chore(deps): widen exact-pinned security overrides to caret ranges - #273
chore(deps): widen exact-pinned security overrides to caret ranges#273escooterclinic wants to merge 1 commit into
Conversation
Every `overrides` entry here exists to force a transitive dependency up to a safe version. Pinned to an exact version, each one stops receiving the next safe version, so the entry has to be bumped by hand every time a new advisory lands — and until someone does, the override is what holds the tree on the vulnerable version. `tar` shows the cost in this repo's own history: 2026-03-09 619f239 7.5.10 2026-03-12 3968d01 7.5.11 2026-06-17 72433b9 7.5.16 2026-06-18 b269934 7.5.11 <- silently back inside the advisory range 2026-06-19 22fb5c3 7.5.16 2026-07-22 94f85eb 7.5.21 Five hand-bumps in five months, one of which moved it backwards into a range GHSA-vmf3-w455-68vh et al. cover (<=7.5.20). A caret range cannot regress like that, and `npm audit fix` can act on it instead of reporting a fix it is not allowed to apply. Mechanical change, `package.json` only. Regenerating the lockfile after it produces no diff — every pinned version was already the newest inside its own caret range — and `npm audit` still reports 0 vulnerabilities. The `@posthog/nuxt` entry is an alias, not a version pin, and is left alone. If a full sweep is more than you want, `tar` alone carries the argument. Signed-off-by: Patryk Radek <patryk@escooterclinic.co.uk>
|
Warning Review limit reached
Next review available in: 59 minutes You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
1 participant
Summary
What: turns the 24 exact-version
overridesentries into caret ranges(
"tar": "7.5.21"→"tar": "^7.5.21").package.jsononly.Why: every one of those entries exists to force a transitive dependency up to a safe
version. Pinned to an exact version, the entry stops receiving the next safe version — so
it has to be bumped by hand each time a new advisory lands, and until someone does, the
override is the thing holding the tree on the vulnerable version.
npm audit fixreportsa fix for it on every run and can never apply it, because the pin outranks the fix.
tarshows what that costs, in this repo's own history:overrides.tar619f2393968d0172433b9b26993422fb5c394f85ebFive hand-bumps in five months, and one of them moved the pin backwards into the range
GHSA-vmf3-w455-68vhand friends cover (<=7.5.20), where it sat for a day. A caret rangecannot regress like that.
Nothing is currently vulnerable —
npm auditonmainis clean today. This is about thenext advisory, not a live one.
What it does not change
The
@posthog/nuxtentry is an alias (npm:empty-npm-package@1.0.0), not a version pin,and is left alone. Caret keeps every override inside its current major, so no transitive
major can arrive through this route.
If a full sweep is more than you want,
taralone carries the argument and the other23 lines can be dropped from this PR.
Type of change
Validation
all — every pinned version was already the newest inside its own caret range — under
both npm 10.9.8 and npm 11.11.1.
npm auditreports 0 vulnerabilities before and after.That is why this PR is one file.
DCO
Signed-off-by) viagit commit -s