related packages to the pkg.pr.new prerelease build for v0.1.24.Updated where applicable:
vite-plus-> pkg.pr.newvite/vitestaliases and overrides ->@voidzero-dev/vite-plus-core/@voidzero-dev/vite-plus-test@voidzero-dev/vite-plus-*direct deps,overrides/resolutions/pnpm.overrides/ catalogsminimum-release-agewith vite-plus stack excluded (pnpm / npm / bun / yarn as applicable)pnpm.*package.json fields intopnpm-workspace.yamlwhere presentTest plan