chore: pin override versions exactly and reject semver ranges

Replace lodash and minimatch >= overrides with exact lockfile versions and fail supply-chain checks when overrides use ranges.

Author: redanthrax

SECURITY.md

@@ -13,7 +13,7 @@ This repository uses defenses against npm supply-chain worms such as **Mini Shai
 - **Blocklist scan** — `pnpm run audit:supply-chain` checks the lockfile against `security/compromised-packages.json` and validates pnpm config.
 - **Delayed updates** — `minimumReleaseAge` (24h, strict) reduces exposure to freshly published malicious versions.
 - **No exotic transitive deps** — `blockExoticSubdeps` blocks git/tarball transitive resolutions.
-- **Version overrides** — known CVEs are mitigated via `overrides` in `pnpm-workspace.yaml` (e.g. `lodash`, `uuid`, `minimatch`).
+- **Version overrides** — CVE mitigations use **exact pins** in `pnpm-workspace.yaml` (e.g. `lodash`, `uuid`, `minimatch`). Do not use `>=`/`^`/`~` ranges in overrides; bump versions deliberately with an updated lockfile and passing audit.
 
 ### Enforcing pnpm for contributors
 

pnpm-lock.yaml

@@ -2,10 +2,11 @@ packages:
   - '.'
 
 # Supply-chain hardening (see SECURITY.md). Configured here — pnpm 10+ ignores package.json "pnpm".
+# Pin exact versions only (no >=/^/~ ranges). Bump deliberately with lockfile + audit.
 overrides:
-  lodash: '>=4.18.0'
+  lodash: '4.18.1'
   uuid: '11.1.1'
-  minimatch: '>=9.0.7'
+  minimatch: '10.2.5'
   # npm dist-tag stable; block 2.23+ beta-channel releases
   n8n-workflow: '2.22.3'
 

pnpm-workspace.yaml

@@ -55,6 +55,36 @@ function verifyPnpmOnlyRepository() {
 	return errors;
 }
 
+function verifyExactOverridePins() {
+	const errors = [];
+
+	if (!existsSync(workspacePath)) {
+		return errors;
+	}
+
+	const workspace = readFileSync(workspacePath, 'utf8');
+	const overridesBlock = workspace.match(/^overrides:\n([\s\S]*?)(?:\n\S|\n*$)/m);
+	if (!overridesBlock) {
+		return errors;
+	}
+
+	for (const line of overridesBlock[1].split('\n')) {
+		const match = line.match(/^\s+([a-zA-Z0-9@/_-]+):\s*['"]?([^'"\n#]+)['"]?\s*$/);
+		if (!match) {
+			continue;
+		}
+		const [, name, value] = match;
+		const trimmed = value.trim();
+		if (/^[<>=~^*]/.test(trimmed) || trimmed.includes(' ')) {
+			errors.push(
+				`pnpm-workspace.yaml override ${name} must be an exact version pin, not a range (${trimmed})`,
+			);
+		}
+	}
+
+	return errors;
+}
+
 function verifyPnpmWorkspaceConfig() {
 	const errors = [];
 
@@ -70,6 +100,8 @@ function verifyPnpmWorkspaceConfig() {
 		}
 	}
 
+	errors.push(...verifyExactOverridePins());
+
 	if (existsSync(packageJsonPath)) {
 		const pkg = JSON.parse(readFileSync(packageJsonPath, 'utf8'));
 		if (pkg.pnpm) {
@@ -116,8 +148,8 @@ function verifyActivePnpmConfig() {
 			}
 		}
 
-		if (!config.includes('lodash=') || !config.includes('uuid=')) {
-			errors.push('pnpm overrides for lodash/uuid are not active — check pnpm-workspace.yaml');
+		if (!config.includes('lodash=') || !config.includes('uuid=') || !config.includes('minimatch=')) {
+			errors.push('pnpm overrides for lodash/uuid/minimatch are not active — check pnpm-workspace.yaml');
 		}
 	} catch (error) {
 		errors.push(`unable to read pnpm config: ${error.message}`);