fix(deps): clear 11 HIGH/CRITICAL advisories by raising override floors - #105
Merged
Conversation
…ories The scheduled audit failed with 13 unpatched HIGH/CRITICAL findings. Every one of them was already covered by an entry in the root pnpm.overrides — the floors had simply fallen behind the versions that carry the fixes, so the lockfile stayed pinned below them: @xmldom/xmldom >=0.8.13 -> >=0.8.15 (7 advisories) js-yaml 4.x ^4.3.0 -> ^4.3.2 js-yaml 3.x ^3.15.1 -> ^3.15.2 svgo ^4.0.2 -> ^4.1.0 sharp ^0.35.0 -> ^0.35.4 astro (web) ^7.2.4 -> ^7.2.8 (CRITICAL, GHSA-26w7-cxv4-gfx2) No major upgrades and no upper bounds touched — each floor moves to the minimum patched release and the lockfile is regenerated to match. org/ was left alone: its astro ^7.2.10 already satisfied the floor. A `>=X` floor that happens to resolve to a patched version is protection by coincidence; anything in the tree asking for a lower release is still free to pull one in. Raising the floor is what makes it a guarantee. Verified locally: pnpm install --frozen-lockfile exits 0, and pnpm audit --audit-level=high now reports only the two pre-existing allowlisted image-size advisories (13 -> 0 violations). The allowlist was not touched; every advisory here had a real patch, so none of them needed one.
|
The latest updates on your projects. Learn more about Vercel for GitHub. 2 Skipped Deployments
|
🟢 Rampart Security Gate — CLEAN
Totals: 0 critical · 0 high · 0 medium · 0 low Mode: |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes the scheduled audit failure on
ce8044ef(run 34343940983), which reported 13 unpatched HIGH/CRITICAL findings.Every advisory was already covered by an entry in the root
pnpm.overrides— the floors had just fallen behind the releases carrying the fixes, so the lockfile stayed pinned below them.@xmldom/xmldom(7 advisories)>=0.8.13>=0.8.15js-yaml4.x^4.3.0^4.3.2js-yaml3.x^3.15.1^3.15.2svgo^4.0.2^4.1.0sharp^0.35.0^0.35.4astro(web)^7.2.4^7.2.8No majors, no upper bounds touched, no allowlist entries added — every advisory here had a real patch.
org/was left alone; itsastro ^7.2.10already satisfied the floor.Why raise a floor that already resolved correctly. A
>=Xfloor that happens to land on a patched version is protection by coincidence — anything in the tree asking for a lower release is still free to pull one in. The floor is what makes it a guarantee.Verified locally
pnpm install --frozen-lockfile— exit 0, so CI's install step will passpnpm audit --audit-level=high— 13 -> 0 violations; the only remaining findings are the two pre-existing allowlistedimage-sizeentries, untouchedWhy a PR and not a push to main
web/vercel.jsonandorg/vercel.jsonbuild every production push, so pushing this tomainwould production-deploy praycalc.com and praycalc.org. Preview builds are skipped, so this PR costs no build minutes. Merging is the deploy approval — per ASI Policy 9.0 that decision is the owner's.