fix(deps): raise the brace-expansion and fast-uri floors to today's fixes - #71
Merged
Conversation
There was a problem hiding this comment.
Pull request overview
Updates pnpm overrides and the lockfile to ensure vulnerable transitive dev dependencies resolve to patched versions, aligning with the repo’s “override placement matters” approach for pnpm 11.
Changes:
- Raised the
fast-urioverride floor to^3.1.5. - Added major-scoped overrides for
brace-expansionandundicito pin each major line to its patched floor. - Regenerated
pnpm-lock.yamlto reflect the new override resolutions.
Reviewed changes
Copilot reviewed 2 out of 3 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| pnpm-workspace.yaml | Adjusts/extends the workspace-level overrides used by pnpm 11 to enforce patched transitive versions. |
| pnpm-lock.yaml | Regenerated lockfile reflecting new override resolutions (fast-uri/brace-expansion/undici). |
| package.json | Normalizes the description string encoding (no functional behavior change). |
Files not reviewed (1)
- pnpm-lock.yaml: Generated file
…ixes `fast-uri` gained a high-severity advisory fixed in 3.1.5, and `brace-expansion` a DoS via unbounded intermediate arrays that bypasses the mitigation for the previous one — so the floor set earlier today is already below it, the fix being 5.0.9. The caret ranges would have picked both up on the next install, but the lockfile is what the scanners read, so the floors move and the lockfile is regenerated. This repository runs pnpm 11, where the `pnpm` field of package.json is ignored, so the overrides live in the workspace file.
msalvatti
force-pushed
the
fix/advisory-floors
branch
from
August 3, 2026 20:36
50bce00 to
79f25a1
Compare
Unscoped, it would force a 1.x or 2.x transitive onto the 5.x line, whose API minimatch cannot use. Each major now carries its own fix for the DoS that bypasses the earlier mitigation — 1.1.18, 2.1.4 and 5.0.9 — matching how the js-yaml and undici pairs in this file are already handled.
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 1 out of 2 changed files in this pull request and generated no new comments.
Files not reviewed (1)
- pnpm-lock.yaml: Generated file
Suppressed comments (1)
pnpm-workspace.yaml:33
- The PR description calls out raising floors for brace-expansion majors 1, 2, and 5, but the workspace override is unscoped and only sets a single range (^5.0.9). If the intent is to track the advisory fixes per-major (like js-yaml and undici below), the override should be scoped by major; otherwise the PR description should be adjusted.
# Scoped per major, like the js-yaml and undici pairs: unscoped, a 1.x or 2.x
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two advisories, both landing today
fast-uri< 3.1.5 — high, andbrace-expansion— a DoS via unbounded intermediate arrays that bypasses the mitigation for the previous one, so the floors I set a few hours ago are already below it:fast-uri^3.1.4brace-expansion@1^1.1.17brace-expansion@2^2.1.3brace-expansion@5^5.0.8The caret ranges would have picked the fixes up on the next install, but the lockfile is what the scanners read, so the floors are raised and the lockfile regenerated. Verified: no vulnerable version resolves any more.
Where the override lives
This repository's
packageManagerdecides that, and getting it wrong is silent. On pnpm 11 thepnpmfield ofpackage.jsonis ignored outright, with no warning — an override placed there does nothing andpnpm installstill reports "Already up to date". I hit exactly that earlier today innest-queue, whose workspace file documents the trap at the top of its overrides block.Seven of the nine libraries pin
pnpm@10.8.1, where the field is honoured;nest-queueandnest-realtimeare onpnpm@11, where the overrides belong inpnpm-workspace.yaml. Each repository is edited in the place its own toolchain reads, and the lockfile confirms the result rather than the placement being assumed.Verification
Full gate chain green: typecheck · lint · coverage at 100% · build · size.
Nothing ships either way — these are development transitives, and the packages declare no runtime dependencies.