Skip to content

feat(dependabot-policy): review-only @microsoft/tui-test in claude-code-plugins #875

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
kyle-sexton wants to merge 2 commits into
base: main
Choose a base branch
from
Draft

feat(dependabot-policy): review-only @microsoft/tui-test in claude-code-plugins #875

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
cce7012
feat(dependabot-policy): review-only @microsoft/tui-test in claude-co…
kyle-sexton Oct 24, 2026
63186f5
docs(dependabot-policy): cite the engine load and claude start as one…
kyle-sexton Oct 24, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 9 additions & 0 deletions components/dependabot-policy/policy.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -68,6 +68,15 @@
"reviewed": "2026-10-18",
"basis": ".github/actions/resolve-config/action.yml:159 installs this lockfile and :160 runs resolve-config.mjs, whose resolve.mjs:8 loads yaml to parse the lane config inside credentialed CI lanes; in pr-merge.yml:210-215 its output sets the permissions the lane token is minted with at :261, so a hijacked release can widen that token.",
"control": "docs/conventions/pr-pipeline/README.md#review-only-dependencies"
},
{
"repository": "melodic-software/claude-code-plugins",
"ecosystem": "npm",
"directory": "/plugins/harness-ops/skills/control-claude-code/driver",
"dependency": "@microsoft/tui-test",
"reviewed": "2026-10-24",
"basis": "plugins/harness-ops/skills/control-claude-code/driver/driver.mjs:245 installs this lockfile on the user's machine, :420-422 load the engine and its per-platform native binary (package-lock.json:22-30) into the session holder and start claude in it after :87 clears the API credential variables, so the session runs on the saved claude.ai subscription login and a hijacked release runs beside it.",
"control": "docs/conventions/pr-pipeline/README.md#review-only-dependencies"
}
],
"excludeSemverMajor": true,
Expand Down
Loading