From a40ea159975ebedf3134460532c7ddc77d58f040 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Maciej=20W=C3=B3jcik?= Date: Thu, 9 Jul 2026 11:28:35 +0200 Subject: [PATCH 1/4] add shared renovate config --- renovate.json | 4 ++++ 1 file changed, 4 insertions(+) create mode 100644 renovate.json diff --git a/renovate.json b/renovate.json new file mode 100644 index 00000000..0f3a2535 --- /dev/null +++ b/renovate.json @@ -0,0 +1,4 @@ +{ + "$schema": "https://docs.renovatebot.com/renovate-schema.json", + "extends": ["github>DefGuard/ci-workflows//renovate/default.json"] +} From def5596d3e80405ca131def7db6f24096d061022 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Maciej=20W=C3=B3jcik?= Date: Thu, 9 Jul 2026 11:34:36 +0200 Subject: [PATCH 2/4] pin pnpm version --- package.json | 1 + web/package.json | 1 + 2 files changed, 2 insertions(+) diff --git a/package.json b/package.json index 18c8c1d5..bc46481f 100644 --- a/package.json +++ b/package.json @@ -1,4 +1,5 @@ { + "packageManager": "pnpm@11.9.0", "devDependencies": { "@tanstack/devtools-vite": "^0.3.12" } diff --git a/web/package.json b/web/package.json index 861df7ea..5ec3d290 100644 --- a/web/package.json +++ b/web/package.json @@ -2,6 +2,7 @@ "name": "web", "private": true, "version": "2.0.2", + "packageManager": "pnpm@11.9.0", "type": "module", "scripts": { "dev": "vite", From 7ee5d680344420ac3a35183a40b476601fba9a41 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Maciej=20W=C3=B3jcik?= Date: Thu, 9 Jul 2026 11:34:45 +0200 Subject: [PATCH 3/4] remove outdated ignores --- .trivyignore.yaml | 9 --------- 1 file changed, 9 deletions(-) diff --git a/.trivyignore.yaml b/.trivyignore.yaml index ba363f0c..8697da6a 100644 --- a/.trivyignore.yaml +++ b/.trivyignore.yaml @@ -1,10 +1 @@ vulnerabilities: - - id: GHSA-w5hq-g745-h8pq - expired_at: 2026-05-23 - statement: "Waiting for upstream patch in paraglide" - - id: CVE-2026-29111 - expired_at: 2026-05-31 - statement: "No fixed version available in debian:13-slim - waiting for Debian to backport systemd patch" - - id: CVE-2025-69720 - expired_at: 2026-05-31 - statement: "No fixed version available in debian:13-slim - waiting for Debian to release ncurses patch" From 6298a4c4c0f78ffaec229ae1ced1b1cd17cbf52b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Maciej=20W=C3=B3jcik?= Date: Thu, 9 Jul 2026 11:41:48 +0200 Subject: [PATCH 4/4] update GH workflows --- .github/workflows/lint-web.yml | 2 +- .github/workflows/release.yml | 8 +++----- 2 files changed, 4 insertions(+), 6 deletions(-) diff --git a/.github/workflows/lint-web.yml b/.github/workflows/lint-web.yml index a71cd7d3..b9cd32e9 100644 --- a/.github/workflows/lint-web.yml +++ b/.github/workflows/lint-web.yml @@ -37,9 +37,9 @@ jobs: - name: Install pnpm uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6 with: + package_json_file: web/package.json cache: true run_install: false - version: 11 - name: Install deps working-directory: web diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index d0e6b967..687a5763 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -94,9 +94,9 @@ jobs: - name: Install pnpm uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9 with: + package_json_file: web/package.json cache: true run_install: false - version: 11 - name: Build frontend working-directory: web @@ -353,16 +353,14 @@ jobs: - name: Install pnpm uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6 with: + package_json_file: web/package.json cache: true run_install: false - version: 11 - # Change to '--frozen-lockfile' once this gets fixed: - # https://github.com/pnpm/action-setup/issues/40 - name: Build frontend working-directory: web run: | - pnpm install --ignore-scripts --no-frozen-lockfile + pnpm install --ignore-scripts --frozen-lockfile pnpm build - name: Install Rust stable