Skip to content

Commit 4a5d5d0

Browse files
balajacatherinmeta-codesync[bot]
authored andcommitted
Fix CVE-2025-69262: Upgrade transitive dependency @pnpm/npm-conf from 2.3.1 to 3.0.2
Summary: Fix CVE-2025-69262: Upgrade transitive dependency pnpm/npm-conf from 2.3.1 to 3.0.2 ## Summary Upgrading the transitive dependency `pnpm/npm-conf` from 2.3.1 to 3.0.2 to fix CVE-2025-69262. ### Approach Rather than forcing `pnpm/npm-conf` to 3.0.2 via a permanent resolution (which would cross a major version boundary for its consumer `registry-auth-token@5.1.0` that expects `^2.1.0`), we nudged `registry-auth-token` from 5.1.0 → 5.1.1. Version 5.1.1 natively depends on `pnpm/npm-conf@^3.0.2`, and is within the existing `^5.0.1` semver range from `package-json@8.1.1`. ### Dependency chain ``` docusaurus/core (direct) → update-notifier@6.0.2 → latest-version@7.0.0 → package-json@8.1.1 (requires registry-auth-token@^5.0.1) → registry-auth-token@5.1.1 (requires pnpm/npm-conf@^3.0.2) → pnpm/npm-conf@3.0.2 ``` No permanent resolution was needed — the version sticks after removing the temporary resolution. ### yarn why output ``` pnpm/npm-conf@3.0.2 docusaurus/core > update-notifier > latest-version > package-json > registry-auth-token depends on it registry-auth-token@5.1.1 docusaurus/core > update-notifier > latest-version > package-json depends on it ``` Reviewed By: huntie Differential Revision: D96355741 fbshipit-source-id: 0b8873b01f472154f8d7240540f51ee3d758f7b4
1 parent c1e614a commit 4a5d5d0

1 file changed

Lines changed: 8 additions & 8 deletions

File tree

website/yarn.lock

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -2146,10 +2146,10 @@
21462146
dependencies:
21472147
graceful-fs "4.2.10"
21482148

2149-
"@pnpm/npm-conf@^2.1.0":
2150-
version "2.3.1"
2151-
resolved "https://registry.yarnpkg.com/@pnpm/npm-conf/-/npm-conf-2.3.1.tgz#bb375a571a0bd63ab0a23bece33033c683e9b6b0"
2152-
integrity sha512-c83qWb22rNRuB0UaVCI0uRPNRr8Z0FWnEIvT47jiHAmOIUHbBOg5XvV7pM5x+rKn9HRpjxquDbXYSXr3fAKFcw==
2149+
"@pnpm/npm-conf@^3.0.2":
2150+
version "3.0.2"
2151+
resolved "https://registry.yarnpkg.com/@pnpm/npm-conf/-/npm-conf-3.0.2.tgz#857622421aa9bbf254e557b8a022c216a7928f47"
2152+
integrity sha512-h104Kh26rR8tm+a3Qkc5S4VLYint3FE48as7+/5oCEcKR2idC/pF1G6AhIXKI+eHPJa/3J9i5z0Al47IeGHPkA==
21532153
dependencies:
21542154
"@pnpm/config.env-replace" "^1.1.0"
21552155
"@pnpm/network.ca-file" "^1.0.1"
@@ -9511,11 +9511,11 @@ regexpu-core@^6.2.0:
95119511
unicode-match-property-value-ecmascript "^2.1.0"
95129512

95139513
registry-auth-token@^5.0.1:
9514-
version "5.1.0"
9515-
resolved "https://registry.yarnpkg.com/registry-auth-token/-/registry-auth-token-5.1.0.tgz#3c659047ecd4caebd25bc1570a3aa979ae490eca"
9516-
integrity sha512-GdekYuwLXLxMuFTwAPg5UKGLW/UXzQrZvH/Zj791BQif5T05T0RsaLfHc9q3ZOKi7n+BoprPD9mJ0O0k4xzUlw==
9514+
version "5.1.1"
9515+
resolved "https://registry.yarnpkg.com/registry-auth-token/-/registry-auth-token-5.1.1.tgz#f1ff69c8e492e7edee07110b4752dd0a8aa82853"
9516+
integrity sha512-P7B4+jq8DeD2nMsAcdfaqHbssgHtZ7Z5+++a5ask90fvmJ8p5je4mOa+wzu+DB4vQ5tdJV/xywY+UnVFeQLV5Q==
95179517
dependencies:
9518-
"@pnpm/npm-conf" "^2.1.0"
9518+
"@pnpm/npm-conf" "^3.0.2"
95199519

95209520
registry-url@^6.0.0:
95219521
version "6.0.1"

0 commit comments

Comments
 (0)