fix(deps): 补回丢失的 pnpm overrides 安全修复#136
Merged
Merged
Conversation
Re-land overrides lost during a prior merge commit. Pin same-major patched versions for transitive deps and bump mermaid to 11.15.0: lodash 4.18.1, js-yaml 4.2.0, markdown-it 14.2.0, yaml 2.8.3, picomatch 4.0.4, ajv 6.14.0, flatted 3.4.2, minimatch 3.1.4/9.0.7, brace-expansion 1.1.13/2.0.3, mermaid 11.15.0 (incl. plugin peer). Audit: 34 -> 7 advisories. Remaining 7 (transitive vite 5.x from vitepress 1.6.4 + its esbuild) are dev-server-only; need vitepress 2.0. Verified: docs:build OK, vitest 26/26 pass.
Deploying documents with
|
| Latest commit: |
07e08ae
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://aaa4d271.documents-dq4.pages.dev |
| Branch Preview URL: | https://fix-security-overrides-redo.documents-dq4.pages.dev |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
背景
PR #135 squash 合并时，
pnpm.overrides块在合并提交阶段被 lint-staged 钩子意外回退，导致真正的安全补丁没有落到 main（#135 实际只保留了 Dependabot 已有的vite ^8.0.16）。本 PR 用普通提交重新补回。改动
mermaid显式声明^11.15.0+ 作用域 override 强制插件 peer 一并升级pnpm.overrides锁定同 major 传递补丁：lodash 4.18.1 · js-yaml 4.2.0 · markdown-it 14.2.0 · yaml 2.8.3 · picomatch 4.0.4 · ajv 6.14.0 · flatted 3.4.2 · minimatch 3.1.4/9.0.7 · brace-expansion 1.1.13/2.0.3效果
pnpm audit：34 → 7。剩余 7 项为 vitepress 1.6.4 传递的 vite 5.x / esbuild，均 dev-server-only，需 vitepress 2.0（alpha）才能根治。验证
pnpm docs:build成功pnpm test26/26