fix(deps): pin esbuild ≥0.28.1 via pnpm-workspace overrides (GHSA-gv7w-rqvm-qjhr)#1910
Merged
Merged
Conversation
…w-rqvm-qjhr) pnpm v10 reads `overrides` from `pnpm-workspace.yaml`, NOT package.json's `pnpm` field (hence the recurring "pnpm field ignored" warning). The repo's minimatch /tar pins lived in package.json and were therefore silently dead, and nothing pinned esbuild at all — so `tsup`/`tsx`/`vite` resolved esbuild 0.27.7 and 0.28.0 (both < 0.28.1), tripping the high-severity advisory GHSA-gv7w-rqvm-qjhr that fails `pnpm audit --audit-level=high` (the "Validate Package Dependencies" CI job) on every dependency-touching PR. Fix: add a real `overrides:` block to pnpm-workspace.yaml — `esbuild: '>=0.28.1'` plus the migrated minimatch/tar pins — and drop the dead `pnpm.overrides` from package.json. esbuild now resolves to a single 0.28.1 across the tree; high advisories drop from 2 to 0. tsup build + vitest verified working on 0.28.1. Test-only tooling/lockfile change; empty changeset. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
github-actions
Bot
added
documentation
os-zhuang
added a commit
that referenced
this pull request
Jun 22, 2026
chore: release packages (#1910) objectui@cba0c6d586a2e8ad25d8316361f69dd5e5f34a7b
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The
Validate Package DependenciesCI job (pnpm audit --audit-level=high) fails on every dependency-touching PR with a high-severity esbuild advisory — GHSA-gv7w-rqvm-qjhr, affecting esbuild>=0.17.0 <0.28.1viatsup → esbuild,tsx → esbuild, andvite → esbuild.Root cause
pnpm v10 reads
overridesfrompnpm-workspace.yaml, not from package.json'spnpmfield — that's the recurring[WARN] The "pnpm" field in package.json is no longer read by pnpm … pnpm.overrides … ignoredmessage in every install.Consequences on
main:minimatch/tarpins live inpackage.json'spnpm.overrides→ silently ignored (dead security pins).tsup/tsx/viteresolve 0.27.7 and 0.28.0 (both< 0.28.1, vulnerable). The lockfile carried three esbuild versions.Fix
overrides:block topnpm-workspace.yaml:esbuild: '>=0.28.1'+ the migratedminimatch/tarpins.pnpm.overridesfrompackage.json.Result
pnpm audit --audit-level=high: 2 high → 0 (now2 low | 5 moderate); total advisories 11 → 7 (the migrated minimatch/tar pins also re-applied).@objectstack/formulatsup build succeeds and vitest 95/95 pass on esbuild 0.28.1.Test-only tooling/lockfile change — no published-package code changes; empty changeset.
🤖 Generated with Claude Code