镜像站点 · 本页由第三方 GitHub 只读镜像提供,非 GitHub 官方站点,不接受任何登录或凭据输入。前往 github.com
Skip to content

chore: update dependency lockfile-lint to ^5.1.0 - #779

Merged
renovate[bot] merged 1 commit into
masterfrom
renovate/lockfile-lint-5.x
Oct 9, 2026
Merged

renovate[bot] merged 1 commit into
masterfrom
renovate/lockfile-lint-5.x

Conversation

@renovate

@renovate renovate Bot commented Oct 9, 2026

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
lockfile-lint (source) ^5.0.1 → ^5.1.0 age adoption passing confidence

Release Notes

lirantal/lockfile-lint (lockfile-lint)

v5.1.0

Compare Source

Minor Changes
  • #​222 578511e580a4c3c398ba7f26fc0465e449f39516 Thanks @​deveshsinghal09! - Add opt-in strict SHA-512 integrity validation that detects missing or malformed hashes while allowing Git, local directory, linked workspace and bundled dependencies.

    Exempt Yarn Classic GitHub codeload archives only when pinned to a full 40-hex
    commit. Resolve npm bundled dependencies against their nearest non-bundled
    ancestor before flattening: v2/v3 require a non-empty bundleDependencies
    declaration and an ancestor with valid SHA-512 integrity or an independent
    source exemption. npm v1 verifies the ancestor but cannot confirm the bundle
    declaration. Unverified flags and HTTP(S)/local tarball downloads still require
    integrity.

    Report Yarn Berry as one marked unsupported-format error. The CLI exits non-zero
    without calling an unsupported format a security finding; other failing
    validators still report their security findings.

    Require commit pins for all Git-source exemptions, and recognize percent-encoded
    local tarball extensions before granting directory exemptions.

Patch Changes

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
@renovate renovate Bot added the dependencies label Oct 9, 2026
@renovate
renovate Bot merged commit 2ca7c8a into master Oct 9, 2026
10 checks passed
@renovate
renovate Bot deleted the renovate/lockfile-lint-5.x branch October 9, 2026 14:50
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants