mirror of
https://github.com/makeplane/plane.git
synced 2026-07-09 12:00:38 +02:00
Resolves the sole open Dependabot alert (GHSA-gv7w-rqvm-qjhr, high): esbuild <0.28.1 lacks binary-integrity verification in its Deno install path, enabling RCE via NPM_CONFIG_REGISTRY. The pnpm `overrides` entry pinned the entire tree to esbuild 0.25.0; bump it to 0.28.1, which fixes all transitive paths (vite, vitest, tsx, vite-node, esbuild-register). Also bump turbo 2.9.14 -> 2.9.18 in the workspace catalog and the four pinned production Dockerfiles (web, live, admin, space). Verified: `pnpm audit` clean, admin react-router/vite build succeeds, @plane/codemods vitest suite 33/33 passing.