docs(dependency-audit): recommend quoting glob targets for portable scripts - #64
Merged
Merged
Conversation
… scripts Quote `"./packages/*"` in the examples so a POSIX shell doesn't expand it before the CLI does — the result is identical, but quoting keeps a package.json script portable to Windows shells (which don't expand globs). Verified shell-expanded and CLI-expanded runs produce byte-identical output, including under --collapse-root-cause.
Deploying mawesome with
|
| Latest commit: |
a0fd1a0
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://f63640f4.mawesome.pages.dev |
| Branch Preview URL: | https://docs-dependency-audit-glob-q.mawesome.pages.dev |
astro <6.4.6 has a Host-header SSRF (GHSA-2pvr-wf23-7pc7); the docs site pulled it transitively via @astrojs/starlight, failing `pnpm audit --audit-level=high` on CI. Bump the direct dependency to the patched line (6.4.8 is held back by the 3-day minimumReleaseAge cooldown). The site app doesn't publish, so no changeset.
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Recommend quoting glob targets (e.g.
"./packages/*") in thedependency-auditREADME and CLI reference, so the CLI — not the shell — does the expansion.Why
Follow-up to the cross-platform glob expansion (#61). On a POSIX shell an unquoted
./packages/*is expanded by the shell before the CLI sees it; on Windowscmd.exe/PowerShell it isn't. Both produce the same audit result (verified byte-identical, including under--collapse-root-cause), but quoting makes apackage.jsonscript portable: the CLI's own expansion runs identically everywhere, and it sidesteps the no-match/nullglob edge cases of an unquoted glob.This came out of review feedback on the Gutenberg consumer PR, where the script is now quoted to be Windows-safe.
Changes
docs/cli.mdexamples now quote the glob, with a short note on why.Verification
Ran the real Gutenberg
lint:published-depswith the quoted glob: it expanded the full../../packages/*tree (127 targets) and audited cleanly — same result as the unquoted form, now portable.