Clear the 17 open Dependabot alerts via pnpm overrides (API-942) - #7
Merged
kiernanmcgowan merged 2 commits intoAug 19, 2026
Conversation
All 17 alerts are transitive devDependencies of the shadcn/vitest toolchain in pnpm-lock.yaml. Adds pnpm.overrides floors for the seven vulnerable packages and regenerates the lockfile; the four packages whose latest release crossed a major (undici, fast-uri, js-yaml, @hono/node-server) are ceiling-capped to stay inside their current major so no untested major bump rides along. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…icy (API-942) CI runs pnpm 11, which ignores the package.json "pnpm" field (overrides now live in pnpm-workspace.yaml) and enforces a 24h minimumReleaseAge that rejected hono@4.13.3 (published <24h before the run). Moves the seven overrides to pnpm-workspace.yaml, drops the dead package.json block, and caps hono at <4.13 so it resolves to 4.12.34 — exactly the patched floor. All seven resolved versions verified >8 days old, and the full 508-entry lockfile passes pnpm 11's supply-chain check. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
alexbaldwin
deleted the
kiernan/api-942-clear-the-17-open-dependabot-alerts-in-the-logo-api-registry
branch
September 1, 2026 20:33
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes API-942.
Problem
This repo has 17 open Dependabot alerts, all transitive npm devDependencies of the shadcn/vitest toolchain in
pnpm-lock.yaml. None are direct dependencies, and none ship in the published registry output, but the repo is public and five of the seven packages carry high-severity advisories.Approach
Adds pnpm
overridesfor the seven vulnerable packages and regenerates the lockfile — no direct-dependency changes. Two adjustments from the groomed plan:pnpm-workspace.yaml, notpackage.json— CI runs pnpm 11, which ignores thepackage.json"pnpm"field.<4.13because hono@4.13.3 was published within 24h and trips pnpm 11'sminimumReleaseAgesupply-chain policy — it resolves to 4.12.34, exactly the patched floor.Resolved versions: undici 7.29.0, ip-address 10.5.0, fast-uri 3.1.5, postcss 8.5.26, js-yaml 4.3.1, hono 4.12.34, @hono/node-server 1.19.17 — each at or above its first-patched version, each within its prior major, each published >8 days ago (youngest is ip-address). The full 508-entry lockfile passes pnpm 11's supply-chain check.
Security alerts
Tests
Verified with pnpm 11 (CI's pinned version):
pnpm install --frozen-lockfilefrom a clean state (the step that failed on the first push),pnpm test(16/16),pnpm typecheck,pnpm lint,pnpm build, andgit diff --exit-code r/(registry output byte-identical) all pass.🤖 Generated with Claude Code