fix(deps): drop stale fast-uri pin to close alerts #13-17 - #37
Merged
Conversation
The `fast-uri: 3.1.5` override in pnpm-workspace.yaml was added to patch an earlier advisory. It since became the reason this repo was held on a vulnerable version, and the reason Dependabot opened no PR here: it will not update a pin it did not create. Both packages arrive through @modelcontextprotocol/sdk. Their parents already accept the patched versions (ajv wants fast-uri@^3.0.1, express wants qs@^6.14.0, body-parser wants qs@^6.15.2), so removing the pin and re-resolving is sufficient. No new override is added, which is what would recreate the trap. fast-uri 3.1.5 -> 3.1.7 (closes #13, #14, #16, #17) qs 6.15.3 -> 6.16.0 (closes #15) fast-uri stays on the 3.x line because ajv declares ^3.0.1. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NFzcwZnNe1VHh7WAmtUc4q
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes Dependabot alerts #13, #14, #15, #16, #17.
Why Dependabot never opened a PR here
pnpm-workspace.yamlpinnedfast-uri: 3.1.5through an override added to patch an earlier advisory. That pin is what held the repo on a version that later became vulnerable, and Dependabot will not update a hand-written pin it did not create. The weekly triage originally classified this as a coverage gap; it was actually a self-inflicted hold.The fix
Remove the pin and let the declared ranges re-resolve. Removing the override alone is not enough, since
pnpm installhonors the existing lockfile, so this also runspnpm update fast-uri qs -rto re-resolve within the declared ranges. No new override is added: pinning at 3.1.6 / 6.16.0 would recreate the same trap in a few weeks.fast-uriajv@8.20.0wants^3.0.1qsexpress@5.2.1wants^6.14.0,body-parserwants^6.15.2fast-urideliberately stays on the 3.x line. 4.x falls outside ajv's^3.0.1and would need a forced override. No vulnerable copies of either package remain anywhere in the lockfile.Verification
All five gates run locally against this branch, in
ci.ymlorder:pnpm install --frozen-lockfile— passpnpm typecheck— passpnpm -r test— pass (598 tests across 43 files)pnpm --filter @flow/web build— passnpx wrangler deploy --dry-runinapps/api— passRuntime reachability
Both packages arrive via
@modelcontextprotocol/sdk@1.30.0, a production dependency ofapps/api. Inspecting the emitted Worker bundle:qsandexpress: absent.apps/apiimports onlyserver/mcp.js,types.js,validation/types.js, andserver/webStandardStreamableHttp.js, never the express-based transport, so both are tree-shaken out. Alert Bump typescript from 5.9.3 to 7.0.2 in /apps/web #15 was lockfile hygiene rather than live exposure.ajvandfast-uri: present. Alerts Bump vitest from 2.1.9 to 4.1.10 in /packages/core #13, Bump zod from 3.25.76 to 4.4.3 in /packages/shared #14, Bump typescript from 5.9.3 to 7.0.2 in /apps/importer #16, Bump @cloudflare/workers-types from 4.20260702.1 to 5.20260727.1 in /apps/api #17 were genuinely shipping.Deploy impact
None.
ci.ymlrunswrangler deploy --dry-runonly; no automatic production deployment occurs on merge.🤖 Generated with Claude Code
https://claude.ai/code/session_01NFzcwZnNe1VHh7WAmtUc4q