From d71d7b50d20fc931e6a9944c16cb3853f8499cd9 Mon Sep 17 00:00:00 2001 From: Aric Camarata Date: Mon, 14 Sep 2026 15:14:52 -0400 Subject: [PATCH] chore(deps): drop the 82 pnpm.overrides in frontend/ that never applied MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit pnpm prints this on every install: WARN The field "pnpm.overrides" was found in frontend/package.json. This will not take effect. You should configure "pnpm.overrides" at the root of the workspace instead. It is right. `frontend` is a workspace member with no lockfile of its own, and no workflow installs it standalone — all 71 `pnpm install` invocations in this repo's workflows run at the root. So those 82 entries have never resolved anything. They read as security posture and are inert. That is the reason to remove them rather than leave them: a block that looks like 82 CVE patches but applies none is worse than no block, because it answers the question "is this handled?" wrongly. Checked every entry before deleting, against the lockfile with real semver rather than by eye: - 39 distinct packages. For each selector, whether any INSTALLED version matches it and fails to satisfy the target. - Exactly one entry asks for more than the root overrides already provide — `serialize-javascript@<7.0.5 -> >=7.0.5` against root's `>=7.0.3`. That intent is preserved: root moves to `>=7.0.5`. The installed version is already 7.0.5, so nothing resolves differently. - Two entries would have changed something and are deliberately NOT carried over. `@tootallnate/once@<3.0.1 -> >=3.0.1` (installed 2.0.1) is GHSA-vpq2-c234-7xj6, severity LOW, and Dependabot does not raise it on this repo. `path-to-regexp -> 8.4.0` is an unconditional pin that would drag the installed 0.1.13 and 6.3.0 consumers across two majors — moving it to root would break builds, not fix them. - Everything else is redundant with root coverage or targets a version not installed here. The lockfile does not move. A control regeneration on unmodified origin/main produces the same `third-party-web 0.29.2 -> 0.30.0` drift from a floating range, so that is pre-existing and is excluded here. The only lockfile line in this commit is the serialize-javascript override, matching the root package.json change. --- frontend/package.json | 86 ------------------------------------------- package.json | 2 +- pnpm-lock.yaml | 2 +- 3 files changed, 2 insertions(+), 88 deletions(-) diff --git a/frontend/package.json b/frontend/package.json index 4927d5f3..deb85643 100644 --- a/frontend/package.json +++ b/frontend/package.json @@ -264,91 +264,5 @@ "typescript": "^6.0.3", "webdriverio": "^9.26.1", "yaml": "^2.9.0" - }, - "pnpm": { - "overrides": { - "d3-color@<3.1.0": ">=3.1.0", - "got@<11.8.5": ">=11.8.5", - "tough-cookie@<4.1.3": ">=4.1.3", - "@sentry/browser@<7.119.1": ">=7.119.1", - "undici@>=6.0.0 <6.21.1": ">=6.21.1", - "on-headers@<1.1.0": ">=1.1.0", - "tmp@<=0.2.3": ">=0.2.4", - "form-data@>=4.0.0 <4.0.4": ">=4.0.4", - "form-data@<2.5.4": ">=2.5.4", - "glob@>=10.2.0 <10.5.0": ">=10.5.0", - "axios@>=1.0.0 <1.12.0": ">=1.12.0", - "lodash@>=4.0.0 <=4.17.22": ">=4.17.23", - "undici@<6.23.0": ">=6.23.0", - "tar@<7.5.7": ">=7.5.7", - "diff@>=6.0.0 <8.0.3": ">=8.0.3", - "undici@>=6.0.0 <6.21.2": ">=6.21.2", - "qs@>=6.7.0 <=6.14.1": ">=6.14.2", - "axios@>=1.0.0 <=1.13.4": ">=1.13.5", - "tar@<=7.5.2": ">=7.5.3", - "tar@<7.5.8": ">=7.5.8", - "bn.js@>=5.0.0 <5.2.3": ">=5.2.3", - "bn.js@<4.12.3": ">=4.12.3", - "minimatch@<3.1.3": ">=3.1.3 <4", - "minimatch@>=5.0.0 <5.1.7": ">=5.1.7 <6", - "minimatch@>=9.0.0 <9.0.6": ">=9.0.6", - "rollup@>=3.0.0 <3.30.0": ">=3.30.0", - "basic-ftp@<5.2.0": ">=5.2.0", - "minimatch@>=5.0.0 <5.1.8": ">=5.1.8 <6", - "minimatch@>=9.0.0 <9.0.7": ">=9.0.7", - "minimatch@<3.1.4": ">=3.1.4 <4", - "fast-xml-parser@>=5.0.0 <5.3.6": ">=5.3.6", - "serialize-javascript@<=7.0.2": ">=7.0.3", - "ajv@<6.14.0": ">=6.14.0", - "ajv@>=7.0.0-alpha.0 <8.18.0": ">=8.18.0", - "eslint>ajv": "6", - "eslint-plugin-jsx-a11y>minimatch": "3", - "test-exclude>minimatch": "3", - "qs@<6.14.1": ">=6.14.1", - "@tootallnate/once@<3.0.1": ">=3.0.1", - "dompurify@>=3.1.3 <3.2.7": ">=3.2.7", - "fast-xml-parser@>=5.0.0 <5.3.8": ">=5.3.8", - "tar@<=7.5.9": ">=7.5.10", - "tar@<=7.5.10": ">=7.5.11", - "@appium/support@<=7.0.5": ">=7.0.6", - "flatted@<3.4.0": ">=3.4.0", - "undici@>=7.0.0 <7.24.0": ">=7.24.0", - "undici@>=6.0.0 <6.24.0": ">=6.24.0", - "undici@<6.24.0": ">=6.24.0", - "undici@>=7.17.0 <7.24.0": ">=7.24.0", - "yauzl@=3.2.0": ">=3.2.1", - "tar@<=7.5.3": ">=7.5.4", - "jspdf@<=4.2.0": ">=4.2.1", - "socket.io-parser@>=4.0.0 <4.2.6": ">=4.2.6", - "fast-xml-parser@>=5.0.0 <5.5.6": ">=5.5.6", - "flatted@<=3.4.1": ">=3.4.2", - "fast-xml-parser@>=4.0.0-beta.3 <=5.5.6": ">=5.5.7", - "nodemailer@<8.0.4": ">=8.0.4", - "serialize-javascript@<7.0.5": ">=7.0.5", - "path-to-regexp@<0.1.13": ">=0.1.13", - "dompurify@<3.3.2": ">=3.3.2", - "brace-expansion@<1.1.13": ">=1.1.13", - "brace-expansion@>=2.0.0 <2.0.3": ">=2.0.3", - "picomatch@<2.3.2": ">=2.3.2", - "picomatch@>=4.0.0 <4.0.4": ">=4.0.4", - "yaml@>=2.0.0 <2.8.3": ">=2.8.3", - "dompurify@>=3.1.3 <=3.3.1": ">=3.3.2", - "path-to-regexp@>=8.0.0 <8.4.0": ">=8.4.0", - "path-to-regexp": "8.4.0", - "bn.js": "5.2.3", - "protobufjs@<7.5.5": ">=7.5.5", - "protobufjs@>=8.0.0 <8.0.2": ">=8.0.2", - "lodash@<=4.17.23": ">=4.17.24", - "lodash-es@<=4.17.23": ">=4.17.24", - "@xmldom/xmldom@<0.8.12": ">=0.8.12", - "@xmldom/xmldom@>=0.9.0 <0.9.9": ">=0.9.9", - "@xmldom/xmldom": ">=0.9.9", - "basic-ftp@<=5.2.2": ">=5.3.0", - "shell-quote": ">=1.8.4", - "axios": "1.16.0", - "next@>=13.0.0 <15.5.21": ">=15.5.21", - "next": "15.5.23", - "websocket-driver": ">=0.7.5" - } } } diff --git a/package.json b/package.json index a8795028..53d1d807 100644 --- a/package.json +++ b/package.json @@ -27,7 +27,7 @@ "@grpc/proto-loader>protobufjs": "8.6.4", "tar": ">=7.5.19", "rollup": ">=3.30.0", - "serialize-javascript": ">=7.0.3", + "serialize-javascript": ">=7.0.5", "undici": ">=8.9.0", "@nhost/nhost-js": "^3.3.1", "shell-quote": ">=1.9.0", diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 74902a67..e68f1e25 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -12,7 +12,7 @@ overrides: '@grpc/proto-loader>protobufjs': 8.6.4 tar: '>=7.5.19' rollup: '>=3.30.0' - serialize-javascript: '>=7.0.3' + serialize-javascript: '>=7.0.5' undici: '>=8.9.0' '@nhost/nhost-js': ^3.3.1 shell-quote: '>=1.9.0'