fix(deps): three security overrides had been overtaken by their own fixes - #916
Open
tobyhede wants to merge 1 commit into
Open
fix(deps): three security overrides had been overtaken by their own fixes#916tobyhede wants to merge 1 commit into
tobyhede wants to merge 1 commit into
Conversation
Seven open HIGH/MEDIUM npm alerts, all reachable because the overrides written to close earlier advisories had gone stale in two distinct ways. OVERTAKEN SELECTORS go quiet. `js-yaml@<3.15.0` was overtaken by its own fix — the tree resolved exactly 3.15.0, so nothing matched and nothing lifted it to 3.15.1 (#189). EXACT PINS INSIDE A STILL-MATCHING RANGE are worse: they cannot self-heal, and Dependabot cannot fix them either. `js-yaml@>=4.0.0 <5` kept matching, so a pin written to FIX an advisory was holding the tree at 4.2.0 and blocking 4.3.1 (#155, #188 — quadratic-CPU DoS via merge-key chains, then `!!omap` duplicate-key detection). `fast-uri@<3.1.3` did the same at 3.1.3 while #158 needs 3.1.4 and #175 needs 3.1.5. Both shapes are now written into the comments, because the lesson is reusable: keep the ceiling AHEAD of the patched floor rather than at it. The `postcss` entry already had this treatment and needed no change. THE js-yaml CAUTION IS DISCHARGED, checked rather than assumed. The comment warned that a past bump broke changesets. @changesets/parse declares `js-yaml: ^4.1.1`, which 4.3.1 satisfies; 4.2.0 and 4.3.1 have identical `dependencies` and `exports`, no `engines`, no `main`; 4.3.0 and 4.3.1 are security backports only, with no API removal on the 4.x line — the breaking churn (grouped constant exports, MERGE_KEY removal, mandatory identify) is all on 5.x, which the `<5` ceiling already excludes. Verified by resolving js-yaml from @changesets/parse's own path and running `changeset status`, which parsed every changeset and produced the correct per-package bumps. brace-expansion (#190) is added rather than repaired — a transitive patch bump with no prior entry. No cooldown bypass was needed: every target is 13-70 days old against the 7-day minimumReleaseAge. The comment claiming "4.3.0 is still inside the cooldown" was 54 days stale. None of these is a runtime dependency of any published package, so nothing ships them and this needs no changeset. NOT FIXED HERE, deliberately: `sharp` (#191) wants 0.34.5 -> 0.35.0, a minor on a 0.x native module and therefore breaking by convention — it needs its own exercised build rather than riding along with lockfile hygiene. The `jsonwebtoken` alert is Rust, in packages/protect-ffi/Cargo.lock, and is blocked by an exact `stack-auth = "=0.42.0"` pin in that crate's manifest, so it is a manifest change rather than a lockfile refresh.
|
coderdan
approved these changes
Aug 19, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes seven open npm Dependabot alerts. Independent of any feature work — extracted from #885/#915 so it is not gated behind a 1000-file review.
Two failure shapes, and the second is worse
An overtaken selector goes quiet.
js-yaml@<3.15.0was overtaken by its own fix: the tree resolved exactly 3.15.0, so nothing matched and nothing lifted it to 3.15.1 (#189). The entry sits there looking like a fix while the vulnerable version installs underneath it.An exact pin inside a still-matching range enforces the vulnerability.
js-yaml@>=4.0.0 <5kept matching, so a pin written to fix an advisory was holding the tree at 4.2.0 and blocking 4.3.1 (#155, #188).fast-uri@<3.1.3did the same at 3.1.3 while #158 needs 3.1.4 and #175 needs 3.1.5. This shape cannot self-heal and Dependabot cannot fix it either — the override wins.Both are now written into the comments, because the lesson is reusable: keep the ceiling ahead of the patched floor, not at it. The
postcssentry already had that treatment and needed no change.<3.15.0→3.15.0<3.15.1→3.15.1>=4.0.0 <5→4.2.0>=4.0.0 <5→4.3.1<3.1.3→3.1.3<3.1.5→3.1.5<5.0.7→^5.0.7Resolved:
js-yaml@3.15.1,js-yaml@4.3.1,fast-uri@3.1.5,brace-expansion@5.0.9.The js-yaml caution is discharged, not ignored
The old comment warned that a past js-yaml bump broke changesets. Checked rather than assumed:
@changesets/parse@0.4.3declaresjs-yaml: ^4.1.1, which 4.3.1 satisfies — and it resolves 4.3.1 at its own path, verified, not a nested copydependenciesandexports, noengines, nomainMERGE_KEYremoval, mandatoryidentify) is all on 5.x, which the<5ceiling excludespnpm exec changeset statusparses every changeset and produces the correct per-package bumpsNo cooldown bypass needed — every target is 13–70 days old against the 7-day
minimumReleaseAge. The comment claiming "4.3.0 is still inside the cooldown" was 54 days stale.Verification
code:check0 ·test:scriptsgreen ·supply-chain.e2e.test.ts25 passed ·changeset statuscorrectDeliberately not here
sharp(chore(deps): bump vite from 6.3.5 to 6.4.1 #191) wants 0.34.5 → 0.35.0 — a minor on a 0.x native module, breaking by convention. It needs its own exercised build, not a ride-along with lockfile hygiene.jsonwebtokenis the Rust alert inpackages/protect-ffi/Cargo.lock, blocked by an exactstack-auth = \"=0.42.0\"pin in that crate's manifest — a manifest change, not a lockfile refresh.No changeset: none of these is a runtime dependency of any published package.