fix(deps): override transitive dependencies to non-vulnerable versions - #63
Open
NiKrause wants to merge 1 commit into
Open
fix(deps): override transitive dependencies to non-vulnerable versions#63NiKrause wants to merge 1 commit into
NiKrause wants to merge 1 commit into
Conversation
Dependabot could not open security PRs for 15 packages, failing every run
with `security_update_not_possible` and an empty `conflicting-dependencies`
list, e.g.:
"dependency-name": "dompurify",
"latest-resolvable-version": "3.4.3",
"lowest-non-vulnerable-version": "3.4.12"
All of them are transitive (mostly via the Docusaurus site) and capped by
their parents' ranges, so Dependabot has nothing it can bump on its own.
Pin them through pnpm overrides instead, covering the 31 open alerts.
Packages that exist in more than one major line are scoped so the other
line is left untouched:
- js-yaml@3 and js-yaml@4 (both are in the tree)
- brace-expansion@1, http-proxy-middleware@2
`ws` moves from ^8.20.1 to ^8.21.0 for the remaining advisory.
Verified: pnpm install resolves every package to a patched version, the
full build succeeds including the Docusaurus site, and all package tests
pass (core 102, browser 45, rootfs 50, playwright 26, ui 18, node 84,
aleph-bootstrap 18, shared-types 3).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes the failing Dependabot Updates runs (#84–#91 and older).
Why Dependabot cannot fix these itself
Every run fails with
security_update_not_possibleand an emptyconflicting-dependencieslist:All 15 packages are transitive (mostly via the Docusaurus site) and capped by their parents' version ranges, so there is no direct dependency for Dependabot to bump. The fix has to be a resolution override.
Change
Pin all 31 open alerts through
pnpm.overrides:body-parser1.20.6 ·brace-expansion@11.1.16 ·dompurify3.4.12 ·esbuild0.28.1 ·fast-uri3.1.4 ·http-proxy-middleware@22.0.10 ·joi17.13.4 ·js-yaml@33.15.0 ·js-yaml@44.3.0 ·launch-editor2.14.1 ·shell-quote1.9.0 ·svgo3.3.4 ·uuid11.1.1 ·webpack-dev-server5.2.6 ·websocket-driver0.7.5 ·ws^8.20.1 → ^8.21.0Scoped overrides where two major lines coexist — a blanket override would have forced one major onto consumers of the other:
js-yaml: both 3.14.2 and 4.1.1 are in the treebrace-expansion@1,http-proxy-middleware@2Verification
pnpm installresolves every listed package to a patched version (checked against the lockfile).pnpm -r buildsucceeds — including the Docusaurus site, which is where most of these deps live.🤖 Generated with Claude Code