fix(root): resolve undici and ts-deepmerge vulnerabilities (fixes DOC-364)

[cursor]

Summary

Weekly dependency security audit — resolves 2 of 3 actionable vulnerability packages (5 advisory IDs total).

Fixed

Package	Severity	Strategy	Advisory
undici	High (+ 3 related)	pnpm override update (^6.24.0 → ^6.27.0)	GHSA-vxpw-j846-p89q
ts-deepmerge	Moderate	pnpm override added (^8.0.0)	GHSA-87mf-gv2c-c62c

Skipped

• js-yaml (moderate, GHSA-h67p-54hq-rp68) — upgrading to >=4.2.0 breaks gray-matter which calls the removed yaml.safeLoad API. No compatible parent update is available.

Validation

• pnpm audit — undici and ts-deepmerge advisories cleared (1 moderate js-yaml remains)
• pnpm build — passes

Linear: DOC-364

  

Greptile Summary

This PR patches two transitive dependency vulnerabilities via pnpm overrides: undici is bumped from 6.25.0 to 6.27.0 (high-severity GHSA-vxpw-j846-p89q) and ts-deepmerge is pinned to 8.0.0 (moderate GHSA-87mf-gv2c-c62c). A third advisory (js-yaml) is intentionally skipped due to a breaking API removal in gray-matter.

• undici@<6.27.0: ^6.27.0 — minor version bump within the same major; all lockfile snapshots updated consistently.
• ts-deepmerge@<8.0.0: ^8.0.0 — major version bump (7 → 8) used transitively via @scalar/openapi-parser; the PR reports pnpm build passes, and the usage is build-time only in a docs repo, so runtime risk is minimal.
• The pnpm-lock.yaml is fully in sync with package.json overrides, and all affected snapshot entries are updated.

Confidence Score: 5/5

Safe to merge — both overrides are scoped precisely and the lockfile is fully consistent with the manifest changes.

The changes are two targeted pnpm override additions: a minor-patch bump for undici and a major-version pin for ts-deepmerge. The major bump (7 → 8) is the only slightly elevated risk, but ts-deepmerge is consumed only by @scalar/openapi-parser at build time in a docs repo, and the PR confirms the build passes. No logic, runtime, or interface code was touched.

No files require special attention.

Important Files Changed

Filename	Overview
package.json	Adds ts-deepmerge override (^8.0.0) and updates undici override from ^6.24.0 to ^6.27.0 to resolve security advisories GHSA-87mf-gv2c-c62c and GHSA-vxpw-j846-p89q
pnpm-lock.yaml	Lockfile correctly reflects the override changes: ts-deepmerge bumped 7.0.2 → 8.0.0 and undici bumped 6.25.0 → 6.27.0; all affected snapshots updated consistently

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[pnpm install] --> B{Override rules applied}
    B --> C["ts-deepmerge@<8.0.0\n→ ^8.0.0 (8.0.0)"]
    B --> D["undici@<6.27.0\n→ ^6.27.0 (6.27.0)"]
    C --> E["@scalar/openapi-parser\nuses ts-deepmerge@8.0.0"]
    D --> F["remark-lint-no-dead-urls\nuses undici@6.27.0"]
    E --> G[pnpm build ✓]
    F --> G
    G --> H[GHSA-87mf-gv2c-c62c resolved]
    G --> I[GHSA-vxpw-j846-p89q resolved]

Loading

%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
flowchart TD
    A[pnpm install] --> B{Override rules applied}
    B --> C["ts-deepmerge@<8.0.0\n→ ^8.0.0 (8.0.0)"]
    B --> D["undici@<6.27.0\n→ ^6.27.0 (6.27.0)"]
    C --> E["@scalar/openapi-parser\nuses ts-deepmerge@8.0.0"]
    D --> F["remark-lint-no-dead-urls\nuses undici@6.27.0"]
    E --> G[pnpm build ✓]
    F --> G
    G --> H[GHSA-87mf-gv2c-c62c resolved]
    G --> I[GHSA-vxpw-j846-p89q resolved]

Loading

_{Reviews (1): Last reviewed commit: "fix(root): resolve high undici and moder..." | Re-trigger Greptile}

[linear-code]

DOC-364

[netlify]

✅ Deploy Preview for docs-novu ready!

Name	Link
🔨 Latest commit	dcb0d11
🔍 Latest deploy log	https://app.netlify.com/projects/docs-novu/deploys/6a3b74408c46ed00084ae3a3
😎 Deploy Preview	https://deploy-preview-1135--docs-novu.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.