Remediate HIGH/CRITICAL vulnerabilities#800
Merged
Merged
Conversation
- Bump vite to patched patch releases in both packages: - packages/react-components: 7.3.2 -> 7.3.6 (fixes CVE-2026-53571, 7.x line) - packages/docs: 6.4.2 -> 6.4.3 (fixes CVE-2026-53571, 6.x line, and CVE-2026-53632) - Bump @babel/core in packages/docs: 7.26.9 -> 7.29.6 (fixes CVE-2026-49356) - Add pnpm-workspace.yaml overrides for transitive deps: - ws >= 8.21.0 (fixes CVE-2026-48779) - esbuild >= 0.28.1 (fixes GHSA-g7r4-m6w7-qqqr) - @babel/core >= 7.29.6 (fixes CVE-2026-49356 wherever pulled in transitively) pnpm audit --audit-level high: vite/ws/esbuild/@babel-core no longer flagged (remaining 2 high findings are form-data/sigstore via lerna, unrelated to #798) Closes #798
malessani
changed the title
malessani
changed the title
malessani
previously approved these changes
Jul 20, 2026
The pkg-pr-new workflow (and Netlify, via corepack) ran pnpm 9, which reads `overrides` from package.json's `pnpm.overrides` field. Issue #775 migrated all overrides to pnpm-workspace.yaml (a pnpm 10+ feature), so under pnpm 9 the resolved overrides are empty while the lockfile still lists them, producing ERR_PNPM_LOCKFILE_CONFIG_MISMATCH on `pnpm install --frozen-lockfile`. This was latent: #775 was pushed straight to main, and pkg-pr-new skips main, so no branch build exercised it until now. - pkg-pr-new: pnpm/action-setup v3/9.x -> v4/10 (matches publish.yaml) - root package.json: pin packageManager pnpm@10.34.5 so Netlify's corepack build uses a version that reads pnpm-workspace.yaml overrides Regenerating the lockfile is NOT a fix: under pnpm 9 it silently strips the entire overrides block, undoing the security remediations.
action-setup@v4 errors ("Multiple versions of pnpm specified") when both a
`version:` input and a package.json `packageManager` field are present. Drop
the explicit `version: 10` from both workflows so they resolve pnpm from the
pinned packageManager field, keeping a single source of truth.
commit: |
malessani
approved these changes
Jul 20, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
viteto patched patch releases:7.3.2 -> 7.3.6(react-components) and6.4.2 -> 6.4.3(docs) — fixes CVE-2026-53571 (both affected ranges) and CVE-2026-53632@babel/corein docs:7.26.9 -> 7.29.6— fixes CVE-2026-49356pnpm-workspace.yamloverrides for transitive deps:ws>= 8.21.0 — fixes CVE-2026-48779esbuild>= 0.28.1 — fixes GHSA-g7r4-m6w7-qqqr@babel/core>= 7.29.6 — fixes CVE-2026-49356 wherever pulled in transitivelyTest plan
pnpm installresolves all four packages to patched versions (verified in lockfile)pnpm audit --audit-level highno longer flags vite/ws/esbuild/@babel-corevitest runagainst react-components with test-org.envloaded: 52 passed, 21 skipped, 2 pre-existing/unrelated failures (Vitest 4 API-signature mismatch in one spec, flaky network timeout)tsc -bproduction build succeedsCloses #798