chore(deps): security sweep via pnpm overrides (consolidates dependabot PRs) - #47
Merged
Conversation
…ot PRs) Resolve all open npm Dependabot advisories through root pnpm.overrides: - axios: force ^1.18.0 (was < 1.18.0) — resolves 1.19.0 - tar: bump override floor <7.5.11 -> <7.5.21 (^7.5.21) — resolves 7.5.22 (fixes critical + high) - hono: bump override floor <4.12.25 -> <4.12.27 (^4.12.27) — resolves 4.12.32 - @hono/node-server: force ^2.0.5 — resolves 2.0.12 - body-parser: force ^2.3.0 for >=2.0.0 <2.3.0 — resolves 2.3.0 - postcss: force ^8.5.18 (high) — resolves 8.5.25 - fast-uri: force ^3.1.4 (high) — resolves 3.1.4 pnpm audit --prod and full pnpm audit both report no known vulnerabilities. typecheck and build pass. No app source changed — manifests + lockfile only. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Resolves every open npm Dependabot security advisory in one pass using root
pnpm.overrides(the mechanism the repo already uses), rather than merging seven individual Dependabot PRs. No app source changed — onlypackage.json(overrides) andpnpm-lock.yaml.Alert counts
gh dependabot/alerts(open)pnpm audit --prodpnpm audit(full)Override changes (root
package.json→pnpm.overrides)Existing entries bumped past the advisories:
tar—tar@<7.5.11: ^7.5.11→tar@<7.5.21: ^7.5.21(fixes critical GHSA + high; resolves7.5.22)hono—hono@<4.12.25: ^4.12.25→hono@<4.12.27: ^4.12.27(resolves4.12.32)New entries added:
axios@<1.18.0: ^1.18.0— high + medium (resolves1.19.0)@hono/node-server@<2.0.5: ^2.0.5— medium (resolves2.0.12)body-parser@>=2.0.0 <2.3.0: ^2.3.0— low (line-scoped so 1.x consumers are untouched; resolves2.3.0)postcss@<8.5.18: ^8.5.18— high (resolves8.5.25)fast-uri@<3.1.4: ^3.1.4— high (resolves3.1.4)No direct-dependency bumps were needed — every flagged package is transitive (none appear in any workspace
package.jsondeps). Cooldown (minimumReleaseAge: 4320) did not block any patched version; all resolved at or above the required patched release. Nopnpm.auditConfig.ignoreGhsasentries touched.Verification
pnpm install --no-frozen-lockfile— cleanpnpm audit --prod— no known vulnerabilitiespnpm audit(full) — no known vulnerabilitiespnpm typecheck(tsc -p tsconfig.json) — passpnpm build(tsup) — passSupersedes
Directly supersedes the security bump #46 (postcss → 8.5.25, delivered here via override). The remaining open Dependabot PRs (#40 typescript, #41 dev-dependencies group, #42 setup-node, #43 web-tree-sitter, #44 checkout, #45 @modelcontextprotocol/sdk) are non-security version bumps and are left for the owner to decide. Do not auto-close them here.
🤖 Generated with Claude Code