fix(deps): pin nested fast-uri/immutable/uplot instances via npm overrides#30
Open
asachs01 wants to merge 1 commit into
Open
fix(deps): pin nested fast-uri/immutable/uplot instances via npm overrides#30asachs01 wants to merge 1 commit into
asachs01 wants to merge 1 commit into
Conversation
…rides Grouped Dependabot bump (PR #20) resolved most flagged advisories but missed three nested dependency-tree instances that aren't reachable by a top-level version bump: - fast-uri: single instance locked at 3.0.6, vulnerable to GHSA-v39h-62p7-jpjc and GHSA-q3j6-qgpj-74h6. Pinned to 3.1.2, which satisfies both advisories. - immutable: @grafana/runtime's own nested immutable was 5.0.3, vulnerable to GHSA-wf6x-7x77-mvgw. Pinned via nested override syntax scoped to @grafana/runtime only (5.1.5), so the unrelated top-level 4.x instance required by @grafana/ui@10.x (a different major, needed elsewhere) is left alone. sass's own immutable@5.1.9 instance was already patched. - uplot: top-level instance was 1.6.30, vulnerable to GHSA-34q8-jcq6-mc37. @grafana/data's and @grafana/runtime's own uplot instances were already on the patched 1.6.31; only the top-level instance needed the pin. Verified post-install: fast-uri and uplot each resolve to a single patched instance; `npm ls immutable` confirms @grafana/runtime's tree gets 5.1.5 (overridden) while the unrelated @grafana/ui@10.x tree still resolves its own immutable@4.3.5 requirement untouched. Lint, typecheck, and build all pass. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Security-remediation follow-up to the grouped Dependabot bump in #20, which resolved most flagged advisories but couldn't reach three nested dependency-tree instances (they're pinned internally by other packages' own dependency trees, not directly controllable by a top-level version bump). Adds targeted
npm overridesfor each:GHSA-v39h-62p7-jpjc,GHSA-q3j6-qgpj-74h6): only instance in the tree was locked at3.0.6. Override pins it to3.1.2, satisfying both advisories.GHSA-wf6x-7x77-mvgw):@grafana/runtime's own nestedimmutablewas5.0.3. Uses npm's nested override syntax, scoped to@grafana/runtimeonly, pinning it to5.1.5. This deliberately does not touch the unrelated top-level 4.ximmutableinstance required by@grafana/ui@10.x(a different major version needed elsewhere) — forcing that one to 5.x could break whatever depends on 4.x.sass's ownimmutable@5.1.9instance was already patched.GHSA-34q8-jcq6-mc37):@grafana/data's and@grafana/runtime's ownuplotinstances were already on the patched1.6.31. Only the top-level instance (1.6.30) was vulnerable, so a simple top-level override (1.6.31) is sufficient.Verification
npm installregeneratedpackage-lock.jsonwith overrides applied.fast-urianduploteach resolve to a single patched instance (3.1.2/1.6.31).npm ls immutableconfirms@grafana/runtime's tree resolves to5.1.5(marked "overridden"), while the unrelated@grafana/ui@10.xdevDependency tree still resolves its ownimmutable@4.3.5requirement, untouched by the override.npm run lint— clean.npm run typecheck— clean.npm run build— compiles successfully.Test plan
npm installcompletes without errorsfast-uri, nested@grafana/runtimeimmutable, and top-leveluplotversions verified vianpm ls/ lockfile inspectionimmutableinstance confirmed unaffectednpm run lintpassesnpm run typecheckpassesnpm run buildpassesNot merging — holding for explicit human approval per WYRE security process.
🤖 Generated with Claude Code