security(deps): clear the Dependabot alerts (js-yaml, brace-expansion, postcss) - #14
Merged
Conversation
…pansion) - js-yaml >=4.3.0 (high: vulnerable range >=4.0.0 <4.3.0) — only one version in the tree (4.2.0), pulled in by @eslint/eslintrc; resolves to 4.3.0, same major line. - brace-expansion >=5.0.7 (high: vulnerable range >=3.0.0 <5.0.7), scoped as "minimatch@10>brace-expansion" — the tree carries TWO incompatible major lines: 1.1.15 (bare-function export) under minimatch@3.1.5 via eslint's own config-array/eslintrc chain, and 5.0.6 (named exports) under minimatch@10.2.5 via @typescript-eslint/typescript-estree. Only the 5.x line is in the advisory's vulnerable range, so the override is qualified to that parent to avoid forcing a major bump onto minimatch@3.1.5 (which would break it the way an unscoped bump broke minimatch@3.x/ @babel/core/istanbul on a sibling repo). Resolves to 5.0.8; the 1.1.15 instance is untouched and out of the alert's range. Full gate green with the new resolutions (1,245 tests, lint, build). `pnpm audit` confirms both js-yaml and the 5.x brace-expansion finding are gone; the untouched 1.x brace-expansion instance and a pre-existing postcss advisory in packages/client are unrelated to these two alerts and were left alone. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…ries Follow-up to the js-yaml / brace-expansion@5 overrides in this branch. - minimatch@3>brace-expansion -> ^1.1.16 clears GHSA-3jxr-9vmj-r5cp. Scoped to the 1.x line so minimatch@3's bare-function usage keeps working; a blanket brace-expansion override would break it (and @babel/core and istanbul), which is exactly how the equivalent bump failed on a sibling repo. - postcss -> ^8.5.18 clears the sourceMappingURL path-traversal advisory reaching packages/client via vite. Remaining after this: GHSA-mh99-v99m-4gvg still matches brace-expansion 1.1.16 under eslint>minimatch@3. It is unfixable — the advisory covers everything <= 5.0.7 and upstream patched only the 5.x line, so no patched 1.x exists — and it is dev-only. 'pnpm audit --prod' reports no known vulnerabilities, so nothing vulnerable ships. Verified on a clean 'pnpm install --frozen-lockfile': build, lint, and the full workspace suite all pass. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
goetchstone
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Clears the open Dependabot alerts, plus two related advisories found while verifying.
js-yaml→ ^4.3.0minimatch@10>brace-expansion→ ^5.0.7minimatch@3>brace-expansion→ ^1.1.16postcss→ ^8.5.18Why the overrides are scoped, not blanket
Two incompatible brace-expansion majors are in this tree:
1.x(bare-function export, underminimatch@3.1.5) and5.x(named exports, underminimatch@10.2.5). A blanketbrace-expansionoverride would force 5.x onto minimatch@3 and break it — exactly how the equivalent bump failed on a sibling repo (TypeError: minimatch is not a functionacross the whole unit suite). pnpm's scoped syntax moves each line independently.Remaining, and why it stays
GHSA-mh99-v99m-4gvg still matches
brace-expansion@1.1.16undereslint>minimatch@3. It is unfixable — the advisory covers everything<= 5.0.7and upstream patched only the 5.x line — and it is dev-only.pnpm audit --prodreports no known vulnerabilities, so nothing vulnerable ships.Verification (clean
pnpm install --frozen-lockfile)pnpm -r build✅pnpm lint✅pnpm test✅ — 1,245 tests (core 562, client 412, stats 127, server 144)🤖 Generated with Claude Code