deps: override deepmerge-ts to 8.x to clear 3 HIGH audit findings - #143
Conversation
npm audit reports 3 HIGH on main: deepmerge-ts 7.1.5 (GHSA-ggr8-5vv4-36mx, stack exhaustion merging recursive object graphs, published 2026-08-17) and the two packages that carry it, @prisma/config and prisma. GitHub has raised no Dependabot alert for any of them in any state, so the only way to see this is to run npm audit against the lockfile. Upgrading Prisma cannot fix it. @prisma/config pins deepmerge-ts to exactly 7.1.5, and still does at @latest. The newest prisma is 8.0.0-rc.15, a release candidate, and the advisory covers prisma through 8.1.0-dev.4. There is no release to move to, so an override is the only route. Verified deepmerge-ts 8 does not break the one thing that consumes it: all four Prisma clients generate, and sabotaging deepmerge-ts on disk makes prisma generate fail with "Unknown error during config file loading", which proves the check can go red rather than passing vacuously. npm audit: 3 high -> 0. Lockfile delta is one package.
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Advanced Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (1)
Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review. 📝 WalkthroughWalkthroughThe package configuration adds a ChangesDependency configuration
Priority: ➖ Normal Estimated code review effort: 1 (Trivial) | ~2 minutes Change: Other Merge Risk: ⚪ Minimal · up to The override removes the vulnerable dependency version without an established compatibility or installation failure. 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
Full details: Description checkExplanation The description provides a detailed summary, rationale, change details, and verification results. It does not follow the required template because the Type of Change, Database Changes, Security Checklist, Deployment Notes, and Screenshots sections are missing or not completed.
✨ Finishing Touches🧪 Generate unit tests (beta)
Warning Some tools did not complete. Review the errors below. 🔧 ESLint
package.jsonESLint skipped: missing config or dependency (missing-dependency). The ESLint configuration references a package that is not available in the sandbox. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
1 participant
npm auditonmainreports 3 HIGH vulnerabilities. GitHub has raised no Dependabot alert for any of them, in any state, so the only way to see this is to runnpm auditagainst the lockfile directly.deepmerge-ts7.1.5prisma→@prisma/config→deepmerge-tsThe other two findings (
@prisma/config,prisma) are the same vulnerability reported against the packages that carry it.Why upgrading Prisma is not an option
@prisma/configpinsdeepmerge-tsto exactly7.1.5, not a range, and still does at@latest. The newest published prisma is8.0.0-rc.15, a release candidate, and the advisory covers prisma through8.1.0-dev.4. There is no stable release that resolves this, sooverridesis the only route.Change
One line in
package.json:"overrides": { + "deepmerge-ts": "^8.0.0",Lockfile delta is a single package:
deepmerge-ts7.1.5 → 8.0.2. Nothing else moves.Verification
deepmerge-tsis only reached at Prisma config-load time, so that is what I exercised:npm audit: 3 high →found 0 vulnerabilitiesnpm run db:generate: all 4 Prisma clients generate (app, users, blog, support)npx vitest run: 1078 passed (49 files)npx tsc --noEmit: cleannpm run build:✓ Compiled successfullyThe generate check is not vacuous. I replaced
deepmerge-ts's entry points on disk with a throwing stub and re-ranprisma generate; it failed withUnknown error during config file loading: Error: MUTATED deepmerge-ts. So@prisma/configgenuinely loads and uses this package during config loading, and the pass under 8.0.2 is real evidence rather than a check that could never fail.Note for future dependency work
This is the second time in this repo that the fix lives in
overridesrather than in a version bump, and the opposite of the last one: in #140 our own override was pinningsharpbelow the patched version, here an upstream exact pin holds us on a vulnerable one. Worth checkingoverridesfirst either way.Summary by CodeRabbit
deepmerge-tsversion.