Repository navigation
Override minimatch and fflate to patched versions (npm audit clean) - #20
Merged
Merged
Conversation
typescript-eslint 8.72.2 still asks for minimatch ^10.2.2, which is in the vulnerable range (>=7.0.0 <11.0.1). Lint only; the minimatch 3.x copies are outside the range. Remove the override once typescript-estree allows 11.
vinext 1.4.5 pins @vercel/og 1.0.3, which pins satori 0.33.5 and fflate 0.7.3. The latest satori still pins 0.7.3. 0.7.5 is the patched release in the same minor line. mPile never generates OG images, and fflate isn't in the build. npm audit now finds 0 vulnerabilities.
vqsierra
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes Dependabot alert 84 and the 4
fflateaudit findings. No code change is needed: mPile never calls either package, and neither one ends up in the built site.@typescript-eslint/typescript-estreewas affected. typescript-eslint 8.72.2, the latest, still asks for^10.2.2, so this overrides it to 11.0.8. Lint only. The minimatch 3.x copies used by eslint are outside the vulnerable range.@vercel/og1.0.3 → satori 0.33.5 → fflate 0.7.3, and the latest satori still pins 0.7.3. This overrides it to 0.7.5, the patched release in the same minor line. It's used only for OG image generation, which mPile doesn't use, and none of it is indist.npm audit fix --forcewould downgrade vinext to 0.2.1, which would break the build.Both overrides are scoped to the one package that pulls in the vulnerable version. Remove them once upstream allows the patched versions.
Checks:
npm auditfinds 0 vulnerabilities (it found 11).npm run verifypasses: lint, 22 tests, typecheck, build and build check.