root - chore: defense - drop tilde range preference - #486
Conversation
This repo uses caret ranges for direct dependencies. Remove the catalog item that claimed new runtime deps prefer ~. Co-authored-by: Jared Wray <me@jaredwray.com>
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #486 +/- ##
=========================================
Coverage 100.00% 100.00%
=========================================
Files 18 18
Lines 2760 2760
Branches 837 837
=========================================
Hits 2760 2760 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 4e7f7c9f34
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| - [x] Lockfile committed; CI installs with `pnpm install --frozen-lockfile` — PR #465 | ||
| - [x] Dependency-update tooling opens PRs only — never auto-merge — verified 2026-08-16 (no auto-merge config in-repo; upgrades via reviewed PRs) | ||
| - [x] New direct dependencies get human review; prefer `~` ranges over `^` — verified 2026-08-16 (all changes via PR; existing runtime deps stay on `^`; new runtime deps prefer `~`) | ||
|
|
There was a problem hiding this comment.
When this checklist is used to assess dependency hardening, deleting the combined entry removes the separately valid requirement that new direct dependencies receive human review, not merely the rejected preference for ~ ranges. The commit description itself distinguishes these two policies and says the PR-based review claim is true, so keep that portion as its own checklist item while dropping only the range recommendation.
Useful? React with 👍 / 👎.
2 participants
Summary
Remove the defense-in-depth checklist item that preferred
~ranges over^. This repo uses caret ranges for direct dependencies.Status update
DEFENSE_IN_DEPTH.md: drop “New direct dependencies get human review; prefer~ranges over^”.How this was checked off
It was marked done in PR #464 when the security-docs scaffold reconciled the defense-in-depth-nodejs catalog. The note was:
That mixed two things: PRs for dependency changes (true) with a catalog policy this repo does not follow. Every direct dependency in
package.jsonalready uses^. Nothing ever switched new runtime deps to~.Verification
package.jsondependencies and devDependencies all use^pnpm test— 17 files, 866 tests, 100% coverage