mirror of
https://github.com/SigNoz/signoz.git
synced 2026-08-23 13:10:30 +01:00
dc836bb67c
#### Description - `tests/e2e` is a standalone pnpm project with no overrides of its own, so `eslint-plugin-playwright > eslint > minimatch` resolved a vulnerable `brace-expansion@5.0.5` (4 advisories, incl. CVE-2026-13149). - Adds `tests/e2e/pnpm-workspace.yaml` flooring it to `>=5.0.9 <6`, which stays inside `minimatch@10.2.5`'s `^5.0.5` range — no breaking bump, and bumping minimatch instead wouldn't help (10.2.6 only widens to `^5.0.8`). - `pnpm audit` in `tests/e2e` now reports no known vulnerabilities. - This also resolves the vulnerabilities reported by vanta #### Issues closed by this PR https://github.com/orgs/SigNoz/projects/39/views/20?pane=issue&itemId=230120135&issue=SigNoz%7Cengineering-pod%7C5925 #### Screenshots / Screen Recordings #### Additional Information Co-authored-by: Gaurav Tewari <tewarig@users.noreply.github.com>