Repository navigation
chore: force patched brace-expansion via pnpm overrides (GHSA-3jxr-9vmj-r5cp) - #334
Conversation
…mj-r5cp) pnpm audit --audit-level=high newly fails on main: brace-expansion has a high-severity DoS advisory across three ranges (<1.1.16, 2.0.0-2.1.1, 3.0.0-5.0.6), reached transitively through minimatch in the jest and eslint toolchains. Per-major overrides force the patched releases (1.1.16 / 2.1.2 / 5.0.7), mirroring the existing serialize-javascript override. All patched versions clear the 3-day minimumReleaseAge cooldown, so no exclude entry is needed. This unblocks the skipped 'Publish to npm' job so the pending 3.5.0 release can go out. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NuJRpjY81Dzoo92ZooE8Xt
|
Warning Review limit reached
Next review available in: 55 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (1)
WalkthroughThe workspace configuration adds range-specific pnpm overrides that force ChangesDependency Override Updates
Estimated code review effort: 1 (Trivial) | ~2 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Preview DeploymentPreview URL: https://3a56c7f6.bestax.pages.dev |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (1)
pnpm-workspace.yaml (1)
43-47: 🗄️ Data Integrity & Integration | 🔵 Trivial | ⚡ Quick winBound the v5 override to
<6.brace-expansion@>=3.0.0 <5.0.7can drift to a future major on lockfile refresh; use>=5.0.7 <6instead.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@pnpm-workspace.yaml` around lines 43 - 47, Update the brace-expansion v5 override in the workspace override configuration so its replacement range is bounded to >=5.0.7 and <6, while preserving the existing source range and other overrides.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@pnpm-workspace.yaml`:
- Around line 43-47: Update the brace-expansion v5 override in the workspace
override configuration so its replacement range is bounded to >=5.0.7 and <6,
while preserving the existing source range and other overrides.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 2969dd16-38ad-461f-bd0d-8a080309dca5
⛔ Files ignored due to path filters (1)
pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml,!pnpm-lock.yaml
📒 Files selected for processing (1)
pnpm-workspace.yaml
Review feedback: an unbounded '>=5.0.7' replacement could drift onto a future brace-expansion 6.x on lockfile refresh; '>=5.0.7 <6' keeps the override within the patched major. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NuJRpjY81Dzoo92ZooE8Xt
Preview DeploymentPreview URL: https://5609f70c.bestax.pages.dev |
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
Deep review — 0 finding(s)
| # | Severity | Area | Finding | Location |
|---|---|---|---|---|
| — | — | — | No blocking defects found. | — |
Overall: This is a pure supply-chain chore that forces the patched brace-expansion releases (DoS advisory GHSA-3jxr-9vmj-r5cp) via three per-major pnpm overrides. I verified the three override key-ranges map exactly onto the advisory's affected ranges (<1.1.16, 2.0.0–2.1.1, 3.0.0–5.0.6), each replacement is bounded within its major (<2, <3, <6), and the lockfile resolves every remaining brace-expansion copy to a patched version (1.1.16 / 2.1.2 / 5.0.7) with no unpatched stragglers. pnpm-workspace.yaml and pnpm-lock.yaml overrides are identical. No product code, no API, and no runtime behavior changes — the human's only real check is that pnpm audit --audit-level=high passes in CI (I couldn't run it here since it needs network access).
🏄 Totally clean little wax job on the dependency tree, dude — three gnarly
brace-expansionversions swapped out for the patched ones, ranges dialed in tight, nothing else disturbed. Green audit and it's good to paddle out.
|
🎉 This PR is included in version 5.7.0 🎉 The release is available on: Your semantic-release bot 📦🚀 |
|
🎉 This PR is included in version 1.0.0 🎉 The release is available on: Your semantic-release bot 📦🚀 |
|
🎉 This PR is included in version 3.5.0 🎉 The release is available on: Your semantic-release bot 📦🚀 |
|
🎉 This PR is included in version 1.0.0 🎉 The release is available on: Your semantic-release bot 📦🚀 |
2 participants
Pull Request
Description
Fixes the post-merge CI failure on
main:pnpm audit --audit-level=highnewly fails becausebrace-expansionpicked up a high-severity DoS advisory (GHSA-3jxr-9vmj-r5cp) across three ranges (<1.1.16,2.0.0–2.1.1,3.0.0–5.0.6), reached transitively throughminimatchin the jest and eslint toolchains (dev-only; ~100 paths). This blocked the audit step on the #331 merge commit and caused the Publish to npm job to be skipped, so the pending minor release hasn't gone out.The fix adds per-major
pnpmoverrides inpnpm-workspace.yaml, mirroring the existingserialize-javascriptsecurity override, forcing the patched releases1.1.16/2.1.2/5.0.7. All three patched versions were published 12+ days ago, comfortably past the 3-dayminimumReleaseAgecooldown, so no exclude entry is needed. Lockfile regenerated.After the change,
pnpm audit --audit-level=highpasses locally (only 3 moderate advisories remain, below the CI gate), and the fullpnpm allgate is green.@allxsmith/bestax-bulma)create-bestax)@allxsmith/bestax-docs)pnpm-workspace.yaml+pnpm-lock.yaml) — no package source changesRelated Issue(s)
Related to #331 (its merge surfaced the failure; merging this unblocks the skipped release)
Type of Change
Checklist
CLAUDE.mdfiles are updatedScreenshots / Demos
Additional Context
chorecommit type: dev-only transitive dependency pin, no release of any package by itself — but once merged, the next green CI run onmainwill run the previously-skipped Publish job and release the pendingfeatminor from feat(bulma-ui): compound (dot-notation) sub-components for all parent/child families via shared withSubComponents helper #331.--audit-level=high); they can be handled separately if desired.🤖 Generated with Claude Code
https://claude.ai/code/session_01NuJRpjY81Dzoo92ZooE8Xt
Generated by Claude Code
Summary by CodeRabbit