Fix workspace dependency vulnerabilities - #11926
Conversation
commit: |
|
All changed packages have been documented.
Show changes
|
|
You can try these changes here
|
There was a problem hiding this comment.
🟢 Approval recommended
The changes are limited to dependency/catalog bumps plus corresponding lockfile and changelog updates, with no code-path logic changes introduced.
Pull request overview
This PR updates the root pnpm workspace dependency catalog and lockfile to pull in patched versions that address multiple Dependabot security alerts, and refreshes the HTTP server JS scaffold’s generated dependency version mapping to stay in sync.
Changes:
- Bump workspace catalog versions for Astro, Sharp, Morgan, and Multer to patched releases.
- Refresh the root
pnpm-lock.yamlso transitive vulnerable versions (e.g.,qs,js-yaml) resolve to patched versions. - Update
@typespec/http-server-jsgenerated dependency definitions and add Chronus entries for the affected packages.
File summaries
| File | Description |
|---|---|
| pnpm-workspace.yaml | Updates the workspace catalog to the patched versions for key vulnerable dependencies. |
| pnpm-lock.yaml | Refreshes the lockfile to ensure the workspace resolves patched direct/transitive dependency versions. |
| packages/http-server-js/generated-defs/package.json.ts | Updates the generated dependency-version map used by the JS HTTP server scaffold (e.g., morgan 1.12.0). |
| .chronus/changes/workspace-security-spector-2026-09-10.md | Adds a dependencies changelog entry for @typespec/spector security-related dependency bumps. |
| .chronus/changes/workspace-security-http-server-js-2026-09-10.md | Adds a dependencies changelog entry for @typespec/http-server-js scaffold dependency bump. |
Review details
Files not reviewed (1)
- pnpm-lock.yaml: Generated file
- Files reviewed: 4/5 changed files
- Comments generated: 0
- Review effort level: Lite
💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
b6eec8e
into
microsoft:main
There was a problem hiding this comment.
🟡 Changes recommended
Sharp platform artifacts remain unavailable from the Azure feed, blocking reliable Windows and other platform installs.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Review details
Files not reviewed (1)
- pnpm-lock.yaml: Generated file
- Files reviewed: 4/5 changed files
- Comments generated: 1
- Review effort level: Lite
| rollup-plugin-visualizer: 7.1.1 | ||
| semver: ^7.8.5 | ||
| sharp: ^0.35.3 | ||
| sharp: ^0.35.4 |
The root pnpm workspace has 11 open Dependabot alerts, including Astro image-processing RCE and denial-of-service vulnerabilities in request parsing.
Resolve those alerts with patched versions:
Refresh all affected transitive copies and the generated HTTP server dependency version. The excluded C#/Java/Python emitter lockfiles remain unchanged.
Azure feed follow-up: all seven security target tarballs and uncached macOS ARM64 Sharp downloads are available. Windows and other optional Sharp platform artifacts still return HTTP 401. A full Azure-registry install also encounters a 401 during pnpm's supply-chain check for the existing
@astrojs/compiler-binding-linux-arm64-gnupackage. Those feed artifacts still need to be made available.