依赖替换与重定向治理（resolutions-overrides-白名单）最佳实践

实现示例type Override = { name: string; target: string; version: string } const allowNames = new Set<string>(['lodash','express','react','vue','@example/core']) function semverValid(v: string): boolean { return /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/.test(v) } function valid(o: Override): boolean { return allowNames.has(o.name) && allowNames.has(o.target) && semverValid(o.version) } function evaluate(list: Override[]): { ok: boolean; errors: string[] } { const errors: string[] = [] for (const o of list) if (!valid(o)) errors.push(`override:${o.name}->${o.target}`) return { ok: errors.length === 0, errors } } 审计与CI门禁记录替换与重定向条目；命中非白名单或非精确版本直接阻断。变更需审批与回归校验；产线仅接受受控清单。