chore(deps): bump undici to 8.10.1 in pnpm-lock.yaml - #155
Merged
Conversation
Resolves Dependabot alerts #4-#8 (GHSA-4cwx-7wf7-3272 plus four medium advisories, all fixed in undici 8.9.0). undici is a transitive devDependency of testcontainers, which already allows ^8.5.0. The Dependabot security job could not ship this bump because the `pnpm update <dep>@<ver> --lockfile-only --no-save -r` command it runs is a silent no-op for transitive dependencies (dependabot/dependabot-core#15766). Lockfile-only refresh via `pnpm update undici --lockfile-only`. It also moves a few in-range subdeps: lightningcss 1.33.0, postcss 8.5.26, nanoid 3.3.18, picomatch 4.0.7, @napi-rs/wasm-runtime 1.2.3.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Lockfile-only bump of the transitive
undicifrom 8.7.0 to 8.10.1 viapnpm update undici --lockfile-only. Nopackage.jsonchanges.Closes Dependabot alerts #4, #5, #6, #7, #8 (one high, GHSA-4cwx-7wf7-3272; four medium), all patched in undici 8.9.0.
Why Dependabot couldn't do this itself
The Dependabot security job (run 33710819595) failed with
security_update_not_possible, reporting 8.7.0 as the highest resolvable version with no conflicting dependencies. That is wrong: undici comes in only throughtestcontainers@12.0.4, which declaresundici ^8.5.0.dependabot-core's subdependency resolver runs
pnpm update undici@8.10.1 --lockfile-only --no-save -r. In recursive mode pnpm only matches update patterns against each project's direct dependencies, so a transitive-only package matches nothing and pnpm exits 0 without touching the lockfile (reproduced on pnpm 9.15.9, 10.0.0, 10.20.0, 10.33.0). Dependabot reads the unchanged lockfile and reports the old version as the ceiling. Upstream: dependabot/dependabot-core#15766. The--depth Infinity/pnpm audit --fixfallbacks exist upstream but are behind theenable_audit_fix_fallbackexperiment, which did not fire in this run.Exposure
undiciis dev-only (integration tests via testcontainers). It is not independenciesanddist/has no references to it, so published consumers are unaffected.Other lockfile movement
In-range refreshes picked up by the same command: lightningcss 1.32.0 → 1.33.0, postcss 8.5.23 → 8.5.26, nanoid 3.3.16 → 3.3.18, picomatch 4.0.5 → 4.0.7, @napi-rs/wasm-runtime 1.1.6 → 1.2.3.
Verification
pnpm install --frozen-lockfilesucceeds;node_modulesresolves undici 8.10.1pnpm typecheckpassespnpm test: 27 files, 656 tests passpnpm buildpasses