Repository navigation
chore(deps): patch undici advisories via override (>=6.27.0) - #193
Merged
Merged
Conversation
Resolves four open Dependabot alerts for undici (all fixed in 6.27.0): high GHSA-vxpw-j846-p89q, medium GHSA-p88m-4jfj-68fv, and low GHSA-35p6-xmwp-9g52 / GHSA-g8m3-5g58-fq7m. undici was pulled in transitively at 6.25.0 via node-gyp (an optional native-build dependency of sqlite3), not declared in any package. Added a root pnpm.overrides entry `undici@<6.27.0` -> `>=6.27.0 <7`. The upper bound keeps undici on the 6.x line so it stays within node-gyp's `^6.25.0` range (an open-ended `>=6.27.0` would let pnpm resolve to undici 8.x and break node-gyp). Documented under vNext in the HISTORY of the three packages whose dependency tree includes node-gyp: aurora-data-api-connector, knex-connector, and migrations.
Contributor
Coverage report
Posted by |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Resolves the four open Dependabot alerts for undici (all fixed in
6.27.0):Why / how
undici was pulled in transitively at 6.25.0 via
node-gyp— an optional native-build dependency ofsqlite3— and is not declared in any workspacepackage.json. Added a rootpnpm.overridesentry, matching the existing override style:The
<7upper bound is deliberate:node-gyp@12.3.0requires undici^6.25.0, and an open-ended>=6.27.0would let pnpm resolve to undici 8.x (thelatesttag), breaking that range.6.27.0is the latest 6.x line and the patched version, satisfying both the advisories and node-gyp. The lockfile now resolves undici to6.27.0everywhere.HISTORY
Documented under
## vNextin the three packages whose dependency tree includesnode-gyp—aurora-data-api-connector,knex-connector, andmigrations— matching the scope of the priortaroverride note (samenode-gypchain).Verification
pnpm install --frozen-lockfilepasses; no undici < 6.27.0 remains in the lockfile.pnpm test:release) pass (27/27; the unrelatedno-eval-in-distcheck requires a priorpnpm buildand is not affected by this change).