Repository navigation
fix(deps): override handlebars to ^4.7.10 to clear a security advisory - #1273
Merged
Merged
Conversation
Dependabot cannot fix this on its own:
security_update_not_possible
latest-resolvable-version: 4.7.8
lowest-non-vulnerable-version: 4.7.10
4.7.10 is published, but the parents pin 4.7.8 exactly, so the update job fails
on every run. The vulnerable copy comes from dev-only tooling
(`conventional-changelog-writer` 5/6 and `ts-jest` 29), so there is no production
exposure, but the advisory stays open until something resolves a patched version.
A pnpm override resolves it. The lockfile is then formatted with the repo's
Prettier config: pnpm writes it with two spaces while the committed file uses
four, so committing it raw produced a 22k/28k line diff instead of 43/187.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Que tipo de Pull Request es?
Descripci贸n
El job de Dependabot para
handlebarsfalla en cada ejecuci贸n:4.7.10s铆 est谩 publicado, pero los paquetes que lo arrastran lo fijan exacto a4.7.8,as铆 que Dependabot no puede resolverlo por s铆 solo.
Origen: tooling de desarrollo, no producci贸n.
conventional-changelog-writer5.x y 6.x (releases)ts-jest29 (pruebas)No hay exposici贸n en producci贸n, pero el aviso queda abierto hasta que algo resuelva una versi贸n
parcheada.
Cambio
Un
overridede pnpm a^4.7.10en la ra铆z. Verificado conpnpm why handlebars: todos losconsumidores pasan a resolver
4.7.10y no queda ninguna referencia a4.7.8en el lockfile.Nota sobre el lockfile
El lockfile se formatea despu茅s con el Prettier del repo. pnpm lo escribe con dos espacios y el
fichero commiteado usa cuatro, as铆 que commitearlo tal cual produce un diff de 22.000/28.000
l铆neas en vez de 166/305. Es el mismo motivo por el que las PRs de Dependabot (#1266, #1264)
parecen reescribir el lockfile entero.
Verificaci贸n
pnpm install --frozen-lockfilepasapnpm why handlebars: todos los consumidores en 4.7.10provider-voice(136) yprovider-meta(163) pasan.ts-jestusa handlebars, as铆 que es una comprobaci贸n real del overridepnpm run generate:check:starters/apps is in sync