fix(deps): bump pinned devalue override and drop npm-run-all#201
Merged
Conversation
The pnpm.overrides pin for devalue (5.6.4) predated devalue 5.8.1, which patches GHSA-77vg-94rm-hx3p (DoS via sparse array deserialization) and is what astro's own dependency range already requires. Bumping the override closes the alert without any other change. npm-run-all is unmaintained and its minimatch@3 dependency was being force-pinned to the vulnerable 3.1.3 (GHSA-23c5-xmqv-rm74), which in turn pulled a vulnerable brace-expansion@1.1.11 (GHSA-f886-m6hf-6m8v, GHSA-v6h2-p8h4-qcjw). Replacing it with the actively maintained npm-run-all2 fork (same run-p/run-s binaries) across the five examples removes that chain entirely, so the minimatch@3 override pin is no longer needed.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Coverage Report
File CoverageNo changed files found. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Closes 4 of the 9 currently-open Dependabot alerts by fixing two root causes:
devalueoverride was stale (High, GHSA-77vg-94rm-hx3p):pnpm.overrides["devalue"]was pinned to5.6.4, which predates5.8.1— the patched version, and also the versionastro's owndependenciesrange (^5.8.1) already resolves to on its own. Bumping the override to5.8.1closes the alert with no other change needed.npm-run-allis unmaintained and itsminimatch@3dependency was force-pinned viapnpm.overrides["minimatch@3"] = "3.1.3"— itself the vulnerable version (High, GHSA-23c5-xmqv-rm74; needs>=3.1.4), which in turn pulled a vulnerablebrace-expansion@1.1.11(Medium GHSA-f886-m6hf-6m8v, Low GHSA-v6h2-p8h4-qcjw). Replacednpm-run-allwith the actively maintained forknpm-run-all2across the five examples that use it (react-app, react-router-6-app, react-router-7-app, nextjs-app, tanstack-router-app). It ships the samerun-p/run-sbinaries used in eachdevscript, so no script changes were needed. Withnpm-run-allgone, theminimatch@3override is no longer needed and was removed.Not in scope: the remaining 5 alerts (
esbuild@0.27.7Low,vite@5.4.21High/Medium ×2,esbuild@0.21.5/0.23.1Medium) are either an accepted, already-documented risk (vitest's bundled dev-only, non-network-exposed vite/esbuild — see #198) or require anastro6→7 major bump (esbuildfloor only reaches the patched0.28.1starting from astro 7, which also needs a@astrojs/starlightbump to^0.41for theastro@^7peer). Left for a follow-up PR.Verification
pnpm buildpnpm test(76 passed, 1 skipped, coverage thresholds met)pnpm lintpnpm --filter @7nohe/react-app generate:api && pnpm --filter @7nohe/react-app test:generatedminimatch@3.1.3/brace-expansion@1.1.11no longer appear anywhere inpnpm-lock.yamlexamples/*/node_modules/.bin/run-presolves tonpm-run-all2