fix(deps): patch the undici advisories, in the place pnpm 11 actually reads - #70
Merged
Conversation
… reads The OSV scan reports five advisories against `undici@8.5.0`, one high, all fixed in 8.9.0. The override went into `package.json` first, which did nothing at all — this repository runs pnpm 11, where the `pnpm` field of package.json is ignored outright and without warning. `pnpm install` reported "Already up to date" and the lockfile kept resolving 8.5.0. The comment at the top of the workspace overrides block says exactly this; I wrote the override before reading it. Moved to `pnpm-workspace.yaml` alongside its siblings, where it takes effect — the lockfile now resolves 8.9.0 — and the dead `pnpm` block is gone from package.json so nothing looks like an override that is not one.
There was a problem hiding this comment.
Pull request overview
This PR addresses OSV-reported vulnerabilities in the transitive undici dependency by applying a pnpm override in the location that pnpm 11 actually honors, ensuring the lockfile resolves a patched undici version.
Changes:
- Add a workspace-level override to force
undicito^8.9.0. - Update
pnpm-lock.yamlso the resolvedundiciversion is8.9.0and the overrides block reflects it. - Minor metadata normalization in
package.json(string encoding).
Reviewed changes
Copilot reviewed 2 out of 3 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| pnpm-workspace.yaml | Adds an override intended to force patched undici resolution under pnpm 11. |
| pnpm-lock.yaml | Updates lockfile overrides and resolved package versions to undici@8.9.0. |
| package.json | Contains a small description string encoding change (unrelated to dependency resolution). |
Files not reviewed (1)
- pnpm-lock.yaml: Generated file
Unscoped, it would force a future transitive on undici 7.x onto the 8.x line. The advisories cover both — `>=7.0.0 <7.29.0` and `>=8.0.0 <8.9.0` — so each line is pinned to its own fix, matching how the js-yaml pair above is already handled. A 7.x arriving later lands above its floor rather than below it.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The OSV scan reports five advisories against
undici@8.5.0— one high — all fixed in 8.9.0.The part worth reading
I first put the override in
package.jsonunderpnpm.overrides. It did nothing: this repository runs pnpm 11, where that field is ignored outright and without warning.pnpm installreported "Already up to date" and the lockfile went on resolving 8.5.0.The comment at the top of this repo's
pnpm-workspace.yamloverrides block states precisely that. I wrote the override before reading it.Moved to
pnpm-workspace.yaml, where it takes effect — the lockfile now resolves 8.9.0 — and the deadpnpmblock is removed frompackage.jsonso nothing looks like an override that is not one.Scope across the family
Seven of the nine libraries pin
packageManager: pnpm@10.8.1, where thepackage.jsonfield is honoured; onlynest-queueandnest-realtimeare on pnpm 11. I verified the distinction rather than assuming it: the seven repositories' lockfiles do resolve their overridden versions.nest-realtimehas noundiciin its lockfile, so it needs nothing.nest-cachesits on 7.29.0, which is the 7.x line's fix — the advisories cover>=7.0.0 <7.29.0and>=8.0.0 <8.9.0.Verification
276 tests at 100%, typecheck · lint · build · size · attw · published surface green. Nothing ships: the package declares no runtime dependencies, and the lockfile is what the scanners read.