fix(security): bound dev-tree overrides within the major they patch - #245
Merged
Conversation
cross-spawn, lodash, tmp, and the minimatch/brace-expansion overrides for pre-9.0.7 minimatch and pre-1.1.13 brace-expansion had unbounded (or too-loosely bounded) upper ranges, letting a vulnerability fix silently carry a package across one or more majors with nothing to flag it. Bound each to the major it patches, matching the pattern already used for the other overrides in this file (and for cyberuni/iso-error). The only resolution this changes is minimatch@3.1.5's brace-expansion, which drops from 5.0.7 (an unrelated, still-unpatched major pulled in only by the old unbounded target) to 1.1.18, inside the major the override was meant to patch. cross-spawn, lodash, tmp, and minimatch's 9.x override were already no-ops in the resolved tree, so bounding them changes nothing today but stops a future silent jump. brace-expansion@5.0.7 still appears in the lockfile via minimatch@10.2.5 (glob/typedoc's own direct dependency, unrelated to any override) and pnpm audit still reports 2 high vulnerabilities from that path alone — unchanged from before this commit and out of scope here.
|
4 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
cross-spawn,lodash,tmp, and the minimatch (>=9.0.0 <9.0.7) and brace-expansion (<1.1.13) overrides inpnpm-workspace.yamlhad unbounded (or too-loosely bounded) upper ranges, so clearing an advisory could silently jump a package across one or more majors with nothing to flag it.cyberuni/iso-error.path-equalships no runtime dependencies) — no changeset, no version bump.What actually changed in the lockfile
Only one resolution moved:
minimatch@3.1.5'sbrace-expansiondependency, from5.0.7down to1.1.18— inside the major (1.x) the override is meant to patch, instead of the unrelated, still-unpatched major-5 line the old unbounded target (<6) happened to reach.cross-spawn,lodash,tmp, and minimatch's>=9.0.0 <9.0.7override were already no-ops against the resolved tree (nothing currently requests those vulnerable ranges), so bounding them changes nothing today — it just removes the unbounded upper before something does request them.Advisories
pnpm audit: 2 high before, 2 high after (unchanged). Both come frombrace-expansion@5.0.7resolved viaminimatch@10.2.5, which isglob/typedoc's own direct dependency (^5.0.5) — unrelated to any override, and out of scope for this fix.brace-expansion@5.0.7was reachable via 5 paths before this change and 4 after (the override-causeddepcheckpath is gone).gh api repos/cyberuni/path-equal/dependabot/alerts: 0 open alerts before and after.Test plan
pnpm install --frozen-lockfile— cleanpnpm verify(biome + build + typecheck + coverage + depcheck + size) — all greenpnpm auditbefore/after compared — no increase