Skip to content

ci(deps): ignore dependabot bumps to uuid override (EOVERRIDE conflict) - #235

Closed
asachs01 wants to merge 1 commit into
mainfrom
fix/uuid-override-dependabot-ignore
Closed

ci(deps): ignore dependabot bumps to uuid override (EOVERRIDE conflict)#235
asachs01 wants to merge 1 commit into
mainfrom
fix/uuid-override-dependabot-ignore

Conversation

@asachs01

@asachs01 asachs01 commented Aug 20, 2026

Copy link
Copy Markdown
Member

Summary

  • uuid is both a direct dependency (^14.0.0) AND a top-level overrides entry (^14.0.0), added in chore(deps): resolve all dependabot alerts #175 as a security-hardening pin forcing any transitive uuid usage up to the patched v14 line (fixes buffer-bounds-check advisories in v3/v5/v6).
  • npm requires a top-level override for a package that's also a direct dependency to match exactly — so whenever Dependabot's production-minor-patch group recreate job tries to bump the override alone (independent of the dependencies entry), it throws EOVERRIDE and the whole group job fails.
  • Reproduced twice: job runs 31700587499 (2026-08-13) and 32079486810 (2026-08-17), both npm error Override for uuid@14.0.1 conflicts with direct dependency.
  • Fix: add a dependabot ignore rule for uuid, same shape as the existing ip-address rule (hold Dependabot off a package it structurally can't update alone; bump both dependencies.uuid and overrides.uuid together, manually, when a new version is needed).
  • Current production-minor-patch group PR (deps(deps): bump the production-minor-patch group across 1 directory with 6 updates #231) is unaffected by this — this only blocks the recreate/refresh job, not the existing PR.

Why not just remove the override

The override isn't vestigial — it protects against a future transitive dependency pulling in an old, vulnerable uuid version. Removing it would silently reopen that class of security issue. Holding it in sync manually (this PR) preserves the protection while stopping the recurring CI failure.

Test plan

  • yaml.safe_load on the changed file — valid
  • No other files touched; not a code change, config-only

View with [code]smith
Need help on this PR? Tag @codesmith-bot with what you need. Autofix is enabled.

uuid is both a direct dependency and a top-level override (added in #175
as a security-hardening pin, forcing any transitive uuid usage up to the
patched v14 line). npm requires a top-level override for a package that's
also a direct dependency to match exactly, so Dependabot's attempt to bump
just the override independently throws EOVERRIDE and fails the whole
production-minor-patch group's recreate job every time a new uuid patch
is available -- reproduced 2026-08-13 and 2026-08-17 (job runs
31700587499, 32079486810; npm error: "Override for uuid@14.0.1 conflicts
with direct dependency"). Same shape as the existing ip-address ignore
rule: hold Dependabot off a package it structurally can't update alone,
bump it manually (both dependencies and overrides, same value) instead.
@asachs01

Copy link
Copy Markdown
Member Author

Duplicate of #234 (same fix — same-day concurrent murph sessions independently found and fixed this EOVERRIDE issue ~1 minute apart, sharing the asachs01 identity). Closing this one, #234 has the full root-cause writeup.

@asachs01 asachs01 closed this Aug 20, 2026
@asachs01
asachs01 deleted the fix/uuid-override-dependabot-ignore branch August 20, 2026 12:35
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant