Repository navigation
Remove the temporary yarn resolutions as their parents are upgraded #269
Description
#263 adds a resolutions block to package.json that forces vulnerable transitives onto patched versions, because the parents that declare them (graph-cli, hardhat 2, solc, ethereum-waffle) pin ranges below the patched majors. Each entry is a workaround for one parent and should be deleted when that parent goes away. Tracking table, updated for #264:
| Resolution | Owner | Delete when |
|---|---|---|
**/binary-install-raw/axios, **/binary-install-raw/tar, **/ipfs-http-client/parse-duration, **/ipfs-core-utils/parse-duration |
graph-cli 0.69 | Removed in #264, the parents are gone under 0.98 |
**/apisauce/axios, **/ipfs-unixfs/protobufjs, **/jayson/uuid, **/tmp-promise/tmp |
graph-cli, still present under 0.98 via gluegun, kubo-rpc-client and jayson | when graph-cli updates those, check each release |
**/gluegun/cross-spawn, **/gluegun/semver, **/@graphprotocol/graph-cli/glob, **/@graphprotocol/graph-cli/undici, **/@graphprotocol/graph-cli/yaml |
graph-cli 0.98, added in #264 | when graph-cli bumps its own ranges past the patched versions |
the allow-ghsas entry in dependency-review.yml (not a resolution) |
graph-cli 0.98, see the comment on that line | when the upstream dependency is updated or dropped |
**/hardhat/undici, **/hardhat/adm-zip, **/hardhat/uuid |
hardhat 2 | #268 |
**/mocha/js-yaml, **/mocha/minimatch, **/mocha/diff, **/mocha/serialize-javascript |
mocha 10 pinned by hardhat | #268, a standalone mocha 11 has no old pins |
**/solc/tmp |
solc via hardhat and waffle | #268. solc only touches tmp in smtsolver.js (tmp.fileSync, still present in 0.2.x), which runs only with the SMT checker; this repo compiles no Solidity, so the override is safe until then. Raised on #263 by Copilot. |
**/request/tough-cookie, **/jsprim/json-schema |
request via ethereum-waffle | #268, or the waffle replacement PR |
**/@ethersproject/providers/ws |
ethers v5 | #268, if it moves to ethers v6 |
same-major floors (immutable, elliptic, lodash, qs, secp256k1, follow-redirects, nanoid, base-x, braces, cookie, ejs, @protobufjs/utf8) |
mixed | any time, the lockfile already holds the patched versions |
After each removal: yarn install, yarn codegen, yarn build, and check that the Dependabot alert count on main does not go up.
Also open: two alerts in the Security tab have no patched release upstream. Review them there and dismiss or wait as appropriate.
Activity
dmcrider commentedon Sep 15, 2026
Nice tracking table — this is exactly the “when can this pin leave?” job after a security/compat resolution lands.
If it’s useful alongside the parent-upgrade checklist: Backpatch is a report-only API + GitHub Action that marks npm/yarn/pnpm overrides
SafeToRemovewhen an upstream parent already ships the fixed transitive. Default path is trial + Actionfail-on: never(report in CI, you decide) — not auto-delete.Action:
cridertechnologies/backpatch-action