mirror of
https://github.com/Fission-AI/OpenSpec.git
synced 2026-10-31 08:03:32 +08:00
Clay GoodandClaude Opus 4.8
3281f1f068
Resolve all three open Dependabot alerts (all high severity): - GHSA-5p4m-2wfm-xmqj — js-yaml quadratic-CPU !!omap DoS (#96, #97). Root tree carried js-yaml 3.15.0 (via read-yaml-file) and 4.3.0 (via @changesets/parse). Dev-only; never in the published CLI, which uses `yaml`, not `js-yaml`. Pinned to >=3.15.1 / >=4.3.1. - GHSA-2v37-7h3g-55p8 / CVE-2026-67213 — nanoid size=0 infinite loop (#99). Present in both root (dev, via postcss<-vitest) and website (build-time, via postcss<-next) trees. Pinned to >=3.3.17 (resolves to 3.3.18). Overrides added to all four override surfaces (pnpm-workspace.yaml + package.json, root and website) to keep them in sync, each YAML entry annotated with its advisory id and removal condition. flake.nix pnpmDeps FOD hash regenerated for the root lockfile change (verified via nix build; hash-mismatch-count 0). dependabot.yml gains a note documenting the two surfaces Dependabot cannot manage (pnpm overrides + the Nix flake). Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
20 lines
719 B
YAML
20 lines
719 B
YAML
packages:
|
|
- '.'
|
|
|
|
allowBuilds:
|
|
esbuild@0.28.1: true
|
|
|
|
overrides:
|
|
brace-expansion@<=5.0.8: '>=5.0.9 <6'
|
|
postcss@<8.5.23: '>=8.5.23 <9'
|
|
# GHSA-5p4m-2wfm-xmqj — js-yaml quadratic-CPU !!omap DoS. Dev-only (pulled by
|
|
# @changesets: read-yaml-file for 3.x, @changesets/parse for 4.x); never in the
|
|
# published CLI. Remove once changesets' transitive js-yaml is >=3.15.1 / >=4.3.1
|
|
# (check: pnpm why js-yaml).
|
|
js-yaml@>=3.0.0 <3.15.1: '>=3.15.1 <4'
|
|
js-yaml@>=4.0.0 <4.3.1: '>=4.3.1 <5'
|
|
# GHSA-2v37-7h3g-55p8 / CVE-2026-67213 — nanoid infinite loop on size=0. Dev-only
|
|
# (transitive via postcss). Remove once transitive nanoid is >=3.3.17
|
|
# (check: pnpm why nanoid).
|
|
nanoid@<3.3.17: '>=3.3.17 <4'
|