[NO-ISSUE] chore: raise brace-expansion floor and prune pnpm overrides to minimal set#801
Open
robsongajunior wants to merge 2 commits into
Open
[NO-ISSUE] chore: raise brace-expansion floor and prune pnpm overrides to minimal set#801robsongajunior wants to merge 2 commits into
robsongajunior wants to merge 2 commits into
Conversation
…s to minimal set pnpm audit was failing on GHSA-mh99-v99m-4gvg (brace-expansion DoS, high, patched 5.0.8); raising the existing floor clears it. Every other override was then validated against the lockfile: each dependent's declared range was resolved without the override and audited. Only 5 of 23 entries still guard a live advisory or a resolution hazard. - keep: brace-expansion (raised to >=5.0.8), minimatch (brace-expansion API interlock), uuid (GHSA-w5hq-g745-h8pq), @babel/core (bounded <8), @hono/node-server (GHSA-frvp-7c67-39w9; MCP SDK still pins ^1.19.x) - drop 3 dead entries (mathjs, serialize-javascript, @babel/plugin-transform-modules-systemjs — no longer in the tree) - drop 10 no-ops whose dependents already resolve >= floor (handlebars, tar, flatted, lodash, lodash-es, @xmldom/xmldom, follow-redirects, form-data, ws, qs) - drop 5 force-majors whose natural resolutions are patched now: js-yaml -> 4.3.0/3.15.0, fast-uri -> 3.1.4, picomatch -> +2.3.2, undici -> 7.29.0, vite -> 6.4.3 (back to the ^6.4.3 the manifests declare; clears the unmet esbuild peer that forced vite@8 introduced) - drop the now-inert js-yaml@5.2.2 minimumReleaseAgeExclude entry pnpm audit: clean (0 vulnerabilities). Root-only change - no package release is cut.
…g it from the removed override The pruned vite override (unbounded >=6.4.3 floor) had been resolving to 8.1.5, so vite 8 was the de-facto CI toolchain even though the manifests declared ^6.4.3. Removing the override downgraded builds to 6.4.3 and the size gate measured accordion-root/table-root over their vite-8-calibrated budgets (15.36/48.21 KB vs 11.29/42.92 KB on vite 8). Declaring ^8.1.5 in the three manifests keeps the effective toolchain identical to main and keeps the bundle budgets ratcheting down instead of being raised for a measurement artifact.
robsongajunior
enabled auto-merge (squash)
July 26, 2026 03:14
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
pnpm auditwas failing on GHSA-mh99-v99m-4gvg (brace-expansion DoS, high, patched 5.0.8) — the existing floor was stale at>=5.0.6; raised to>=5.0.8.pnpm-workspace.yaml#overridesfrom 23 entries to 5. Every override was validated empirically: dependents' declared ranges were resolved without the override in a scratch copy of the workspace and the regenerated lockfile audited. Only 5 entries still guard a live advisory or a resolution hazard; each kept entry is now annotated with its reason.vite: ^8.1.5explicitly (root, storybook, icons-gallery) — see Notes.Kept (5):
brace-expansion >=5.0.8,minimatch >=9(keeps minimatch@3 chains out so the brace-expansion force stays within one API major),uuid >=14(GHSA-w5hq-g745-h8pq, naturals 8.x/9.x vulnerable),@babel/core >=7.29.1 <8(peer ranges would jump to Babel 8),@hono/node-server >=2.0.5(GHSA-frvp-7c67-39w9; MCP SDK latest still pins^1.19.x— drop when it moves to^2).Removed (18): 3 dead (
mathjs,serialize-javascript,@babel/plugin-transform-modules-systemjs— not in the tree), 10 no-ops (handlebars,tar,flatted,lodash,lodash-es,@xmldom/xmldom,follow-redirects,form-data,ws,qs— resolution unchanged), and 5 force-majors whose natural resolutions are patched now (js-yaml→ 4.3.0/3.15.0,fast-uri→ 3.1.4,picomatch→ +2.3.2 split,undici→ 7.29.0). Also drops the now-inertjs-yaml@5.2.2entry fromminimumReleaseAgeExclude.Notes
>=6.4.3override floor had been resolving vite to 8.1.5, making vite 8 the de-facto CI toolchain while the manifests still declared^6.4.3. Removing the override initially downgraded builds to 6.4.3 and the size gate flaggedaccordion-root/table-rootover their vite-8-calibrated budgets (15.36/48.21 KB on vite 6 vs 11.29/42.92 KB on vite 8). Declaring^8.1.5keeps the effective toolchain identical to main and keeps the bundle budgets ratcheting down instead of raising them for a measurement artifact.pnpm auditafter the change: No known vulnerabilities found.packages/*source is touched — no package release is cut.