chore(deps): minor-patch group, and floor nanoid to clear GHSA-2v37-7h3g-55p8 - #72
Merged
Merged
Conversation
Bumps the minor-patch group with 3 updates: [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node), [knip](https://github.com/webpro-nl/knip/tree/HEAD/packages/knip) and [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint). Updates `@types/node` from 26.1.2 to 26.2.0 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Updates `knip` from 6.31.0 to 6.32.0 - [Release notes](https://github.com/webpro-nl/knip/releases) - [Commits](https://github.com/webpro-nl/knip/commits/knip@6.32.0/packages/knip) Updates `typescript-eslint` from 8.65.0 to 8.66.0 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.66.0/packages/typescript-eslint) --- updated-dependencies: - dependency-name: "@types/node" dependency-version: 26.2.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: minor-patch - dependency-name: knip dependency-version: 6.32.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: minor-patch - dependency-name: typescript-eslint dependency-version: 8.66.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: minor-patch ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
nanoid 3.3.16 carries a HIGH (8.2) advisory fixed in 3.3.17, and it reaches this repo transitively through postcss. postcss declares "^3.3.16", so the fixed release is already inside its range, but bun does not re-resolve a locked version that still satisfies its range: a plain install leaves 3.3.16 in place indefinitely and the scan keeps failing. An override floor takes it, matching the esbuild floor already here and the transitive-override pattern the dependency registry describes. It resolves to 3.3.18. The override is auditable rather than permanent: drop it once the natural resolution of every locked copy clears the floor. Verified: osv-scanner reports no issues against this lockfile, and typecheck, lint, 166 tests, build and knip are green.
vvillait88
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Dependabot's grouped minor-patch bump (
@types/node, thetypescript-eslintset,knip,get-tsconfig), plus the fix for the advisory that was failing this PR's Dependency Scan.nanoid3.3.16 carries a HIGH (8.2) advisory, GHSA-2v37-7h3g-55p8, fixed in 3.3.17. It reaches this repo transitively throughpostcss, which declares"^3.3.16", so the fixed release was already inside its range. The reason a re-install did not take it: bun does not re-resolve a locked version that still satisfies its range, so 3.3.16 sits there indefinitely and the scan keeps failing. An override floor takes it, and it resolves to 3.3.18.The floor matches the
esbuildfloor already in this manifest. It is auditable rather than permanent: it should be dropped once the natural resolution of every locked copy clears it.Nothing else is outstanding here.
bun outdatedreports onlyeslint10 andtypescript7, both of which are deliberately held at their current majors as org-wide upgrades rather than routine bumps.Type of change
Public API
None. Every bump here is a devDependency, and the nanoid floor affects a transitive package only. No exported type, signature, wire format, or response shape changes.
Test plan
Run locally on this branch, all green:
bun run typecheck,bun run lint,bun run test(166 passed, 9 skipped),bun run build, andbun run knip.The advisory fix is verified by positive evidence rather than by the absence of a failure:
osv-scanner scan --lockfile=bun.lockreports "No issues found" against the same lockfile CI scans, and the lock resolvesnanoid@3.3.18.Checklist