CyberCoveandClaude Sonnet 5.5
3f2be6fab0
- Lockfile-only/overrides bumps within the same major for vulnerable transitive build/test tooling (see pnpm-overrides.md) - electron 42.0.1 -> 42.11.12 (same major) for runtime advisories - .gitea/workflows/ci.yml: single job (build admin, tests, audit) Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
28 lines
7.7 KiB
Markdown
28 lines
7.7 KiB
Markdown
# package.json Overrides
|
|
|
|
This file documents the rationale for each dependency override defined in `package.json` under `pnpm.overrides`.
|
|
These overrides force specific versions of transitive dependencies, primarily for security and compatibility reasons.
|
|
|
|
| Package | Version | Pulled in by | What to check before removing |
|
|
|---------|---------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|
|
| `micromatch` | `^4.0.8` | `anymatch` (`^3.1.4`), `common-tags` (`3.1.10`), `sane` (`^3.1.4`), `find-yarn-workspace-root` / `findup-sync` (`^4.0.2`), `ember-template-lint` / `stylelint` (`^4.0.5`) all declare ranges that would resolve below `4.0.8`. | Once all dependents declare a range of `^4.0.8` or higher, the override can be removed. |
|
|
| `css-select>nth-check` | `^2.0.1` | `css-select` pins an older `nth-check`. | Check whether a newer `css-select` release drops the pinned `nth-check` `<2.0.0` requirement. Used by `ember-inline-svg`. |
|
|
| `ansi-html` | `^0.0.9` | Both `broccoli-middleware` and `broccoli` pin `"ansi-html": "^0.0.7"`. | Check whether newer `broccoli` / `ember-cli` releases update these to drop the sub-`0.0.9` pin. |
|
|
| `fireworm>async` | `^2.6.4` | `fireworm` pins an older `async`. | Check whether `fireworm` has been updated or replaced; if `testem` updates `fireworm`, this override can be removed. |
|
|
| `ember-cli-babel>@babel/runtime` | `7.27.6` | `ember-cli-babel` restricts the version it resolves. | Review when upgrading `ember-cli-babel`; once its `@babel/runtime` range is broad enough, remove and verify the build. |
|
|
| `ember-try-config>package-json` | `^10.0.1` | `ember-try-config` pins an older `package-json`. | Check whether a newer `ember-try-config` release widens its `package-json` range to include v10+. |
|
|
| `ember-loading>ember-concurrency` | `^4.0.0` | `ember-loading` declares `"ember-concurrency": "^2.0.3"`. | The override and the patch (`patches/ember-loading.patch`) are a pair — the override forces v4 to be installed, the patch updates the source to use v4. Both must be removed together if `ember-loading` ever ships a version that natively supports v4. |
|
|
| `tmp` | `^0.2.7` | 10+ packages pin old versions of `tmp` (`broccoli`, `can-symlink`, `ember-cli-typescript`, `external-editor`, `fixturify-project`, `sane`, `testem`, and others) | Check whether the main Ember toolchain packages (`broccoli`, `ember-cli`, `testem`) have been updated to allow `tmp ^0.2.x`. |
|
|
| `tar` | `^7.5.22` | Both `cacache` (`^6.1.11`) and `@electron/rebuild` (`^6.0.5`) pin old ranges. | Check whether a newer `ember-electron` brings in versions of `@electron/rebuild` and `cacache` that allow `tar ^7.x`. |
|
|
| `nomnom>underscore` | `^1.13.8` | `nomnom` pins `"underscore": "~1.6.0"`. All other consumers already declare ranges that include 1.13.8. | `nomnom@1.8.1` is the last published version and the package is abandoned. `jsonlint` is the actual consumer, currently pinned to `^1.6.3` which still depends on `nomnom`. |
|
|
| `ember-cli>markdown-it` | `^14.3.2` | `ember-cli` (`~5.12.0`) pins old ranges. | Once `ember-cli` has been updated to at least `6.3.0` then this override can be removed. |
|
|
|
|
## Security overrides added by the Threshold fork
|
|
|
|
The overrides keyed `<name>@>=X.0.0 <Y.0.0` were generated from `pnpm audit` (see the "About this fork" section in the README). Each one only raises a transitive dependency to the latest patched release **within the same major line** (patch/minor, lockfile-only effect). They are build/test tooling dependencies (`ember-cli`, `testem`, `stylelint`, `openapi-generator`, ...), not shipped code. Remove an entry once the dependents release versions that no longer need it; re-run `pnpm audit` after removing.
|
|
|
|
Packages covered: `@babel/core`, `@humanfs/node`, `@xmldom/xmldom`, `axios`, `baseline-browser-mapping`, `body-parser`, `brace-expansion`, `browserslist`, `colord`, `compression`, `diff`, `engine.io`, `follow-redirects`, `form-data`, `handlebars`, `immutable`, `ip-address`, `js-yaml`, `linkify-it`, `morgan`, `nanoid`, `postcss`, `postcss-selector-parser`, `proxy-addr`, `qs`, `seroval`, `shell-quote`, `socket.io-parser`, `source-map-js`, `websocket-driver`, `ws`.
|
|
|
|
Known unfixed without a major bump or an upstream fix: `svgo@1` (via `ember-inline-svg`), `@faker-js/faker@8` (api addon mirage data), `uuid@8` (testem), `diff@7` (sinon), `postcss-selector-parser@6` (stylelint), `basic-ftp@5` (openapi-generator), `extract-zip@2`, `http-cache-semantics@4`, `braces@3`, `sprintf-js@1` (no patched release).
|
|
|