Revise security policy and upgrade development dependenciesds#42
Conversation
Updated security policy with contact information and supported versions.
Updated security policy with contact information and supported versions.
Updates include: - Trunk linter tools (actionlint, checkov, eslint, prettier, trufflehog) - Runtime versions (bun 1.3.13, node 24.15.0, rust 1.95.0) - Nuxt ecosystem packages and core dependencies - Development tools (playwright, vitest, wrangler) - VSCode extension recommendations expanded Removes deprecated Nuxt modules (@nuxt/a11y, @nuxt/hints) and streamlines postinstall scripts. Adds Vite optimization for Vue devtools and updates worker configuration types with new Cloudflare platform features including AI Search, Artifacts, Flagship feature flags, and Stream bindings.
Deploying with
|
| Status | Name | Latest Commit | Preview URL | Updated (UTC) |
|---|---|---|---|---|
| ✅ Deployment successful! View logs |
affirm-staging | 5ce8c60 | Commit Preview URL Branch Preview URL |
Apr 29 2026, 01:26 AM |
There was a problem hiding this comment.
Pull request overview
Adds a project security policy and simplifies the Bun postinstall flow by removing Trunk install/upgrade steps.
Changes:
- Added
SECURITY.mdwith supported-versions and vulnerability reporting guidance. - Updated
package.jsonpostinstallto remove Trunk install/upgrade steps and only run prepare, types, and formatting.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
| package.json | Simplifies postinstall by removing Trunk install/upgrade steps. |
| SECURITY.md | Introduces a security policy with reporting instructions. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| "lint:trunk:fix": "bun run trunk check -a --fix", | ||
| "lint:types": "bun run tsc --noEmit", | ||
| "postinstall": "bun run-s postinstall:trunk:install postinstall:trunk:upgrade postinstall:prepare types format", | ||
| "postinstall": "bun run-s postinstall:prepare types format", |
There was a problem hiding this comment.
postinstall no longer runs postinstall:trunk:install / postinstall:trunk:upgrade, but project docs still state that the postinstall hook “sets up Trunk” (README.md:107, GETTING-STARTED.md:147). Either update those docs, or adjust the install flow so Trunk is still initialized before format/format:trunk runs during postinstall.
| "postinstall": "bun run-s postinstall:prepare types format", | |
| "postinstall": "bun run-s postinstall:prepare types postinstall:trunk:install format", |
| "lint:trunk:fix": "bun run trunk check -a --fix", | ||
| "lint:types": "bun run tsc --noEmit", | ||
| "postinstall": "bun run-s postinstall:trunk:install postinstall:trunk:upgrade postinstall:prepare types format", | ||
| "postinstall": "bun run-s postinstall:prepare types format", |
There was a problem hiding this comment.
PR title mentions upgrading development dependencies, but this change set doesn’t update any dependency/devDependency versions in package.json. Consider updating the PR title/description to match the actual changes, or include the intended dependency upgrades.
| no releases yet. | ||
|
|
There was a problem hiding this comment.
“Supported Versions” currently just says “no releases yet.” which is ambiguous for reporters. Consider stating explicitly what is supported (e.g., default branch / latest commit) and, if applicable, providing a simple supported-versions table (as GitHub’s SECURITY.md template expects). Also capitalize the sentence start.
| no releases yet. | |
| | Version | Supported | | |
| | ------- | ------------------ | | |
| | Default branch / latest commit | :white_check_mark: | | |
| There are no tagged releases yet. |
This pull request introduces a security policy for the project and updates the postinstall script in
package.jsonto simplify the installation process. The main changes are summarized below:Security Policy:
SECURITY.mdfile outlining supported versions and instructions for reporting vulnerabilities, including a contact email and a request for responsible disclosure.Build Process:
postinstallscript inpackage.jsonto remove trunk-related installation and upgrade steps, streamlining the postinstall process to only run preparation, type checking, and formatting tasks.