Commit 4a5d5d0
Fix CVE-2025-69262: Upgrade transitive dependency @pnpm/npm-conf from 2.3.1 to 3.0.2
Summary:
Fix CVE-2025-69262: Upgrade transitive dependency pnpm/npm-conf from 2.3.1 to 3.0.2
## Summary
Upgrading the transitive dependency `pnpm/npm-conf` from 2.3.1 to 3.0.2 to fix CVE-2025-69262.
### Approach
Rather than forcing `pnpm/npm-conf` to 3.0.2 via a permanent resolution (which would cross a major version boundary for its consumer `registry-auth-token@5.1.0` that expects `^2.1.0`), we nudged `registry-auth-token` from 5.1.0 → 5.1.1. Version 5.1.1 natively depends on `pnpm/npm-conf@^3.0.2`, and is within the existing `^5.0.1` semver range from `package-json@8.1.1`.
### Dependency chain
```
docusaurus/core (direct)
→ update-notifier@6.0.2
→ latest-version@7.0.0
→ package-json@8.1.1 (requires registry-auth-token@^5.0.1)
→ registry-auth-token@5.1.1 (requires pnpm/npm-conf@^3.0.2)
→ pnpm/npm-conf@3.0.2
```
No permanent resolution was needed — the version sticks after removing the temporary resolution.
### yarn why output
```
pnpm/npm-conf@3.0.2
docusaurus/core > update-notifier > latest-version > package-json > registry-auth-token depends on it
registry-auth-token@5.1.1
docusaurus/core > update-notifier > latest-version > package-json depends on it
```
Reviewed By: huntie
Differential Revision: D96355741
fbshipit-source-id: 0b8873b01f472154f8d7240540f51ee3d758f7b41 parent c1e614a commit 4a5d5d0
1 file changed
Lines changed: 8 additions & 8 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
2146 | 2146 | | |
2147 | 2147 | | |
2148 | 2148 | | |
2149 | | - | |
2150 | | - | |
2151 | | - | |
2152 | | - | |
| 2149 | + | |
| 2150 | + | |
| 2151 | + | |
| 2152 | + | |
2153 | 2153 | | |
2154 | 2154 | | |
2155 | 2155 | | |
| |||
9511 | 9511 | | |
9512 | 9512 | | |
9513 | 9513 | | |
9514 | | - | |
9515 | | - | |
9516 | | - | |
| 9514 | + | |
| 9515 | + | |
| 9516 | + | |
9517 | 9517 | | |
9518 | | - | |
| 9518 | + | |
9519 | 9519 | | |
9520 | 9520 | | |
9521 | 9521 | | |
| |||
0 commit comments