Bumped 11 vulnerable transitive deps via pnpm.overrides#27569
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
WalkthroughThe 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
9larsons
changed the title
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
docs/dep-bumps.md (1)
230-236: Add a language to the fenced code block (markdownlint MD040).📝 Proposed fix
-``` +```bash pnpm install # refresh lockfile pnpm audit --json | jq '.metadata.vulnerabilities' # confirm count drops pnpm nx run-many -t build # build check pnpm nx run-many -t test # unit tests pnpm --filter `@tryghost/e2e` test # e2e (only if touched workspace matters)</details> <details> <summary>🤖 Prompt for AI Agents</summary>Verify each finding against the current code and only fix it if needed.
In
@docs/dep-bumps.mdaround lines 230 - 236, The fenced code block containing
the pnpm commands (the block starting with the three backticks before "pnpm
install" and ending after "pnpm --filter@tryghost/e2etest") needs a language
tag to satisfy markdownlint MD040; update the opening fence to use "```bash"
(and keep the closing fence) so the block is explicitly marked as bash/sh and no
other content needs changing.</details> </blockquote></details> </blockquote></details> <details> <summary>🤖 Prompt for all review comments with AI agents</summary>Verify each finding against the current code and only fix it if needed.
Inline comments:
In@docs/dep-bumps.md:
- Around line 70-82: The example in the Batch A JSON block uses ">=" range
specifiers on the RHS (e.g. entries like "minimatch@>=9.0.0 <9.0.7": ">=9.0.7",
"debug@>=4.0.0 <4.3.1": ">=4.3.1") which contradicts the override-hygiene rule;
update each RHS to the exact pinned version that actually shipped (replace all
">=x.y.z" RHS values with their corresponding exact versions from the committed
package.json) so the snippet matches the real overrides and avoids reintroducing
the minimatch@10 resolution bug.
Nitpick comments:
In@docs/dep-bumps.md:
- Around line 230-236: The fenced code block containing the pnpm commands (the
block starting with the three backticks before "pnpm install" and ending after
"pnpm --filter@tryghost/e2etest") needs a language tag to satisfy markdownlint
MD040; update the opening fence to use "```bash" (and keep the closing fence) so
the block is explicitly marked as bash/sh and no other content needs changing.</details> <details> <summary>🪄 Autofix (Beta)</summary> Fix all unresolved CodeRabbit comments on this PR: - [ ] <!-- {"checkboxId": "4b0d0e0a-96d7-4f10-b296-3a18ea78f0b9"} --> Push a commit to this branch (recommended) - [ ] <!-- {"checkboxId": "ff5b1114-7d8c-49e6-8ac1-43f82af23a33"} --> Create a new PR with the fixes </details> --- <details> <summary>ℹ️ Review info</summary> <details> <summary>⚙️ Run configuration</summary> **Configuration used**: Path: .coderabbit.yaml **Review profile**: CHILL **Plan**: Pro **Run ID**: `93450ae4-ce44-47d5-b249-7aae7fd4eb39` </details> <details> <summary>📥 Commits</summary> Reviewing files that changed from the base of the PR and between b11949015d0f7292aa92ae328378ee6c187476da and 6946c63c1b5e8f54f6204d9036d742a1307051bc. </details> <details> <summary>⛔ Files ignored due to path filters (1)</summary> * `pnpm-lock.yaml` is excluded by `!**/pnpm-lock.yaml` </details> <details> <summary>📒 Files selected for processing (2)</summary> * `docs/dep-bumps.md` * `package.json` </details> </details> <!-- This is an auto-generated comment by CodeRabbit for review status -->
Adds 11 entries to root pnpm.overrides to force vulnerable transitive deps forward without touching any direct deps. All replacement versions are pinned with ^x.y.z to keep upgrades within the existing major. Modules: @tootallnate/once, clean-css, debug (x2 ranges), diff (x2 ranges), handlebars, minimatch (x2 ranges), qs, tmp. pnpm audit: 153 -> 123 advisories (-1 crit, -14 high, -4 mod, -11 low). Verification: - pnpm test (15 unit-test projects, excl. e2e + ghost-admin): pass - pnpm --filter ghost-admin run build: exit 0 - pnpm --filter ghost-admin run test: 1065/1065 passing - handlebars and tmp are direct deps in ghost/core but already at the override-target version, so this is a no-op for direct deps - Transitive major-version jumps (clean-css, tmp, diff, minimatch) are confined to the Ember admin dev/build toolchain; no production runtime impact
9larsons
force-pushed
the
dep-bumps/batch-a-overrides
branch
from
6946c63 to
6aab219
Compare
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #27569 +/- ##
=======================================
Coverage 73.14% 73.14%
=======================================
Files 1557 1557
Lines 126175 126189 +14
Branches 15310 15309 -1
=======================================
+ Hits 92289 92305 +16
+ Misses 32927 32907 -20
- Partials 959 977 +18
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
1 participant
Summary
Adds 11 entries to the root
pnpm.overridesblock to force vulnerable transitive deps forward, without touching any direct deps. All replacement versions are pinned with^x.y.zto keep upgrades within the existing major.Modules:
@tootallnate/once,clean-css,debug(×2 ranges),diff(×2 ranges),handlebars,minimatch(×2 ranges),qs,tmpAudit delta:
pnpm audit153 → 123 (−1 crit, −14 high, −4 mod, −11 low)Notes
handlebarsandtmpare direct deps inghost/corebut already match the override-target version, so this is a no-op for direct deps.clean-css 3 → 4,tmp 0.0.x → 0.2.5,diff 1 → 3,minimatch 0 → 3) are confined to the Ember admin dev/build toolchain (broccoli-clean-css,mocha 2.5.3,sane,external-editor,fixturify-project); none reach production runtime, public apps, orghost/core/server/.Test plan
pnpm install— cleanpnpm test(15 unit-test projects, excluding e2e and ghost-admin) — passpnpm --filter ghost-admin run build— exit 0pnpm --filter ghost-admin run test— 1065 / 1065 passingpnpm dev→ load/ghost)