chore(deps): upgrade catalog + replace vite audit ignore with overrides#23
Merged
Conversation
…h overrides Bump the workspace catalog to the latest versions that clear the 7-day minimumReleaseAge gate. Hold typescript at 6.0.3 (typedoc peer caps at 6.0.x) and vitepress at 1.6.4 (2.x is alpha-only). Bump @types/node to 26.1.1 and @temporalio/* to the matching 1.20.2 set. prisma stays at 7.8.0 (7.9.0 is too fresh for the maturity gate). Replace the auditConfig.ignoreGhsas entry for GHSA-fx2h-pf6j-xcff with a targeted overrides block that pulls each vulnerable transitive to its first patched release: - brace-expansion@2 -> 2.1.2 (GHSA-3jxr-9vmj-r5cp, via testcontainers) - vite -> 6.4.3 (GHSA-fx2h-pf6j-xcff, via docs/vitepress) - @hono/node-server@1 -> 1.19.13 (GHSA-92pp-h63x-v22m, via prisma dev) pnpm audit is now fully clean (no ignores). Add search-insights to ignoreMissing (optional peer of VitePress's Algolia DocSearch).
There was a problem hiding this comment.
Pull request overview
This PR updates the monorepo’s pnpm workspace catalog to newer dependency versions (clearing the minimumReleaseAge gate) and replaces the previous pnpm audit ignore with explicit pnpm overrides to force patched transitive versions. The net effect is a refreshed dependency set with security advisories addressed via targeted resolution pinning rather than audit suppression.
Changes:
- Bumped multiple catalog-pinned tool/runtime dependencies (Temporal, Vitest, Turbo, Hono, etc.).
- Replaced the prior
auditConfig.ignoreGhsasexception with scopedoverridesfor vulnerable transitives (brace-expansion, vite, @hono/node-server@1). - Added
search-insightstopeerDependencyRules.ignoreMissingto avoid fresh-install peer noise from VitePress/DocSearch.
Reviewed changes
Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| pnpm-workspace.yaml | Updates catalog versions; removes audit ignore; adds targeted overrides and a peer-missing ignore entry. |
| pnpm-lock.yaml | Regenerates lockfile to reflect catalog bumps and the new overrides-resolved dependency graph. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Change the vite override selector to `vite@<6.4.3` so only the vulnerable pre-6.4.3 line is lifted to the patched 6.4.3, rather than forcing every Vite dependent in the workspace. Resolution and lockfile are unchanged today (only vitepress's vite 5.x is present); the scoped selector future-proofs it and makes the 'scoped selector' comment accurate.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Upgrades the workspace catalog to the latest versions that clear the 7-day
minimumReleaseAgegate, and replaces the standingauditConfig.ignoreGhsasvite exception with targetedoverridesthat pull each vulnerable transitive to its first patched release.pnpm auditis now fully clean with no ignores.Catalog bumps
Audit ignore → override
Removed
auditConfig.ignoreGhsasentirely; each advisory is now pinned to its patched version via scoped overrides:brace-expansion@2→ 2.1.2vite→ 6.4.3@hono/node-server@1→ 1.19.13Each override was verified as load-bearing by test-removal (audit re-surfaces the advisory when dropped). Our own workspace dep on
@hono/node-serverremains 2.x; the override only affects the 1.x line pulled by the prisma dev server.Held back (intentionally)
6.0.x; TS7 would break the docs build.Other
search-insightstopeerDependencyRules.ignoreMissing(optional analytics peer of VitePress's bundled Algolia DocSearch; surfaced on fresh install).allowBuildsintent (@swc/core,protobufjs,cpu-features,ssh2blocked).Verification
pnpm install— clean (passes maturity gate)pnpm audit --audit-level=high— exit 0 (fully clean, moderate too)pnpm typecheck— 13/13 taskspnpm build— 5/5 tasks incl.vitepress build(confirms the vite 6.4.3 override)Integration tests (Docker/testcontainers) were not run.