fix(deps): raise stale pnpm override floors to current advisory patched versions - #2446
fix(deps): raise stale pnpm override floors to current advisory patched versions#2446dcccrypto wants to merge 1 commit into
Conversation
…ed versions `pnpm audit --audit-level=high` is a blocking step in the Security Tests job. Several override floors in pnpm.overrides were written against older advisories and have since drifted *below* the patched version, so they no longer protect anything: axios >=1.15.2 -> GHSA-gcfj-64vw-6mp9 needs >=1.18.0 undici >=7.24.0 -> GHSA-vmh5-mc38-953g needs >=7.28.0 vite >=7.3.2 -> GHSA-fx2h-pf6j-xcff needs >=8.0.16 brace-expansion >=5.0.5 -> GHSA-3jxr-9vmj-r5cp needs >=5.0.7 and three packages had no override at all: protobufjs (2 criticals), js-yaml, vitest. Each range is upper-bounded to its current major, following the existing `fast-uri: '>=3.1.2 <4'` convention. An unbounded `undici: '>=7.28.0'` resolves to 8.x, which jsdom@28 cannot load — that breaks the whole app test run with MODULE_NOT_FOUND on jsdom-dispatcher. vite is declared explicitly in app/devDependencies because it is otherwise only present as an auto-installed peer of @vitejs/plugin-react, and pnpm will not re-resolve a locked peer from an override alone — it stayed pinned at the vulnerable 8.0.5 until the dependency was made explicit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
Correction to my own PR description — I got the mechanism wrong. I wrote that It is not a path filter. The job is gated on security-tests:
if: needs.detect-packages.outputs.has_packages == 'true'
What this does not change: the vulnerabilities are real and present in the dependency tree What it does change: merging this will not turn any check green, because the check does not run. Please review it as a dependency-hygiene fix, not as a CI unblock. The wider problem — no tests of any kind run in CI on |
|
Independent verification — not an approval (QA/Security own that). Safe at compile level; one sequencing gap worth knowing given the two major bumps. What I verifiedThis PR's own CI is green on the bumps: Build & Fast Tests, Type Check, and ✅ Merge Gate all SUCCESS. Since the install uses The part that isn't fully exercised:
|
1 participant
Problem
pnpm audit --audit-level=highis a blocking step in theSecurity Testsjob. On currentplaygroundit fails hard:This is not visible on recent PRs only because that job is path-filtered and has been skipping — e.g. #2444 shows
Security Tests skipping. The next PR that actually touches a filtered path will hit a wall.The root cause is one coherent pattern rather than 13 unrelated findings: several override floors were written against older advisories and have since drifted below the patched version, so they no longer protect anything they claim to.
axios>=1.15.2>=1.18.0— GHSA-gcfj-64vw-6mp9undici>=7.24.0>=7.28.0— GHSA-vmh5-mc38-953g (+2 more)vite>=7.3.2>=8.0.16— GHSA-fx2h-pf6j-xcffbrace-expansion>=5.0.5>=5.0.7— GHSA-3jxr-9vmj-r5cpPlus three with no override at all:
protobufjs(2 criticals + 5 highs),js-yaml,vitest(1 critical).Fix
Raise the four stale floors, add the three missing ones, and upper-bound every range to its current major, following the
fast-uri: '>=3.1.2 <4'convention already in this file.Two findings worth calling out
1. Unbounded ranges are not safe here — I broke the test suite proving it.
My first attempt used a bare
undici: '>=7.28.0'. That resolves to undici@8.8.0, whose module layoutjsdom@28cannot load. The entire app suite collapsed:Bounding to
>=7.28.0 <8pinsundici@7.28.0and the suite runs normally. Every range in this change is bounded for the same reason.2. An override alone could not move
vite.viteis not a declared dependency anywhere — it exists only as an auto-installed peer of@vitejs/plugin-react. pnpm wrote the new constraint into the lockfile'soverrides:block and into the recordedpeerDependencies, but kept resolving the locked peer at the vulnerable8.0.5.pnpm update vite -rand a scoped'@vitejs/plugin-react>vite'override both failed to shift it.Declaring
viteexplicitly inapp/devDependenciesis what actually moves it. Note the production build isnext build— vite is only used by vitest for test transforms, so this is test-path only.Verification
Resolved versions after the change — all inside their intended major:
Audit gate:
pnpm audit --audit-level=high5 low | 32 moderate | 17 high (1 ignored) | 2 critical3 low | 7 moderate | 1 high (1 ignored)Both criticals and all unignored highs are gone. The one remaining high is the pre-existing
GHSA-3gc7-fjrx-p6mgalready listed inpnpm.auditConfig.ignoreGhsas.No test regression. I ran the app suite on clean
origin/playgroundand on this branch, same machine, same command:origin/playground(baseline)Byte-identical. Those 95 failures are pre-existing on
playgroundand are not touched by this change — worth their own investigation, but out of scope here.Related
Same advisory, same class of problem, filed separately: dcccrypto/percolator-indexer#180 (indexer had no
brace-expansionoverride at all and is red on every PR right now).percolator-keeperandpercolator-apialso resolve vulnerablebrace-expansionbut have nopnpm auditstep in CI, so nothing is blocked there.🤖 Generated with Claude Code