chore(deps): pin vulnerable transitives and refresh the lockfile - #263
Conversation
|
🚀 Subgraph Studio preview deployed
curl -H 'Content-Type: application/json' \
-d '{"query":"{ protocol(id: \"0\") { inflation } }"}' \
https://api.studio.thegraph.com/query/31909/livepeer-ci/pr-263-3198d53-34330481798 |
There was a problem hiding this comment.
🟡 Changes recommended
The new global resolutions force multiple semver-major overrides (notably uuid), which can introduce runtime incompatibilities and should be pinned/scoped more safely.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Pull request overview
This PR updates dependency constraints and refreshes the Yarn lockfile to move several direct and transitive dependencies onto patched versions, primarily to reduce the project’s Dependabot alert count without changing application code.
Changes:
- Bump direct dependencies
handlebarsandjs-yamlto patched releases. - Add a
resolutionsblock to override multiple vulnerable transitive dependencies. - Refresh
yarn.lockto drop stale entries and resolve to newer patched transitive versions.
File summaries
| File | Description |
|---|---|
| package.json | Bumps handlebars / js-yaml and introduces extensive Yarn resolutions overrides for transitive security remediation. |
| yarn.lock | Regenerated lockfile reflecting the new direct versions and forced resolution of multiple transitives (including several major-version jumps). |
Review details
Suppressed comments (1)
package.json:57
resolutions.uuidforcesuuid@^3.3.2(used byrequest@2.88.2) anduuid@^8.3.2(used byhardhat@2.28.3) to resolve touuid@11.x(see yarn.lock:requestdepends onuuid "^3.3.2", anduuid@^11.1.1, uuid@^3.3.2, uuid@^8.3.2resolves to 11.1.1). Packages that import legacy entrypoints likeuuid/v4(common in uuid v3 consumers) will break at runtime under uuid v11. Consider scoping uuid overrides so uuid v3 consumers stay on a compatible 3.x/4.x line.
"uuid": "^11.1.1",
"adm-zip": "^0.6.0",
- Files reviewed: 1/2 changed files
- Comments generated: 2
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
There was a problem hiding this comment.
🔵 Needs a closer look
It introduces broad global resolutions that force multiple transitive dependencies across major versions, which can cause runtime incompatibilities and merits final human validation.
Review details
Suppressed comments (1)
package.json:57
- The top-level
resolutionshere force several major upgrades that do not satisfy transitive semver ranges (e.g.axios@^0.21.x-> 1.20.0,tar@^6.1.0-> 7.5.22,undici@^5.14.0-> 6.28.1,protobufjs@^6.10.2-> 7.6.6,uuid@^3.3.2-> 11.1.1 inyarn.lock). This is a higher-risk pattern because dependents may rely on old-major APIs, and future dependency updates can silently change what breaks.
Consider scoping these overrides to the specific dependency paths that need them (using selective resolutions like you already do for mocha/*), so unaffected consumers aren’t forced onto incompatible majors.
"resolutions": {
"axios": "^1.13.0",
"tar": "^7.5.18",
"undici": "^6.28.0",
"protobufjs": "^7.5.6",
"serialize-javascript": "^7.0.5",
"tmp": "^0.2.6",
"uuid": "^11.1.1",
"adm-zip": "^0.6.0",
- Files reviewed: 1/2 changed files
- Comments generated: 0 new
- Review effort level: Lite
There was a problem hiding this comment.
🔵 Needs a closer look
The new resolutions intentionally force multiple major-version overrides against transitive semver ranges, which can introduce runtime/tooling incompatibilities that need human validation.
Review details
Suppressed comments (3)
package.json:54
- These global Yarn resolutions force major-version overrides that violate transitive semver ranges in the current lockfile (e.g., axios "^0.21.x" is resolved to 1.20.0; tar "^6.1.0" is resolved to 7.5.22; protobufjs "^6.10.2" is resolved to 7.6.6). That can break transitive consumers at runtime even if installs succeed. Consider scoping these overrides to the specific dependency subtrees that need them (e.g., graph-cli / hardhat) or upgrading the parent packages so their declared ranges allow the newer majors.
"axios": "^1.13.0",
"tar": "^7.5.18",
"undici": "^6.28.0",
"protobufjs": "^7.5.6",
"serialize-javascript": "^7.0.5",
package.json:69
- The tough-cookie and json-schema resolutions override very old declared ranges in the lockfile (e.g., request depends on tough-cookie "~2.5.0", but the lock resolves 4.1.4). This kind of major jump can cause subtle breakage for any code paths that still exercise those legacy dependencies. If the intent is to address advisories for a specific tool (e.g., graph-cli), it’s safer to scope these resolutions to that tool’s dependency subtree rather than applying them repo-wide.
"cookie": "^0.7.0",
"ejs": "^3.1.10",
"tough-cookie": "^4.1.3",
"json-schema": "^0.4.0",
package.json:77
- These resolutions force hardhat’s declared dependency ranges onto newer majors (hardhat declares undici "^5.14.0" and uuid "^8.3.2" in yarn.lock, but they resolve to undici 6.28.1 and uuid 11.1.1). Since this is an intentional semver override, it would be good to ensure CI runs the hardhat test suite (or at least a smoke test) to catch any behavioral incompatibilities introduced by the forced upgrades.
"parse-duration": "^2.1.3",
"**/hardhat/uuid": "^11.1.1",
"**/jayson/uuid": "^11.1.1"
- Files reviewed: 1/2 changed files
- Comments generated: 0 new
- Review effort level: Lite
There was a problem hiding this comment.
🔵 Needs a closer look
It includes broad lockfile churn plus multiple transitive overrides (including overriding an exact solc -> tmp pin), which warrants human verification of runtime/tooling paths beyond the existing build checks.
Review details
- Files reviewed: 1/2 changed files
- Comments generated: 1
- Review effort level: Lite
f54f3ee to
9833a4c
Compare
There was a problem hiding this comment.
🔵 Needs a closer look
A broad, semver-incompatible **/solc/tmp resolution override should be scoped to the known consumers to reduce unintended future impact and risk on the hardhat/solc toolchain.
Review details
Suppressed comments (1)
package.json:77
- The
**/solc/tmpresolution is a broad (and semver-incompatible) override:solcdeclarestmp "0.0.33"in the lockfile, but the lock ends up resolvingtmp@0.0.33to0.2.7. Sincesolcis only consumed viahardhatandethereum-wafflein this repo, consider scoping this override to those paths to avoid accidentally affecting any futuresolcconsumer added to the dependency tree.
"**/solc/tmp": "^0.2.6",
"**/tmp-promise/tmp": "^0.2.6",
- Files reviewed: 1/2 changed files
- Comments generated: 0 new
- Review effort level: Lite
9833a4c to
2504b23
Compare
Bumps handlebars and js-yaml to their patched releases and adds yarn resolutions that force the transitives pinned below the patched major by graph-cli, hardhat and solc (axios, tar, undici, protobufjs, serialize-javascript, tmp, uuid, adm-zip) onto patched lines. The resolutions are floors, the lockfile is the pin. Also drops stale lockfile entries so in-range transitives (ws, minimatch, form-data, brace-expansion, picomatch and friends) resolve to their patched versions.
Clears 107 of the 118 open Dependabot alerts without any code changes.
yarn codegenandyarn buildpass, hardhat loads its plugins, and the docker suite deploys and indexes against the changed toolchain (subgraph does not failpasses; the other runnable case fails for a pre-existing reason, see #267). Supersedes #223, #224, #232, #233, #234, #236 and #258. Does not touch graph-cli or graph-ts (#226, #227), which need a schema change and land in #264.Follow-ups: #269 tracks removing each resolution as its parent is upgraded, #268 removes hardhat and waffle, which own the remaining unfixable alerts.