Michael Kriese

- https://github.com/nfarina/xmldoc/pull/79 patch required 😕

let's see if this is fixed upstream in next days

one more fix is required

this isn't easy to resolve. we use shlex to quote and pass it to node child process. so we don't do that cmd stuff directly

> @viceice what is the status on this? What is it waiting on to merge? Just says "Merging is blocked" for me waiting for another reviewer

it's important to note that's a small breaking change, because now the global env vars are trimmed to only allowed values. that's why I want a second pair of 👀

> @viceice @secustor perhaps we could have a different type of workaround group - not included with config:recommended - which is for these type of valid replacements which aren't drop-in?...

still needs discussion how to since the fork base branches with the upstream ones. should ideally be done without a local copy

we should refactor renovate first to extract the general fork handling to be first class citizen equal for all platforms, the each platform can implement the specific pieces needed. that...

The package file would also very helpful. We've a lot test fiuxtures on renovatebot repo and it's pretty hard to find the file to the vulnerable package. The current report...