chore(deps): override deepmerge-ts to clear the stack-exhaustion advisory - #58
Merged
Conversation
…sory
`npm audit` reports two high findings here — deepmerge-ts, and
flowbite-react as its only path to us:
flowbite-react@0.12.17 -> deepmerge-ts@7.1.5 (vulnerable: <8.0.0)
npm's own suggested fix is a semver-major *downgrade* to
flowbite-react@0.10.2, which is worse than the problem. And there is
nothing to wait for upstream: 0.12.17 is the latest release and it pins
deepmerge-ts to the exact version 7.1.5, not a range.
So: override. This is not speculative — robosystems-app already carries
`"deepmerge-ts": "^8.0.1"` and runs the same flowbite-react 0.12.17
against deepmerge-ts 8.x in production. This repo simply never got the
entry; it already had an overrides block for sharp and next/postcss.
Resolves to deepmerge-ts 8.0.2, flowbite-react unchanged at 0.12.17.
npm audit goes from 2 high to 0.
Scope worth being precise about: npm honours `overrides` only at an
install root, so this fixes this repo's own CI and dev installs, not
anything consuming @robosystems/core as a library. Consumers carry their
own copy — the three apps already do. Same shape as the js-yaml override
in the TypeScript client.
package-lock.json is gitignored here, so package.json is the whole of
the change and CI resolves it fresh.
Gate green: typecheck, eslint, 492 tests (16 skipped) across 43 files,
build.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Clears the two high-severity
npm auditfindings in this repo with a one-lineoverridesentry.npm auditgoes from 2 high → 0.Changes
package.json— added"deepmerge-ts": "^8.0.1"to the existingoverridesblock.Both findings trace to a single path:
npm's own suggested fix is a semver-major downgrade to
flowbite-react@0.10.2, which is worse than the problem. And there's nothing to wait for upstream: 0.12.17 is the latest release, and it pinsdeepmerge-tsto the exact version7.1.5, not a range — so no amount of updating moves it.Hence the override. This isn't speculative:
robosystems-appalready carries"deepmerge-ts": "^8.0.1"and runs the sameflowbite-react@0.12.17against deepmerge-ts 8.x in production. This repo simply never got the entry, though it already had anoverridesblock forsharpandnext/postcss.Resolves to
deepmerge-ts@8.0.2;flowbite-reactstays on 0.12.17.package-lock.jsonis gitignored here, sopackage.jsonis the whole of the change and CI resolves it fresh.Consumer Impact
INTERNAL. No export, prop contract, rendered structure, or peer range changes. Nothing in the emitted surface moves, and no packaging characteristic is touched — directives, ESM-only, publish-from-dist layout,
sideEffects, and peers-staying-peers are all unaffected.One point worth being precise about rather than overstating: npm honours
overridesonly at an install root, so this fixes this repo's CI and dev installs, not anything consuming@robosystems/coreas a library. The three apps each need their own entry — and all three already have one, which is exactly why they report 0 vulnerabilities today while this repo reported 2. So no app has to do anything on their next bump.Same shape as the
js-yamloverride in the TypeScript client.Testing
Full gate, all green:
npm run typecheck— clean (exit 0)npm run lint— clean (exit 0; 12 pre-existing warnings, unchanged)npm test— 43 files, 492 passed, 16 skippednpm run build— clean (exit 0)npm audit— 2 high → 0Verified
flowbite-reactstill resolves to 0.12.17 with deepmerge-ts 8.0.2 under it, so the override doesn't silently drag the component library backwards. The pre-commit hook ran format:check, lint, typecheck and the suite again independently.