chore(deps): 2026-07 audit 波の脆弱性 override を追加する#28
Merged
Conversation
brace-expansion / js-yaml / websocket-driver / shell-quote / axios に 対する新規 advisory 群 (GHSA-3jxr-9vmj-r5cp ほか critical 1 件・ high 4 件) の公開により pnpm audit が失敗していた。本リポジトリで 検出された advisory に対応する override を pnpm-workspace.yaml に 追加し、lockfile を再生成して audit 0 件を確認した。 brace-expansion の 3.x-5.0.6 は patch が出ておらず 5.0.7 が必要。 5.0.x は lockfile の既存解決が range を満たし自然には上がらないため override で強制している。 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
2026-07 の新規 advisory 波により
pnpm auditが失敗していたため、このリポジトリで検出された advisory に対応する override をpnpm-workspace.yamlに追加し、lockfile を再生成する。対象の advisory 群:
補足: brace-expansion 3.x〜5.0.6 には patch が出ておらず 5.0.7 が必要。5.0.x は lockfile の既存解決（5.0.5 等）が range を満たすため自然には上がらず、override で強制している。不要になった override は prune-supply-chain-overrides-action が後で自動的に剥がす。
Test plan
pnpm install --no-frozen-lockfile実行後、pnpm auditが 0 件になることを確認Co-Authored-By: Claude noreply@anthropic.com
🤖 Generated with Claude Code