Raise the pinned floors for the flagged transitive packages - #162
Merged
Conversation
All ten open Dependabot alerts sit in build-time and tooling dependencies: undici under cheerio (search-local plugin) and under @vercel/node, plus brace-expansion under minimatch and fast-uri under ajv. None of it reaches the browser bundle, but the repo already pins patched floors through pnpm overrides, so these follow the same pattern. Fold the superseded brace-expansion and js-yaml entries into single ranges rather than stacking another rule on top — the older entries were resolving 5.0.8 and 4.3.0 and holding the tree back. `pnpm audit` reports clean, and the six-locale build and typecheck both pass. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Contributor
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
This pull request has been ignored for the connected project Preview Branches by Supabase. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes all ten open Dependabot alerts (#158–#167).
What the alerts actually are
Every one is transitive and lives in build-time or tooling code — none of it ships in the browser bundle:
undici7.28.0cheerio←@easyops-cn/docusaurus-search-local, used to parse our own generated HTML at build timeundici5.28.4@vercel/node, imported only by itsdev-server.mjsfor localvercel devbrace-expansion5.0.8minimatch← eslint /@vercel/nftfast-uri4.1.1ajv← webpack schema validationThe undici advisories (cache poisoning, response desync, cookie injection, CRLF) all require attacker-influenced HTTP traffic through undici. Neither call path does that: cheerio parses local HTML, and
@vercel/node's copy only runs in local dev. So the practical exposure is low — but the repo already keeps patched floors pinned viapnpm.overrides, and these follow that pattern.Also cleaned up
pnpm auditflagged six more in the same@vercel/nodesubtree that Dependabot hasn't raised yet (minimatch,smol-toml,tar,js-yaml); pinned those too.Rather than stack new rules on top of the old ones, superseded
brace-expansionandjs-yamlentries are folded into single ranges. The stale entries were pinning 5.0.8 and 4.3.0 and holding the tree back — that is why two versions of each were resolving.Verification
pnpm audit— no known vulnerabilitiespnpm typecheck— cleanpnpm build— all six locales built, including the search-local plugin that drives the bumped cheerio/undici pathNothing to dismiss manually: the alerts close on their own once this lockfile lands on
main.🤖 Generated with Claude Code