From bd2517cdc8b7235651b20c46cebf9031746d7b1c Mon Sep 17 00:00:00 2001 From: Dawson Toth Date: Sun, 11 Oct 2026 02:39:44 -0400 Subject: [PATCH] fix(deps): override every undici range below 8.10.2, jsdom's own floor jsdom 30.1.1 declares undici ^8.10.2, but the `undici@>=7.0.0` override replaced each dependent's declared range with its own `^8.9.0`, so pnpm kept reusing the 8.10.0 already in the lockfile and jsdom ran below its floor. Nothing warned, and Renovate cannot catch it: its dashboard lists the overrides with no pending update because `^8.9.0` is still satisfied, and lockFileMaintenance is off. 8.10.2 is also the release that patches GHSA-vp8m-p9jh-q5pm (undici >=8.10.0 <8.10.2, high) and ten sibling advisories, so 8.10.0 was the vulnerable line, not just an old one. Dependabot has not raised an alert for it yet. Replace the `>=7.0.0` and `<6.27.0` selector pair with one `undici@<8.10.2: ^8.10.2`. pnpm applies a `pkg@range` override to every declared range that overlaps the selector, so the pair left a gap: a dependent declaring ^6.28.0 matched neither and resolved 6.29.0 (checked against pnpm 12.8.2 with fixture packages). The single selector lifts every range that can resolve below the floor and leaves ranges already above it, jsdom's included, on their own declaration instead of clamping them to 8.x. The lockfile change is undici alone: the single copy moves from 8.10.0 to 8.11.2 for jsdom, @actions/http-client (^6.23.0), @ai-sdk/provider-utils (^7.29.0) and @semantic-release/github (^7.0.0). Closes #1847 Co-Authored-By: Claude Opus 5.5 --- pnpm-lock.yaml | 17 ++++++++--------- pnpm-workspace.yaml | 10 ++++------ 2 files changed, 12 insertions(+), 15 deletions(-) diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 202a5239f..5ed951415 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -164,8 +164,7 @@ settings: overrides: handlebars: ^4.7.9 - undici@>=7.0.0: ^8.9.0 - undici@<6.27.0: ^8.9.0 + undici@<8.10.2: ^8.10.2 lodash-es: ^4.18.1 form-data: ^4.0.6 dompurify: ^3.4.11 @@ -6962,8 +6961,8 @@ packages: undici-types@7.24.6: resolution: {integrity: sha512-WRNW+sJgj5OBN4/0JpHFqtqzhpbnV0GuB+OozA9gCL7a993SmU+1JBZCzLNxYsbMfIeDL+lTsphD5jN5N+n0zg==} - undici@8.10.0: - resolution: {integrity: sha512-HvltHd7avK13QIw/oLe4qoOLyoVSoafqJ2jYOrtMRBkbYT31eiBQ8O0ehRKZiEZCMEyLFQNIADpgCWC5fALvYQ==} + undici@8.11.2: + resolution: {integrity: sha512-u4UB2/IrKdU6lFxumHmmo1a3fCQO5tzQllRorfoRS63txhrB7xTpSn1PftwC4qEHkOaqP95fCWW4lJzwErwzhQ==} engines: {node: '>=22.19.0'} unicode-emoji-modifier-base@1.0.0: @@ -7355,7 +7354,7 @@ snapshots: '@actions/http-client@4.0.1': dependencies: tunnel: 0.0.6 - undici: 8.10.0 + undici: 8.11.2 '@actions/io@3.0.2': {} @@ -7388,7 +7387,7 @@ snapshots: '@standard-schema/spec': 1.1.0 '@workflow/serde': 4.1.0 eventsource-parser: 3.1.1 - undici: 8.10.0 + undici: 8.11.2 zod: 4.6.5 '@ai-sdk/provider@4.0.21': @@ -9317,7 +9316,7 @@ snapshots: p-filter: 4.1.0 semantic-release: 25.0.9(supports-color@8.1.1)(typescript@7.0.2) tinyglobby: 0.2.17 - undici: 8.10.0 + undici: 8.11.2 url-join: 5.0.0 transitivePeerDependencies: - kerberos @@ -12048,7 +12047,7 @@ snapshots: parse5: 8.0.1 saxes: 6.0.0 tough-cookie: 6.0.2 - undici: 8.10.0 + undici: 8.11.2 w3c-xmlserializer: 6.0.0 webidl-conversions: 8.0.1 whatwg-mimetype: 5.0.0 @@ -14563,7 +14562,7 @@ snapshots: undici-types@7.24.6: {} - undici@8.10.0: {} + undici@8.11.2: {} unicode-emoji-modifier-base@1.0.0: {} diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index 987f90e67..4088d3576 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -30,12 +30,10 @@ overrides: # Force patched versions of stale transitive deps flagged by Dependabot. # All are transitive-only; bumping the minimum clears the advisories. handlebars: '^4.7.9' - # 8.9.0, not 8.0.0: CVE-2026-13697 (GHSA-4cwx-7wf7-3272), a shared-cache - # disclosure in undici's cache interceptor, is only patched from 8.9.0 on. - 'undici@>=7.0.0': '^8.9.0' - # undici 6.x still comes in via semantic-release's @actions/http-client, which - # declares ^6.23.0 as of 4.0.1; drop this and it resolves back down to 6.28.0. - 'undici@<6.27.0': '^8.9.0' + # 8.10.2 is jsdom 30.1's own floor and patches GHSA-vp8m-p9jh-q5pm and ten sibling + # advisories. Keep the selector `