mirror of
https://github.com/Fission-AI/OpenSpec.git
synced 2026-09-14 20:16:53 +08:00
Clay Good
e4e112d94f
The security overrides were declared twice: in pnpm-workspace.yaml, with the advisory comments explaining each pin, and again under package.json's pnpm.overrides. The copies are not additive — pnpm 10 uses package.json's block instead of the workspace list when both are present — and Dependabot rewrites plain-name entries in package.json whenever it bumps the same package. So a routine bump silently displaces the pins that patch advisories, and fails the equality test that guards them (#1812). Keeps one declaration, in the file that carries the reasoning, and asserts the mirror stays gone. Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
25 lines
1.1 KiB
YAML
25 lines
1.1 KiB
YAML
packages:
|
|
- '.'
|
|
|
|
allowBuilds:
|
|
esbuild@0.28.1: true
|
|
|
|
# The only declaration of these. A `pnpm.overrides` block in package.json does not
|
|
# merge with this list — pnpm 10 uses it *instead of* this file (verified: a lone
|
|
# entry there produced a lockfile with only that override). Dependabot rewrites
|
|
# plain-name entries in package.json when it bumps the same package, so a mirrored
|
|
# copy there both drifts and silently takes precedence over these advisory pins.
|
|
overrides:
|
|
brace-expansion@<=5.0.8: '>=5.0.9 <6'
|
|
postcss@<8.5.23: '>=8.5.23 <9'
|
|
# GHSA-5p4m-2wfm-xmqj — js-yaml quadratic-CPU !!omap DoS. Dev-only (pulled by
|
|
# @changesets: read-yaml-file for 3.x, @changesets/parse for 4.x); never in the
|
|
# published CLI. Remove once changesets' transitive js-yaml is >=3.15.1 / >=4.3.1
|
|
# (check: pnpm why js-yaml).
|
|
js-yaml@>=3.0.0 <3.15.1: '>=3.15.1 <4'
|
|
js-yaml@>=4.0.0 <4.3.1: '>=4.3.1 <5'
|
|
# GHSA-2v37-7h3g-55p8 / CVE-2026-67213 — nanoid infinite loop on size=0. Dev-only
|
|
# (transitive via postcss). Remove once transitive nanoid is >=3.3.17
|
|
# (check: pnpm why nanoid).
|
|
nanoid@<3.3.17: '>=3.3.17 <4'
|