chore(deps-dev): bump vitest from 4.0.16 to 4.1.0 #75
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Dependency Review | |
| # Runs on every PR targeting main. Diffs the PR's dependency manifest | |
| # against the GitHub Advisory Database and fails the check if the PR | |
| # introduces a package (or version bump) with a known high-severity | |
| # vulnerability. Also blocks license changes to incompatible licenses. | |
| # | |
| # This is the primary guard against "malicious dep swap" attacks where | |
| # a contributor's PR pins a legitimate package to a compromised version | |
| # or adds a typosquatted dependency. | |
| on: | |
| pull_request: | |
| branches: [main] | |
| permissions: | |
| contents: read | |
| pull-requests: write | |
| jobs: | |
| dependency-review: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - uses: actions/dependency-review-action@2031cfc080254a8a887f58cffee85186f0e49e48 # v4.9.0 | |
| with: | |
| fail-on-severity: high | |
| # Deny copyleft licenses incompatible with MIT distribution. | |
| deny-licenses: GPL-2.0, GPL-3.0, AGPL-3.0 | |
| comment-summary-in-pr: on-failure |