mirror of
https://github.com/langchain-ai/langgraphjs.git
synced 2026-07-19 13:17:39 -04:00
John Kennedy
a34543a0dd
## Summary - Add Socket optimized registry overrides for supported transitive dependencies. - Regenerate the root pnpm lockfile with the Socket registry packages. - Add Socket GitHub App configuration scoped to dependency manifest and lockfile changes. ## Test plan - `sfw pnpm install --lockfile-only --no-frozen-lockfile` - `git diff --check` - JSON/YAML parsing for `package.json` and `socket.yml` The install reported existing workspace peer/deprecation warnings and a missing docs patch path. --------- Co-authored-by: John Kennedy <jkennedyvz@users.noreply.github.com>
31 lines
712 B
YAML
31 lines
712 B
YAML
# Optional Socket GitHub App configuration.
|
|
# Docs: https://docs.socket.dev/docs/socket-yml
|
|
# Only takes effect once the Socket GitHub app is installed on this repo.
|
|
version: 2
|
|
|
|
# Only run PR alert scans when dependency manifests or lockfiles change.
|
|
triggerPaths:
|
|
- "package.json"
|
|
- "pnpm-lock.yaml"
|
|
- "**/package.json"
|
|
- "**/pnpm-lock.yaml"
|
|
|
|
issueRules:
|
|
malware: true
|
|
installScripts: true
|
|
telemetry: true
|
|
troll: true
|
|
gitDependency: true
|
|
httpDependency: true
|
|
hasNativeCode: true
|
|
shellScriptOverride: true
|
|
invalidPackageJSON: true
|
|
unresolvedRequire: true
|
|
|
|
githubApp:
|
|
enabled: true
|
|
dependencyOverviewEnabled: true
|
|
ignoreUsers:
|
|
- "dependabot[bot]"
|
|
- "github-actions[bot]"
|