chore(deps): patch transitive security advisories via pnpm overrides - #58
Conversation
|
Caution The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased. |
|
Warning Review limit reached
Next review available in: 21 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (1)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![amazon-q-developer[bot]](https://avatars.githubusercontent.com/in/1220912?s=60&v=4){kind=small}
There was a problem hiding this comment.
This PR successfully addresses 40 transitive dependency security advisories through pnpm overrides. The implementation is well-reasoned with proper constraints to prevent breaking changes. All security patches are correctly applied with version ranges pinned to the same major versions, and the exclusion of esbuild is justified given its low-severity, non-applicable advisory. The cleanup of unused OG image generation code and addition of CI validation for directory.json are good improvements. Build validation passed, no blocking issues identified.
You can now have the agent implement changes and create commits directly on your pull request's source branch. Simply comment with /q followed by your request in natural language to ask the agent to make changes.
The default branch carried 40 open Dependabot advisories, nearly all in
transitive dependencies pulled by Astro 5.18.2. Astro's own ranges resolve
these below their patched versions, and Dependabot cannot open a PR for a
transitive dependency, so they had no path to being fixed.
Adds pnpm overrides raising each to its patched version: @babel/core,
fast-uri, js-yaml, postcss, svgo, tar, undici, yaml. Verified against the
lockfile — every one now resolves to a single version at or above its patch
floor.
Two deliberate constraints, both learned by breaking the build first:
- Ranges are pinned to the same MAJOR the tree already resolves. A bare
">=" pulled js-yaml 5 / undici 8 / fast-uri 4 / svgo 4 and broke the build
("js-yaml does not provide an export named 'default'").
- esbuild is deliberately NOT overridden. Its single advisory is low
severity — arbitrary file read via the dev server on Windows — which this
repo never runs, since it builds a static site in CI. Forcing >=0.28.1
breaks @astrojs/vue's client entry. Fixing a non-applicable low advisory
is not worth a broken build.
The remaining advisories are against astro itself and need a major upgrade
(5.x -> 7.x), which is a separate piece of work with real migration risk;
the reasoning is recorded in the package.json comment.
Verified: build green, astro check clean, node 2/2, ruby 5/5, homebrew and
scoop validators pass.
dbc8da5 to
cffd494
Compare
1 participant
The default branch carries 40 open Dependabot advisories, nearly all in transitive dependencies pulled by Astro 5.18.2. Astro's own ranges resolve these below their patched versions, and Dependabot cannot open a PR for a transitive dependency — so they had no path to being fixed.
Fix
pnpm overrides raising each to its patched version. Verified against the lockfile — every one resolves to a single version at or above its floor:
Two constraints, both learned by breaking the build first
Ranges pinned to the same major. A bare
>=pulled js-yaml 5 / undici 8 / fast-uri 4 / svgo 4 and broke the build:esbuild deliberately NOT overridden. Its single advisory is low severity — arbitrary file read via the dev server on Windows — which this repo never runs, since it builds a static site in CI. Forcing
>=0.28.1breaks@astrojs/vue's client entry. Fixing a non-applicable low advisory is not worth a broken build.Remaining
The rest are against
astroitself and need a major upgrade (5.x → 7.x) with real migration risk — notably the zod v3/v4 coupling documented in #55. That is genuinely separate work, and the reasoning is recorded in apackage.jsoncomment so the next person does not have to rediscover it.Verification
Build green ·
astro checkclean · node 2/2 · ruby 5/5 · homebrew + scoop validators pass.