Zoltan Kochan 63c0b8eede chore: patch deepmerge@4.3.1 and ignore GHSA-gcqx-w48m-w2h4 (#17443) ...

deepmerge has no patched release upstream for GHSA-gcqx-w48m-w2h4. Patch
deepmerge@4.3.1 to reject __proto__ keys by name in mergeObject() across
index.js, dist/cjs.js, and dist/umd.js (TehShrike/deepmerge#274), and
ignore GHSA-gcqx-w48m-w2h4 in auditConfig.

Also use recentTimestamp() across checkDepsStatus.test.ts so mocked
sub-second mtimes never land on an exact second when Date.now() % 1000 === 0.

2026-10-28 01:41:11 +01:00

..

__fixtures__

…

__typecheck__

…

__typings__

…

__utils__

…

auth/commands

…

benchmarks

…

bins

…

building

…

cache

…

catalogs

…

cli

…

config

…

core

…

crypto

…

deps

…

docs

…

engine

…

exec

…

fetching

…

fs

…

global

…

hooks

…

installing

…

lockfile

…

log/group

…

modules-mounter/daemon

…

network

…

object

…

os

…

patching

…

pkg-manager/link-bins/test/fixtures/bin-owner-override

…

pkg-manifest

…

pnpm

…

registry-access

…

releasing

…

resolving

…

shell/path

…

store

…

testing

…

text

…

worker

…

workspace

…

yaml/document-sync

…

fix-duplicates.mjs

…