fix(deps): browserslist override + stale lockfile resync - #67
Merged
Merged
Conversation
Two newly published HIGH advisories against browserslist <= 4.28.6 (unbounded memory growth from an unevicted query-result cache, plus a crash/prototype-write via untrusted browserslist-stats.json), patched in 4.28.7. Reached transitively via babel, so no direct dependency to bump. Overridden at the workspace root. Also resyncs the lockfile against nself-org/packages main, which added eslint + typescript-eslint devDependencies to @nself/tailwind-brand, @nself-web/csp and @nself-web/og -- pnpm install --frozen-lockfile was stale against the sibling packages checkout. Verified by the resolved lockfile version rather than the config: browserslist now resolves to 4.28.8. CI=true pnpm install --frozen-lockfile exits 0 at the workspace root. pnpm audit --audit-level=high exits 0 (2 high findings, both pre-existing ignored CVEs unrelated to this change). Also added the override to desktop/package.json for documentation, though pnpm warns it has no effect there. Discovery (not fixed here, out of scope): desktop is a workspace member of the root pnpm-workspace.yaml, so pnpm install run from inside desktop/ walks up and resolves against the ROOT lockfile -- desktop/pnpm-lock.yaml is never touched and appears to be a dead file, same pattern already called out by this repo's own desktop-e2e.yml comment. The other three desktop-build CI jobs that install with working-directory: nclaw/desktop are therefore already exercising the root lockfile fixed here.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
browserslist-stats.json), patched in 4.28.7. Reached transitively via babel; overridden at the workspace root (fixes "Mobile Unit Tests" -> "Dependency audit").nself-org/packagesmain, which addedeslint/typescript-eslintdevDependencies to@nself/tailwind-brand,@nself-web/cspand@nself-web/og.Verification
grep -oE 'browserslist@[0-9.]+' pnpm-lock.yaml->browserslist@4.28.8at root.CI=true pnpm install --frozen-lockfileexits 0 at the workspace root.pnpm audit --audit-level=highexits 0 (2 high findings, both pre-existing ignored CVEs).Discovery (out of scope, flagging only)
desktopis a workspace member of the rootpnpm-workspace.yaml, sopnpm installrun from insidedesktop/walks up and resolves against the root lockfile --desktop/pnpm-lock.yamlis never touched and looks like a dead file, matching this repo's owndesktop-e2e.ymlcomment about the same thing. The threedesktop-build-*CI jobs that install withworking-directory: nclaw/desktopare therefore already exercising the root lockfile fixed here. Added the override todesktop/package.jsontoo for documentation, though pnpm warns it has no effect there.Test plan