Repository navigation
Fix CI: record pnpm in the lockfile, update vulnerable dependencies - #46
Merged
Merged
Conversation
pnpm 12 keeps the version from packageManager in a section of pnpm-lock.yaml, and a frozen install fails if it is missing. Moving to 12.16.1 in 15ccf53 changed package.json only, so every CI job has failed at pnpm install since. It didn't show locally because an older global pnpm that switches itself to 12.16.1 doesn't check this. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
next 16.4.3 (critical RCE and high DoS, templates/nextjs). shadcn 4.23.0, a dev dependency, which moves its zod to 4.6.7. In the lockfile, within existing ranges: body-parser 2.4.0, qs 6.17.1, fast-uri 3.1.9, ip-address 10.7.5, undici 7.30.1 and 8.12.3, systeminformation 5.33.19. pnpm audit --prod is clean. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
n4ff4h
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Makes CI pass again. Two commits, both needed; nearly every CI job has failed since
15ccf53, onmainand on every PR.1. Lockfile
pnpm 12 keeps the version from
packageManagerin a section at the top ofpnpm-lock.yaml, and a frozen install fails if it is missing.15ccf53changedpackage.jsononly. It didn't show locally because a global pnpm 10 that switches itself to 12.16.1 doesn't check this. Running 12.16.1 directly, aspnpm/action-setupdoes, reproduces the error.2. Vulnerabilities
With the install working, the
pnpm audit --prod --audit-level highstep failed on 10 advisories. It is now clean.next(critical RCE, high DoS)templates/nextjsbody-parserqsfast-uriip-addressA full audit including dev dependencies also listed these, now fixed:
undici,systeminformation, andzod3 (shadcn4.21 → 4.23, a dev dependency used by the sync script, which moves it to zod 4).Still listed by a full audit, dev-only, and not failing CI:
minimatch(moderate; the fix is a major version that ESLint plugins andts-morphdon't accept) anddeepmerge(low; no patched version exists).No changeset: the published packages' dependency ranges don't change.
Merging
Merge this first. #41–#45 already contain it through a merge commit, because the lockfile conflicted with Part A's dependency changes. #40 needs a CI re-run after this lands.
🤖 Generated with Claude Code