Repository navigation
VC-793: Override tinypool, source-map-js and sharp to patched versions, and re-resolve smol-toml - #931
Merged
hussainph merged 2 commits intoOct 19, 2026
Conversation
Scoped patch-level overrides for the parents that pin vulnerable copies exactly (oxfmt 0.64.0 -> tinypool 2.1.2, miniflare -> sharp 0.35.5), a range-scoped override for source-map-js <1.2.2, and an in-place re-resolution of smol-toml within astro's ^1.6.0. Regenerates THIRD-PARTY-NOTICES for the shipped source-map-js 1.2.2.
|
Important
This repository does not receive automatic reviews because it has fewer than 10 stars. ⚙️ Run configuration
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
The sharp override removes the last installed @img/sharp-libvips 1.3.3 (miniflare's dev-only copy), so check:licenses requires dropping that version from the reviewed record.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Eight Dependabot alerts opened with no ticket (VC-793). Four of them have a published patch, but the lockfile still resolves the vulnerable copy:
tinypool: 2.1.0exactly. vite-plus pinsoxfmt: =0.64.0(catalog pin, VC-211).^1.2.1, but the stale lock entry keeps 1.2.1. This copy ships in the .app (jsdom's runtime tree, seeelectron-builder.yml).sharp: 0.35.4exactly. Docs/website build only.^1.6.0. Static-site build only.Fix
pnpm-workspace.yamloverrides. Each one is patch-level, scoped to the vulnerable parent or range, and has a comment that says when to remove it:oxfmt@0.64.0>tinypool: 2.1.2source-map-js@<1.2.2: 1.2.2miniflare@5.20260926.1-alpha>sharp: 0.35.5smol-toml is re-resolved in place (
pnpm up -r --depth Infinity --lockfile-only smol-toml), giving 1.9.1. No override.Because the sharp override removes the last installed
@img/sharp-libvips@1.3.3, which was miniflare's dev-only copy,check:licensesrequires dropping 1.3.3 fromapps/desktop/scripts/dependency-license-policy.json. The note indocs/licensing/dependency-license-review.mdthat explained why it was kept is updated to match.apps/desktop/THIRD-PARTY-NOTICESis regenerated because the shipped source-map-js moves from 1.2.1 to 1.2.2. The lockfile diff contains only these four packages plus the sharp 0.35.4@img/*platform entries it drops.Left to the owner (deliberately untouched)
@streamdown/mermaid→ mermaid 11.x → katex. Only a cross-minor override (to 0.18.x) would fix it, and nobody has yet checked that this is safe for mermaid's math rendering. The advisory's precondition is an existing prototype pollution, so it is not reachable on its own.@astrojs/starlight→ expressive-code 0.44 → postcss-nested 6.2.0 → postcss-selector-parser. The fix is a major bump (7.1.6), so it waits on upstream. Docs build only.Decisions
Check + Build(staledocs/protocol/protocol.schema.jsonafter the zod bump),Test (packages)(session-rpc VC-315 JSON-wire refusal and protocol-schema tests) and the core/cloud smokes. Stacking would have inherited breakage outside this ticket. So this PR targets main and closes build(deps): bump the non-major-dependencies group across 1 directory with 4 updates #87 and volli CLI: read-only worktree observability (worktree status/diff) #80 itself, with a scoped patch-level override and an in-place re-resolution, instead of waiting for the group bump.<1.2.2, not to one parent. Several parents (tailwind, magicast, postcss) share the stale entry. A range selector covers them all, and newer copies stay untouched.git merge-treeis clean against origin/main and VC-834: background Change Set/rail/venue/diff reads run read-only git (stacked on #885 — merge after it) #909, VC-838: refuse one-click commit over unmerged index entries #919, VC-796: host-owned project.remove stops a project's live work before its delete #920, VC-807: confirm a minted harness launch before it moves the resume seed; skip announce for --version/--help/housekeeping and nested runs #921 and VC-831: release page-scoped sign-ins and file/dir/worktree watches when the renderer page reloads or crashes #922. build(deps): bump the non-major-dependencies group across 1 directory with 51 updates #928 conflicts only inpnpm-lock.yaml, as any lockfile change would. Dependabot rebases its own PR.Tests
Dependency-only change, so there is no Vitest file. The checks:
origin/main'spnpm-lock.yamlresolves tinypool 2.1.0, source-map-js 1.2.1, sharp 0.35.4 (miniflare) and smol-toml 1.8.0.pnpm why -r <pkg>after a frozen install shows one copy of each: tinypool 2.1.2, source-map-js 1.2.2, sharp 0.35.5, smol-toml 1.9.1. katex 0.16.47, postcss-selector-parser 6.1.4 and sprintf-js 1.1.3 are unchanged, as listed above.check-dependency-licenses,check:notice-inputs,check:lgpl-sourceandcheck:library-validation(apps/desktop): all pass.pnpm check:notices: self-test passed. The notice is current (587 packages) and electron-builder ships it.vp fmt --check pnpm-workspace.yaml: clean.