Repository navigation
fix(deps): fork builds pin eight security fixes upstream's ranges already allow - #194
Merged
Merged
Conversation
pnpm audit found 23 advisories in the lockfile; GitHub's alert list has not updated since the lockfile moved to pnpm 12's two-document format, so it missed four of them (dompurify among them) and still shows fixed ones. Each new pin is major-scoped and its floor sits inside the range the parent already declares, so no package.json changes: dompurify 3.4.17, hono 4.13.13, http-cache-semantics 4.3.0, ip-address 10.7.4, proxy-addr 2.0.8, seroval 1.7.0, shell-quote 1.12.0, smol-toml 1.9.1. Nothing else in the lockfile moves. Audit: 23 -> 12, criticals 4 -> 0. The rest need a change to an upstream manifest (@modelcontextprotocol/sdk, stream-json, sharp, katex) or have no patched release, so they stay with upstream. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fork builds stop shipping the eight advisories in our lockfile that already have a fix inside the ranges upstream declares, including four criticals.
pnpm auditfinds 23 advisories inpnpm-lock.yaml, and GitHub's alert list misses four of them (dompurifyamong them). GitHub has not re-read the lockfile since #191 moved it to pnpm 12's two-document format, so it also kept fixed alerts open.Eight major-scoped pins go in the fork's existing security-pins block in
pnpm-workspace.yaml. Every floor already satisfies the parent's declared range, so nopackage.jsonchanges, and the pins survive the sync's lockfile rebuild.Tests
pnpm audit(pnpm 12.14.0): 23 advisories before, 12 after. Criticals 4 → 0, highs 9 → 6.pnpm install --lockfile-only: "Lockfile passes supply-chain policies".seroval1.7.0 still exports thecreatePluginandcreateStreamthatseroval-plugins1.5.4 imports.serovalbump.Merge danger
Low, two-way door. The largest jump is
seroval1.5.4 → 1.7.0, the router's serializer; a break would show in the web app.Merge only after the release for
238aed8c8fpublishes. Merging movesmain's tip, so that release would not be marked latest.Your call
@modelcontextprotocol/sdk×5 including 3 high,stream-json,sharp),katex(needs 0.18),uuid@7(Expo), or have no patched release. Leave them all with upstream? I recommend yes. I closed Dependabot's chore(deps-dev): bump @modelcontextprotocol/sdk from 1.29.0 to 1.32.0 in /apps/server #188, which bumped upstream's@modelcontextprotocol/sdkpin.Made by Claude Opus 5.5 in Claude Code, driven from T3 Code.
🤖 Generated with Claude Code