From e23780eeef09e69deeb5b340425af278df6b8217 Mon Sep 17 00:00:00 2001 From: Tom King Date: Sun, 4 Oct 2026 21:59:12 -0500 Subject: [PATCH] ci: audit production dependencies only in release workflow Dev-only advisories in markdownlint-cli2's transitive dependencies (braces, micromatch) have no patched upstream release. Production dependencies are what ship in the release archive and SBOM, which already use --omit=dev. Co-Authored-By: Claude Sonnet 5 --- .github/workflows/release.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index da40163..128ef9c 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -41,7 +41,7 @@ jobs: cache: 'npm' - name: Security Audit - run: npm audit --audit-level=moderate + run: npm audit --omit=dev --audit-level=moderate - name: Install Dependencies and Build run: |