From 76522d89861f60cb2e3ce2df24cff831f43d24bd Mon Sep 17 00:00:00 2001 From: Matt Calthrop Date: Mon, 10 Aug 2026 08:59:24 +0100 Subject: [PATCH] chore(deps): fix pnpm audit findings (undici, postcss, nanoid) All seven findings were transitive-only, so each is resolved with a comparator-scoped override in pnpm-workspace.yaml: - undici: the existing `undici@>=6.0.0 <6.27.0` override pinned 8.8.0, which is itself vulnerable. Replaced with `undici@<8.9.0: ^8.9.0`, which covers both the original 6.x range and the vulnerable 8.0-8.8 line. Reached via @actions/core and @actions/github. - postcss: `postcss@<8.5.23: ^8.5.23`, reached via vite. - nanoid: `nanoid@<3.3.17: ^3.3.17`, reached via postcss. All bumps stay within the installed major, so no breaking changes. `pnpm audit --audit-level=low` is clean and the test suite passes. Refs https://github.com/advisories/GHSA-4cwx-7wf7-3272, https://github.com/advisories/GHSA-8xcm-r25x-g524, https://github.com/advisories/GHSA-m8rv-5g2x-5cg5, https://github.com/advisories/GHSA-jr45-8vmc-qm54, https://github.com/advisories/GHSA-v3r7-h72x-cjcm, https://github.com/advisories/GHSA-fxqj-rqcc-2cmp, https://github.com/advisories/GHSA-2v37-7h3g-55p8 Co-Authored-By: Claude Opus 5 (1M context) --- pnpm-lock.yaml | 32 +++++++++++++++++--------------- pnpm-workspace.yaml | 9 ++++++++- 2 files changed, 25 insertions(+), 16 deletions(-) diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index d1229ac..ea99db6 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -6,10 +6,12 @@ settings: overrides: rollup@>=4.0.0 <4.59.0: 4.62.2 - undici@>=6.0.0 <6.27.0: 8.8.0 + undici@<8.9.0: ^8.9.0 picomatch@<2.3.2: '>=2.3.2' yaml@>=2.0.0 <2.8.3: '>=2.8.3' '@babel/core@<7.29.1': 7.29.7 + postcss@<8.5.23: ^8.5.23 + nanoid@<3.3.17: ^3.3.17 importers: @@ -1059,8 +1061,8 @@ packages: ms@2.1.3: resolution: {integrity: sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==} - nanoid@3.3.16: - resolution: {integrity: sha512-bzlKTyNJ7+LdGIIwy8ijFpIqEQIvafahV7eYykJ8Cvh42EdJeODoJ6gUJXpQJvej1BddH8OqTXZNE/KfbWAu8Q==} + nanoid@3.3.18: + resolution: {integrity: sha512-DTg4MJbGMWkfi6VZFdNt2/caMbQy4Ou+Op/hJQvGEWcnVfoA1QA+xzRKAzw9jD6+GVOOeYr/mIcuDSdug6F6+w==} engines: {node: ^10 || ^12 || ^13.7 || ^14 || >=15.0.1} hasBin: true @@ -1091,8 +1093,8 @@ packages: resolution: {integrity: sha512-RvwwcruNjI1ncT5xRakeyS9Lf8lcItv34KD+aif+VH9kduAyfYBipGh12274xtenIPZ119/R9BdTBa8gAwSh0A==} engines: {node: '>=12'} - postcss@8.5.20: - resolution: {integrity: sha512-lW616l85ucIQL+FocMmL7pQFPqBmwejrCMg+iPxyImlrANNJG9NHq/RkyCZopDhd8C3LA03PHRJDjkbGu8vvug==} + postcss@8.5.26: + resolution: {integrity: sha512-u82N74LFzG8ca+dD8puPnplTXoGH4fTPpVGuIbt36G3qvNlkvfD0lEAZSxaly3KX8TS/L1A1gsCEmvKmBcVbkQ==} engines: {node: ^10 || ^12 || >=14} property-expr@2.0.6: @@ -1192,8 +1194,8 @@ packages: undici-types@7.18.2: resolution: {integrity: sha512-AsuCzffGHJybSaRrmr5eHr81mwJU3kjw6M+uprWvCXiNeN9SOGwQ3Jn8jb8m3Z6izVgknn1R0FTCEAP2QrLY/w==} - undici@8.8.0: - resolution: {integrity: sha512-ubshXMXwF3MQIMF1y/WxZdNBnjEKeSg2wF5mcGUtU55YTw34tnVVpKRlLf7ruDXZ5344KokPVX4RBx1wJm64Bw==} + undici@8.10.0: + resolution: {integrity: sha512-HvltHd7avK13QIw/oLe4qoOLyoVSoafqJ2jYOrtMRBkbYT31eiBQ8O0ehRKZiEZCMEyLFQNIADpgCWC5fALvYQ==} engines: {node: '>=22.19.0'} universal-user-agent@7.0.3: @@ -1331,17 +1333,17 @@ snapshots: '@octokit/plugin-rest-endpoint-methods': 17.0.0(@octokit/core@7.0.6) '@octokit/request': 10.0.8 '@octokit/request-error': 7.1.0 - undici: 8.8.0 + undici: 8.10.0 '@actions/http-client@3.0.2': dependencies: tunnel: 0.0.6 - undici: 8.8.0 + undici: 8.10.0 '@actions/http-client@4.0.0': dependencies: tunnel: 0.0.6 - undici: 8.8.0 + undici: 8.10.0 '@actions/io@3.0.2': {} @@ -2124,7 +2126,7 @@ snapshots: ms@2.1.3: {} - nanoid@3.3.16: {} + nanoid@3.3.18: {} node-releases@2.0.27: {} @@ -2185,9 +2187,9 @@ snapshots: picomatch@4.0.5: {} - postcss@8.5.20: + postcss@8.5.26: dependencies: - nanoid: 3.3.16 + nanoid: 3.3.18 picocolors: 1.1.1 source-map-js: 1.2.1 @@ -2293,7 +2295,7 @@ snapshots: undici-types@7.18.2: {} - undici@8.8.0: {} + undici@8.10.0: {} universal-user-agent@7.0.3: {} @@ -2307,7 +2309,7 @@ snapshots: dependencies: lightningcss: 1.32.0 picomatch: 4.0.5 - postcss: 8.5.20 + postcss: 8.5.26 rolldown: 1.1.5 tinyglobby: 0.2.17 optionalDependencies: diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index fa2734b..12505ac 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -1,6 +1,13 @@ overrides: "rollup@>=4.0.0 <4.59.0": "4.62.2" - "undici@>=6.0.0 <6.27.0": "8.8.0" + # 2026-08-10: undici <8.9.0 — GHSA-4cwx-7wf7-3272 (high), GHSA-8xcm-r25x-g524, + # GHSA-m8rv-5g2x-5cg5, GHSA-jr45-8vmc-qm54, GHSA-v3r7-h72x-cjcm (moderate). + # Supersedes the earlier <6.27.0 override, which pinned the now-vulnerable 8.8.0. + "undici@<8.9.0": "^8.9.0" "picomatch@<2.3.2": ">=2.3.2" "yaml@>=2.0.0 <2.8.3": ">=2.8.3" "@babel/core@<7.29.1": "7.29.7" + # 2026-08-10: postcss <=8.5.22 — GHSA-fxqj-rqcc-2cmp (moderate) + "postcss@<8.5.23": "^8.5.23" + # 2026-08-10: nanoid <3.3.17 — GHSA-2v37-7h3g-55p8 (high) + "nanoid@<3.3.17": "^3.3.17"