Repository navigation
chore: pin handlebars and undici to patched releases - #428
Conversation
Override transitive handlebars to >=4.7.10 and keep undici on the patched 7.x and 8.x lines so the lockfile no longer resolves 4.7.9, 7.29.0, or 8.10.0. Co-authored-by: Jared Wray <me@jaredwray.com>
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #428 +/- ##
=========================================
Coverage 100.00% 100.00%
=========================================
Files 9 9
Lines 406 406
Branches 94 94
=========================================
Hits 406 406 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 6d22b41563
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| # Transitive security floors. fumanchu still declares handlebars ^4.7.9. | ||
| # undici 7 and 8 are separate lines (@cacheable/net, AI SDK, miniflare, docula). | ||
| overrides: | ||
| handlebars: ">=4.7.10" |
There was a problem hiding this comment.
When Ecto is packed and published, this override does not protect downstream applications: pnpm documents pnpm-workspace.yaml as a per-project configuration file, while the release workflow packs the library and the package.json files allowlist excludes both this file and the lockfile. The published manifest therefore still declares only @jaredwray/fumanchu@^4.7.3, so an existing consumer lockfile can retain vulnerable handlebars@4.7.9 after upgrading Ecto. Carry the patched floor through the published dependency chain, such as via a fixed fumanchu release or an appropriate manifest dependency.
Useful? React with 👍 / 👎.
| # Transitive security floors. fumanchu still declares handlebars ^4.7.9. | ||
| # undici 7 and 8 are separate lines (@cacheable/net, AI SDK, miniflare, docula). | ||
| overrides: | ||
| handlebars: ">=4.7.10" |
There was a problem hiding this comment.
Once Handlebars 5 is old enough to satisfy minimumReleaseAge, >=4.7.10 permits pnpm to select it even though fumanchu declares compatibility only with ^4.7.9; pnpm documents that a regular override rewrites every matching edge unconditionally. A fresh install could therefore force an incompatible major into the runtime engine. Add a <5 cap as was done for both Undici lines, or use a compatibility-preserving convergence override.
Useful? React with 👍 / 👎.
2 participants
Please check if the PR fulfills these requirements
What kind of change does this PR introduce? (Bug fix, feature, docs update, ...)
Security dependency override. No application code changes. Existing tests still pass at 100% coverage.
Summary
Transitive
handlebars@4.7.9andundici@7.29.0/undici@8.10.0are below the patched floors.@jaredwray/fumanchu@4.7.3(and 4.7.4) still declareshandlebars@^4.7.9, so a fumanchu bump does not clear it. pnpm overrides inpnpm-workspace.yamlforce:handlebars>=4.7.10→ 4.7.10 (GHSA-8r5x-fm3f-whwj / CVE-2026-106446, GHSA-p8wg-vrv2-v86f)undici@7>=7.29.1 <8→ 7.30.0undici@8>=8.10.2 <9→ 8.11.2The major caps keep the 7.x consumers (
@ai-sdk/provider-utils,@cacheable/net,miniflare) on 7.x. An open>=7.29.1range resolved those edges to still-vulnerableundici@8.10.0.Resolved versions are older than the 7-day
minimumReleaseAgecooldown, so nominimumReleaseAgeExcludewas added.Lockfile refresh also deduped
hashery'shookified@3.0.2snapshot ontohookified@3.0.3, which was already in the tree.Test plan
pnpm install --frozen-lockfilepnpm why handlebars→ only4.7.10pnpm why undici→ only7.30.0and8.11.2pnpm buildpnpm test— 239 tests, 100% coverage