Repository navigation
Fix failing Dependabot security updates in lang/typescript - #679
Closed
DominiqueFlaaa wants to merge 1 commit into
Closed
DominiqueFlaaa wants to merge 1 commit into
DominiqueFlaaa wants to merge 1 commit into
Conversation
Dependabot could not resolve the security updates for tinypool and source-map-js: vitest 3 pins tinypool 1.x, and the fixed versions are 2.1.2 and 1.2.2. Move vitest to ^4.1.12, which no longer depends on tinypool and also fixes @vitest/mocker (GHSA-qxg6-89mg-rqv8). Raise the vite override to ^6.4.4 (GHSA-9jrq-w75r-8gcw and related launch-editor advisories) and add a source-map-js ^1.2.2 override (GHSA-68fv-2mgg-jv7q). The vite peer that pnpm installs for vitest kept the old lockfile entry, so the lockfile entries for vite were resolved again.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What are you trying to accomplish?
Two Dependabot security update jobs fail on
main:security_update_not_possible, latest resolvable 1.1.1, lowest non-vulnerable 2.1.2 (GHSA-85c8-ppgw-ccpr, GHSA-5gmw-xhrv-c9v3).vitest@^3pinstinypool@1.x, so Dependabot cannot reach the fixed version on its own.What approach did you choose and why?
In
lang/typescriptonly (dev dependencies; nothing in the published package changes):vitest^3.0.0→^4.1.12. Vitest 4 no longer depends ontinypool, and 4.1.12 fixes@vitest/mocker(GHSA-qxg6-89mg-rqv8). The existingvitest.config.tsworks unchanged.viteoverride^6.4.2→^6.4.4(resolves to 6.4.6), for GHSA-9jrq-w75r-8gcw and the launch-editor advisories.source-map-jsoverride^1.2.2, following the existing overrides.pnpm 9.1.3 does not apply overrides to the
vitepeer it auto-installs for vitest; it kept the 6.4.3 lockfile entry. I removed thevite@6.4.3entries and let pnpm resolve them again. The lockfile resolves from registry.npmjs.org.What should reviewers focus on?
The vitest major bump. The test suite passes without config changes.
The impact of these changes
Dev tooling only. No change to the Ruby gem or the published npm package.
Testing
With pnpm 9.1.3 in
lang/typescript, the same steps as CI Typescript:pnpm install --frozen-lockfile,pnpm typecheck,pnpm lint,pnpm test(7 files, 162 tests passed),pnpm build.Checklist