Bump lint-staged to 17.0.2 and override @noble pins#417
Merged
Conversation
Update lint-staged 16.2.7 -> 17.0.2. @noble/hashes@1.7.0 and @noble/curves@1.8.0 were already in the lockfile when trustPolicy: no-downgrade was introduced; pnpm grandfathered them in by reusing the existing lockfile entries. Bumping lint-staged forces a fresh resolution that re-evaluates trust, which trips on those entries. Both are exact-pinned by @walletconnect/relay-auth@1.1.0 (pulled in via wagmi) and were published on 2025-01-03 without provenance attestation. Override to the next attested patches (1.8.0 / 1.8.1), which are already present elsewhere in the tree. Drop the overrides once relay-auth ships a release that doesn't pin those: WalletConnect/walletconnect-utils#244
Deploying with
|
| Status | Name | Latest Commit | Preview URL | Updated (UTC) |
|---|---|---|---|---|
| ✅ Deployment successful! View logs |
vetro-landing | 8c9939c | Commit Preview URL Branch Preview URL |
May 13 2026, 06:33 PM |
Deploying with
|
| Status | Name | Latest Commit | Preview URL | Updated (UTC) |
|---|---|---|---|---|
| ✅ Deployment successful! View logs |
vetro-api-staging | 8c9939c | Commit Preview URL Branch Preview URL |
May 13 2026, 06:34 PM |
Deploying with
|
| Status | Name | Latest Commit | Preview URL | Updated (UTC) |
|---|---|---|---|---|
| ✅ Deployment successful! View logs |
vetro-storybook | 8c9939c | Commit Preview URL Branch Preview URL |
May 13 2026, 06:34 PM |
Deploying with
|
| Status | Name | Latest Commit | Preview URL | Updated (UTC) |
|---|---|---|---|---|
| ✅ Deployment successful! View logs |
vetro-web-staging | 8c9939c | Commit Preview URL Branch Preview URL |
May 13 2026, 06:35 PM |
There was a problem hiding this comment.
Pull request overview
This PR updates the repo’s commit-time linting workflow by bumping lint-staged to 17.0.2, and adds pnpm overrides to avoid untrusted exact-pinned @noble/* versions pulled in via @walletconnect/relay-auth.
Changes:
- Bump
lint-stagedfrom16.2.7to17.0.2. - Add pnpm overrides to redirect
@noble/hashes@1.7.0and@noble/curves@1.8.0to attested releases. - Regenerate
pnpm-lock.yamlto reflect the new resolution (including the overrides).
Reviewed changes
Copilot reviewed 2 out of 3 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| pnpm-workspace.yaml | Adds pnpm overrides to redirect pinned @noble/* versions and documents the rationale. |
| pnpm-lock.yaml | Records the overrides and updates the dependency resolution after the lint-staged bump. |
| package.json | Bumps root devDependency lint-staged to 17.0.2. |
Files not reviewed (1)
- pnpm-lock.yaml: Language not supported
Comments suppressed due to low confidence (1)
pnpm-lock.yaml:16053
- The re-resolution also changes ox@0.6.7 to use
@noble/curves1.8.1 (was 1.9.7 previously per diff). Please verify this version change is expected and doesn’t introduce behavior differences; if not, consider pinning/overriding@noble/curvesto keep the prior resolved version for consumers that can use it.
ArturDolzan
approved these changes
May 14, 2026
gabmontes
approved these changes
May 14, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Bumps
lint-stagedfrom16.2.7to17.0.2. The major bump is dev-only (runs at commit time), audited via/review-dep-update: no install hooks, no new network/credential surface, nativepidtreeremoved, replacedcommander/nano-spawn/micromatchwith built-innode:util.parseArgs/tinyexec/picomatch. Engine bump tonode >=22.22.1is satisfied by our.nvmrc(24).The bump forces a fresh pnpm resolution.
@noble/hashes@1.7.0and@noble/curves@1.8.0were already in the lockfile whentrustPolicy: no-downgradewas introduced in #414 — pnpm grandfathered them in by reusing the existing entries — but the re-resolution re-evaluates trust and rejects them. Both are exact-pinned by@walletconnect/relay-auth@1.1.0(pulled in transitively viawagmi) and were published on 2025-01-03 without provenance attestation. This PR redirects each to the next attested patch (1.8.0/1.8.1) — versions already present elsewhere in the tree. Drop these overrides once relay-auth ships a release that doesn't pin those: WalletConnect/walletconnect-utils#244Screenshots
N/A — no UI changes.
Related issue(s)
No related issue.
Checklist