chore(deps): upgrade dependencies and convert audit ignores to overrides#331
Merged
Conversation
Bump catalog deps to latest within the 7-day maturity gate, refresh the @temporalio/* line to 1.20.2, and replace the auditConfig ignore block with targeted overrides pulling each vulnerable transitive to its patched version. Held back: - typescript 6.0.3 (typedoc peer caps at 6.0.x) - vitepress 1.6.4 in docs (2.x is alpha-only) - oxlint/oxfmt/knip/changesets/tsdown stepped down to newest release >7 days old Removed the fast-uri, protobufjs, and testcontainers>undici overrides — after the upgrades their parents pull patched versions natively and audit stays clean.
Contributor
There was a problem hiding this comment.
Pull request overview
Updates the workspace dependency catalog and lockfile to newer versions (including the @temporalio/* line) while hardening pnpm audit results by replacing GHSA ignores with explicit pnpm.overrides pins for patched transitive dependencies.
Changes:
- Bumped multiple catalog-managed dependencies (notably
@temporalio/*,@types/node,vitest,turbo, etc.) and regeneratedpnpm-lock.yaml. - Replaced
auditConfig.ignoreGhsaswith targetedoverrides(brace-expansion, js-yaml, vite/esbuild) to drive advisories to patched versions. - Restructured/normalized
pnpm-workspace.yamllayout (movedpeerDependencyRules/overridesbelowcatalog, updated comments).
Reviewed changes
Copilot reviewed 1 out of 2 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| pnpm-workspace.yaml | Catalog bumps and new overrides replacing GHSA ignores; minor file organization/comment updates. |
| pnpm-lock.yaml | Regenerated lockfile reflecting upgraded catalog versions and new override resolutions. |
Files not reviewed (1)
- pnpm-lock.yaml: Generated file
Change the vite override selector to `vite@<6.4.3` so only the vulnerable pre-6.4.3 line is lifted, and fix the js-yaml override comment (the selectors are version-scoped by major, not parent-path scoped).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Dependency upgrade + audit hardening
Upgrades catalog dependencies to latest (majors OK) under the 7-day
minimumReleaseAgegate, refreshes the@temporalio/*line, and replaces theauditConfig.ignoreGhsasblock with targetedoverrides.Catalog bumps
@btravstack/theme@commitlint/cli@temporalio/*(client, common, testing, worker, workflow)@types/node@vitest/coverage-v8kniplefthookturbovitestHeld back
typescript6.0.x; TS 7 breaks typedocvitepress(docs)oxlintoxfmtknip@changesets/clitsdownignoreGhsas→overridesThe
auditConfig.ignoreGhsasblock (which ignored the esbuild and viteadvisories) is removed. Each advisory is now driven to a patched pin:
server.fs.denybypass, via docs>vitepress)vite: 6.4.3vite@6.4.3drags esbuild to patched 0.25.12brace-expansion@2: 2.1.2,brace-expansion@5: 5.0.7js-yaml@3: 3.15.0,js-yaml@4: 4.3.0Removed overrides (re-evaluated, no longer doing work)
fast-uri: ">=3.1.2"protobufjs: ">=7.6.1">=7.6.5globally broke temporalio's protobufjs Root identity check, so the pin is dropped entirelytestcontainers>undici: ">=8.5.0"Also tidied
pnpm-workspace.yaml: normalized blank-line spacing betweentop-level keys, alphabetized
catalog, and co-located theminimumReleaseAgeblock.
Verification
pnpm install— clean, lockfile passes supply-chain policypnpm audit— No known vulnerabilities found (clean at moderate and high)pnpm typecheck— 12/12 tasks passpnpm build— 10/10 tasks pass (includesvitepress build)Integration tests were not run, per scope.