deps: drop the pnpm override apparatus, scope the audit gate to prod deps - #71
Merged
Conversation
…deps Problem: package.json had accumulated 14 pnpm overrides and a direct minimatch devDependency, all added over time to silence pnpm audit findings in build-time tooling. Overrides rot: several pinned versions (brace-expansion 1.1.12/2.0.2, js-yaml ^4.1.1 frozen at 4.1.1 in the lockfile) had themselves become the vulnerable versions, so the apparatus was generating the very findings it existed to suppress. Meanwhile the audit CI job failed on advisories in eslint's dependency chain: code no visitor can ever reach, since it runs once per build on input the team wrote. Change: - package.json: remove the whole pnpm.overrides block and the direct minimatch devDependency (nothing imports it; it existed only to force a resolution). Update eslint within its range (9.39.5), which pulls patched js-yaml 4.3.1 and current minimatch/brace-expansion on its own, no overrides needed. - ci.yml: the audit gate becomes pnpm audit --prod --audit-level high. Production dependencies are the tree that builds the site and serves the one real server-side surface (/api/search); advisories there still fail CI. Dev-tool advisories no longer gate merges; Dependabot keeps bumping those packages regardless. After this change every remaining audit finding (prod and dev alike) is a fumadocs path fixed by the trio upgrade in PR #70. Merge #70 first; once this branch is rebased on it, the audit job is green with no suppression list at all. Verified: pnpm build green, CI-scoped eslint clean, tsc --noEmit clean.
✅ Deploy Preview for classy-clafoutis-ff4fd0 ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
✅ Deploy Preview for codex-documentation ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
package.jsoncarried 14pnpm.overridesentries plus a directminimatchdevDependency, all accreted to silence audit findings in build-time tooling. Overrides rot: several pinned versions had themselves become the vulnerable ones (thebrace-expansionpins,js-yamlfrozen at 4.1.1), so the apparatus was generating the findings it existed to suppress. And the audit job failed CI on advisories in eslint's chain — code no site visitor can reach.Change
pnpm.overridesblock and the directminimatchdevDependency (nothing imports it). A plainpnpm update eslint(→ 9.39.5) pulls patchedjs-yaml4.3.1 and currentminimatch/brace-expansionon its own.pnpm audit --prod --audit-level high. Prod dependencies are the tree that builds the site and serves the one genuine server-side surface (/api/search, reachable through both docs hosts). Advisories there still fail CI; dev-tool advisories no longer gate merges (Dependabot keeps bumping those packages regardless).Merge order
Merge #70 (fumadocs trio) first, then rebase/update this branch. Every audit finding remaining on this branch is a fumadocs path that #70 fixes; after both land, the audit job is green with no suppression list at all — prod and dev.
Verification
pnpm buildgreen; CI-scoped eslint clean;tsc --noEmitclean.pnpm audit --audit-level highlocally: only the fumadocs-path findings remain (fixed in deps: upgrade fumadocs trio to 16.15.1/15.3.1 and migrate theme variables #70); the eslint-chain findings are gone through the eslint update alone.