In an npm monorepo, only the root lockfile is authoritative. Workspace-specific
lockfiles were stale, couldn't benefit from root overrides, and were triggering
Dependabot false positives. Switching to **/package-lock.json gitignore pattern.
Also adds eslint peer dep overrides to frontends/postgres for standalone compatibility.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Update storybook packages to 10.2.17 in root, storybook/, frontends/postgres, frontends/workflowui
- Move @storybook/react-vite from postgres dependencies→devDependencies
- Add storybook version pinned overrides to resolve peer dep conflicts
- Remove storybook from root devDependencies (managed by workspaces)
- Add @esbuild-kit/core-utils@3.3.3-metabuilder.0 patched tarball to deployment/npm-patches/
- Update publish-npm-patches.sh to handle pre-patched local tarballs
- Add @esbuild-kit scoped registry in .npmrc pointing to Nexus
- Publish @esbuild-kit/core-utils@3.3.3-metabuilder.0 to Nexus (esbuild dep widened to >=0.18.20)
- 2 residual moderate vulns remain: esbuild dev-server in drizzle-kit (dev-only, no prod impact)
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
