fix: clear three high-severity advisories reachable from production - #266
Merged
Conversation
`pnpm audit --prod --audit-level high` fails on main, and has been failing
every dependabot pull request with it — including bumps of GitHub Actions,
which cannot touch a dependency at all. The base was red, not the branches.
All three arrive through a transitive pin that no direct bump reaches:
js-yaml 3.15.0 @istanbuljs/load-nyc-config, via jest's coverage chain
nanoid 3.3.16 postcss, whose own override had drifted behind the fix
deepmerge-ts 7.1.5 @prisma/config, and prisma 7 is the only version that
carries the fixed one
Scoped overrides rather than global ones: js-yaml also ships a 4.x line that
a bare `js-yaml` override would drag backwards, and deepmerge-ts 8 is only
wanted under Prisma.
Forcing a major under Prisma 6 is the part worth checking rather than
assuming, so the full suite ran against a live Postgres: 28/28 turbo tasks,
every database-backed test included. Five findings down to one low, which is
an esbuild development-server issue on Windows and below the gate.
This was referenced Aug 18, 2026
This was referenced Aug 18, 2026
AKogut
added a commit
that referenced
this pull request
Aug 18, 2026
Replaces #262 and #264. Both went `DIRTY` when #266 touched `package.json` and the lockfile, and dependabot did not pick them back up after being asked. Their checks kept running against the old base, so they kept failing on the advisory `main` no longer has — which would have looked like the bumps' fault indefinitely. Same versions, applied on the fixed base: | | from | to | | --- | --- | --- | | `eslint-plugin-simple-import-sort` | 12.1.1 | 14.0.0 | | `tsx` | 4.19.2 | 4.23.12 | | `eslint` | 10.8.0 | 10.8.1 | | `turbo` | 2.10.8 | 2.10.10 | `simple-import-sort` crossing **two majors** is the one that deserved checking rather than a shrug — it decides whether every import block in the repo still lints, and lint is a required check. It does, unchanged. ``` Tasks: 62 successful, 62 total ``` Build, typecheck, lint and the full test suite against a live Postgres.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
pnpm audit --prod --audit-level highcurrently fails onmain.That is worth stating plainly first, because it also explains something that looked like noise: the audit check is red on almost every open dependabot pull request, including #258, which bumps
pnpm/action-setup— a GitHub Action that cannot affect a dependency tree at all. The branches were not broken. The base was.The three
js-yaml@istanbuljs/load-nyc-config, via jest's coverage chainnanoidpostcss— whose existing override had drifted behind its own advisorydeepmerge-ts@prisma/config, and Prisma 7 is the only release carrying the fixed oneNone is reachable by a direct bump, which is what the comment in
audit.ymlalready anticipated: "advisories reachable through a transitive pin that only a resolution override can clear."Why the overrides are scoped
js-yamlalso ships a 4.x line. A bare"js-yaml": "^3.15.1"override would drag every 4.x consumer backwards to fix a 3.x problem — so it is pinned under the one parent that pulls the vulnerable copy. Same reasoning fordeepmerge-ts: version 8 is wanted under Prisma, not everywhere.postcsswas already overridden; that entry had simply fallen behind. Raising it also clearednanoid, since that is where it came from.The part I did not assume
Forcing a major of
deepmerge-tsunderneath Prisma 6 is exactly the kind of change that type-checks and then falls over at runtime, so it was run rather than reasoned about: the full suite against a live Postgres, every database-backed test included.Plus build, typecheck and lint: 47/47.
Result
Five findings become one:
The remainder is an esbuild development-server file-read on Windows — below the
--audit-level highgate the workflow enforces, and reported by the second, non-failing audit step that already exists for exactly this.What this unblocks
#261 (zod 4) and #263 (prisma 7) fail on their own merits and still need work. The rest — #258, #262, #264, #265 — were failing only on this, and should go green on a rebase.