build(deps): override devalue to 5.8.1 (GHSA-77vg-94rm-hx3p)#112
Merged
Conversation
Pins `devalue` to 5.8.1+ via pnpm-workspace.yaml overrides. Versions 5.6.3..5.8.0 are vulnerable to GHSA-77vg-94rm-hx3p (HIGH, 7.5) — DoS via sparse-array deserialization. Advisory was published 2026-05-14 20:23 UTC, ~3.5h after #103 (astro 6.3.1 → 6.3.3) merged. Impact path: devalue is pulled in transitively by astro@6.3.3, which is consumed only by @opencodehub/docs — a private workspace package that builds the static documentation site. None of the published @opencodehub/* tarballs depend on devalue, so the runtime exposure is zero. The override exists to keep `pnpm audit --audit-level=high` clean on the release-please PR (otherwise the release pipeline gets blocked behind a pre-release-gate failure that doesn't affect what ships). Verified locally: - `pnpm install --frozen-lockfile` succeeds - `pnpm audit --audit-level=high --prod` → "No known vulnerabilities found" - `pnpm typecheck` → green across all 19 workspace projects - `pnpm --filter @opencodehub/docs build` → 63 pages, completes - `pnpm why devalue` → resolves to 5.8.1 The override is keyed on `devalue@<5.8.1` so it auto-disengages once astro ships a transitive constraint that already pulls 5.8.1+.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Pins `devalue` to 5.8.1+ via pnpm-workspace.yaml overrides. Versions
5.6.3..5.8.0 are vulnerable to GHSA-77vg-94rm-hx3p (HIGH, 7.5) —
DoS via sparse-array deserialization. Advisory published 2026-05-14
20:23 UTC, ~3.5h after #103 (astro 6.3.1 → 6.3.3) merged.
Impact path
`devalue` is pulled in transitively by `astro@6.3.3` → consumed only
by `@opencodehub/docs` (`"private": true`, builds the static docs
site, never published). None of the 17 published `@opencodehub/*`
tarballs depend on devalue. Runtime exposure to the published
artifacts is zero.
Why this PR exists
The release pipeline (`release.yml`) does not run `pnpm audit`, so
the CVE wouldn't actually break a release. But the pre-release
gate on release-please PRs does run `pnpm audit --audit-level=high
--prod`, and that's currently failing on #97 (the release PR for
`root-v0.4.0` + `cli-v0.3.0`). Patching devalue cleanly is the
defensible engineering move:
`devalue >= 5.8.1` (the override is keyed on `devalue@<5.8.1`).
Verified locally
Test plan
this branch (both are non-required but currently failing on
chore: release main #97; this PR is the fix).