fix(deps): override defu >=6.1.5 (prototype pollution CVE)

jdalton · jdalton · commit 41cd21b418b8 · 2026-04-04T09:21:39.000-04:00
diff --git a/package.json b/package.json
@@ -145,6 +145,7 @@
       "aggregate-error": "catalog:",
       "ansi-regex": "catalog:",
       "brace-expansion": "catalog:",
+      "defu": ">=6.1.5",
       "emoji-regex": "catalog:",
       "es-define-property": "catalog:",
       "es-set-tostringtag": "catalog:",
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
@@ -1,3 +1,8 @@
+settings:
+  minimumReleaseAge: 10080
+  minimumReleaseAgeExclude:
+    - defu
+
 packages:
   - packages/*
   - '!packages/package-builder/build'
