feat(resolve): full Node.js '#' subpath-imports (package.json "imports") support - #7028

Merged

proggeramlug merged 32 commits into

PerryTS:mainfrom

jdalton:feat/subpath-imports

Jul 30, 2026

Commits on Jul 28, 2026

build: 7-day supply-chain soak + pinned security tooling
jdalton
committed
93c2b36
docs: changelog fragment for #6912
jdalton
committed
8efeaff
ci(zizmor): run the SRI-pinned binary instead of the marketplace action
jdalton
committed
3b73baf
deps(sfw): bump firewall pins to 1.14.0 via dated soakBypass
jdalton
committed
239e573
deps(tools): bump zizmor 1.28.0, pnpm 11.15.1, npm 12.0.1 — newest soaked releases
jdalton
committed
c9dc5f5
docs: fragment says rack-pinned zizmor, not marketplace action
jdalton
committed
71b13f6
feat(soak): auto-prune expired bypass annotations — fixer + scheduled bot PR
jdalton
committed
fc7e3f1
ci(soak-autofix): bind the artipacked ignore to the checkout line
jdalton
committed
6cc276e
ci: pin actions/* to latest release-tag SHAs in the new security workflows
jdalton
committed
4fe87ad
fix(soak): expired annotations warn instead of failing — stale is not unsafe
jdalton
committed
07ca0a9
fix(soak): address review-bot findings across the port
jdalton
committed
e3dda61
fix(sfw): export SFW_UNKNOWN_HOST_ACTION=ignore in the shims
jdalton
committed
d882d5a
fix(soak): take review fixes surfaced on the aube twin
jdalton
committed
aa3e2f2
docs(soak): align prose with warn-not-fail; source-cite the unknown-host comment
jdalton
committed
3255e41
fix(soak): never prune a wrong-arithmetic annotation as "cleared"
jdalton
committed
3a8f00b
fix(soak): downloads fall back to unauthenticated and retry once on 5xx
jdalton
committed
20a26b0
fix(soak): stop the fixers reformatting files they do not own
jdalton
committed
c1eed51
fix(soak): stop the fixers reformatting files they do not own
jdalton
committed
88169c6
feat(soak): gate npm's min-release-age-exclude entries too
jdalton
committed
ce95e57
fix(soak): fail loudly when cargo silently ignores min-publish-age
jdalton
committed
b67907d
feat(soak): explain a window-blocked cargo re-resolution, refuse the env bypass
jdalton
committed
c3d27e0
fix(soak): take the adversarial-review findings
jdalton
committed
369dadf
fix(soak): take the review findings — one is a regression I introduced
jdalton
committed
c1ff686

Commits on Jul 29, 2026

fix(compile): survive binary/workspace skew and complete the surfaces a real npm CLI needs
jdalton
committed
f8c6baf
docs: changelog fragment for #7021
jdalton
committed
e8e529d
feat(resolve): full Node.js '#' subpath-imports (package.json "imports") support
jdalton
committed
7bedfe2
docs: key the changelog fragment to PR #7028
jdalton
committed
107d8f7
fix: address stacked stdlib review
Ralph Küpper
committed
13c235f
fix: address subpath imports review
Ralph Küpper
committed
b9fef02
Merge main into feat/subpath-imports
Ralph Küpper
committed
bd379e1

Commits on Jul 30, 2026

Merge remote-tracking branch 'origin/main' into maint/pr-7028
Ralph Küpper
committed
d68df30
Merge remote-tracking branch 'origin/main' into maint/pr-7028
Ralph Küpper
committed
cee7b45