ci(deps): ignore dependabot bumps to uuid override (EOVERRIDE conflict) - #235
Closed
asachs01 wants to merge 1 commit into
Closed
ci(deps): ignore dependabot bumps to uuid override (EOVERRIDE conflict)#235asachs01 wants to merge 1 commit into
asachs01 wants to merge 1 commit into
Conversation
uuid is both a direct dependency and a top-level override (added in #175 as a security-hardening pin, forcing any transitive uuid usage up to the patched v14 line). npm requires a top-level override for a package that's also a direct dependency to match exactly, so Dependabot's attempt to bump just the override independently throws EOVERRIDE and fails the whole production-minor-patch group's recreate job every time a new uuid patch is available -- reproduced 2026-08-13 and 2026-08-17 (job runs 31700587499, 32079486810; npm error: "Override for uuid@14.0.1 conflicts with direct dependency"). Same shape as the existing ip-address ignore rule: hold Dependabot off a package it structurally can't update alone, bump it manually (both dependencies and overrides, same value) instead.
Member
Author
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
uuidis both a direct dependency (^14.0.0) AND a top-leveloverridesentry (^14.0.0), added in chore(deps): resolve all dependabot alerts #175 as a security-hardening pin forcing any transitive uuid usage up to the patched v14 line (fixes buffer-bounds-check advisories in v3/v5/v6).production-minor-patchgroup recreate job tries to bump the override alone (independent of thedependenciesentry), it throwsEOVERRIDEand the whole group job fails.npm error Override for uuid@14.0.1 conflicts with direct dependency.ignorerule foruuid, same shape as the existingip-addressrule (hold Dependabot off a package it structurally can't update alone; bump bothdependencies.uuidandoverrides.uuidtogether, manually, when a new version is needed).production-minor-patchgroup PR (deps(deps): bump the production-minor-patch group across 1 directory with 6 updates #231) is unaffected by this — this only blocks the recreate/refresh job, not the existing PR.Why not just remove the override
The override isn't vestigial — it protects against a future transitive dependency pulling in an old, vulnerable uuid version. Removing it would silently reopen that class of security issue. Holding it in sync manually (this PR) preserves the protection while stopping the recurring CI failure.
Test plan
yaml.safe_loadon the changed file — validNeed help on this PR? Tag
@codesmith-botwith what you need. Autofix is enabled.