Repository navigation
fix(deps): override vulnerable transitive deps flagged by pnpm audit - #469
Conversation
![ferrfleet-interne[bot]](https://avatars.githubusercontent.com/in/5311663?s=60&v=4){kind=small}
There was a problem hiding this comment.
Overrides and lockfile match: each bumped package resolves to one version at or above its floor, and only the vite override changes the dependency graph beyond the lockfile (vite 8.3.5 → rolldown 1.2.15, postcss 8.5.31). Nothing blocking, one nit inline. When I reviewed, Test & Build and the audit job were still running.
Co-authored-by: ferrfleet-interne[bot] <342363332+ferrfleet-interne[bot]@users.noreply.github.com>
There was a problem hiding this comment.
Follow-up on 655f82c: the vite: '^8.3.3' override in pnpm-workspace.yaml no longer matches the lockfile, which still has '>=8.3.3'. A frozen install will reject it. Blocking finding inline: regenerate the lockfile. Test & Build was still running when I reviewed.
There was a problem hiding this comment.
Follow-up on fb4c3b8: the lockfile is regenerated and its overrides match pnpm-workspace.yaml, so the frozen-install mismatch is gone. Nothing blocking remains. I didn't check CI status for this commit.
## [10.14.1] - 2026-10-24 ### Bug Fixes - fix(deps): override vulnerable transitive deps flagged by pnpm audit (#469)
Bumps overrides for body-parser, fast-uri, hono, ip-address, source-map-js and vite to patched versions.
pnpm auditreports no known vulnerabilities. Unblocks #468.