chore(deps): force esbuild >=0.28.1 via pnpm override (GHSA-gv7w-rqvm-qjhr)#266
Conversation
…-qjhr) esbuild <0.28.1 is flagged high by pnpm audit (binary integrity bypass via NPM_CONFIG_REGISTRY in the Deno loader). Both lockfile copies were vulnerable: 0.25.12 under electron-vite/vite and 0.28.0 under fumadocs-mdx. Unify on 0.28.1 with an override, matching the existing security-floor overrides (tar, minimatch, rollup, ...). Verified locally on node 22 / pnpm 10.12.4: desktop lint, tsc -b, electron-vite build, web lint/typecheck/build, Electron Playwright smoke suite, and pnpm audit --audit-level=high all green.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Mogplex PR ReviewStatus: No material issues found SummaryClean security patch — no issues found. ✅ This PR adds
No security, correctness, architectural, or performance concerns. Ready to merge. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: b17f63aa99
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| "fast-uri": "3.1.2", | ||
| "tmp": "0.2.6" | ||
| "tmp": "0.2.6", | ||
| "esbuild": ">=0.28.1" |
There was a problem hiding this comment.
When the root dev/build/package scripts run through electron-vite and vite, this override makes pnpm install esbuild@0.28.1 for those tools (the lockfile now resolves both electron-vite@3.1.0 and vite@6.4.2 to 0.28.1). vite@6.4.2 declares esbuild: ^0.25.0, and the previous lockfile resolved it to 0.25.12, so forcing 0.28.x puts the main build pipeline outside the supported esbuild minor line; esbuild 0.x minor releases are treated as breaking releases. Please update Vite/electron-vite to versions that declare compatibility with 0.28.x, or use a compatible patched 0.25.x resolution if one exists, rather than overriding every consumer across minors.
Useful? React with 👍 / 👎.
1 participant
Why
GHSA-gv7w-rqvm-qjhr (high) flags esbuild <0.28.1. The lockfile carried two vulnerable copies:
0.25.12underelectron-vite/vite(declared range^0.25.x)0.28.0underfumadocs-mdxThe advisory published after the open Dependabot PRs' CI runs (Jun 7), so the next push to main would fail the required
pnpm audit --audit-level=highstep. This must land before #265.What
One-line pnpm override
"esbuild": ">=0.28.1"+ lockfile regen, matching the existing security-floor overrides (tar, minimatch, rollup, …).Verification (local, node 22 / pnpm 10.12.4)
pnpm audit --audit-level=high✅ (0 high)tsc -b/electron-vite build✅next build✅🤖 Generated with Claude Code
Need help on this PR? Tag
/codesmithwith what you need. Autofix is disabled.