fix(deps): resolve 4 transitive security advisories failing Dependabot - #174
Merged
Conversation
Dependabot's security updater cannot bump transitive deps on its own, so four security-update jobs fail with `security_update_not_possible`. Fix each at the appropriate level: - @opentelemetry/core (<2.8.0) and protobufjs (<7.6.3): both pulled in ONLY via posthog-js' old @opentelemetry/exporter-logs-otlp-http. Their OTel parents pin @opentelemetry/core to exactly 2.2.0, so the core advisory is unfixable by override without an untested version mix. posthog-js >=1.387.0 drops the OpenTelemetry exporter entirely, so bumping posthog-js (^1.351.4 -> ^1.387.0, already in range) removes both subtrees at the source. App only uses posthog's stable top-level API (init/register/capture/opt_*), unaffected by the bump. - dompurify (<3.4.9): pulled in by monaco-editor@0.55.1 (pins exactly 3.2.7, the latest monaco) and posthog-js. Force ^3.4.10 via override; same-major minor bump, API-compatible. - form-data (<4.0.6): dev-only, via jsdom (^4.0.0) used by vitest. Force ^4.0.6 via override; in range. typecheck, the 200 TS tests, and the web build all pass. Signed-off-by: Mohammod Al Amin Ashik <maa.ashik00@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What & why
Four Dependabot security-update jobs keep failing with
security_update_not_possible(example run). Each affected package is a transitive dependency, which Dependabot won't bump on its own — so the jobs error on every run.This PR remediates all four at the appropriate level.
@opentelemetry/core<2.8.0protobufjs<7.6.3@opentelemetry/otlp-transformerdompurify<3.4.9monaco-editor@0.55.1(pins exactly3.2.7, latest monaco) + posthog-js^3.4.10form-data<4.0.6jsdom(dev-only, via vitest)^4.0.6Two techniques, by necessity
pnpm.overrides. Their parents accept the patched version (monaco's exact3.2.7becomes an API-compatible same-major minor bump), so forcing the version is safe and surgical.@opentelemetry/core: every OTel parent (sdk-trace-base,resources,otlp-transformer,sdk-metrics) pins it to exactly2.2.0, and forcing2.8.0would create an untested OTel version mix (OTel pins exactly to avoid duplicate-instance bugs). Instead, posthog-js ≥ 1.387.0 dropped its OpenTelemetry exporter entirely, so bumpingposthog-js(^1.351.4 → ^1.387.0, already within the existing caret range) removes both the OTel and protobufjs subtrees at the source. The app only uses posthog's stable top-level API (init/register/capture/opt_*), unaffected by the bump.Changes
apps/desktop/package.json:posthog-js^1.351.4 → ^1.387.0package.json: addpnpm.overridesfordompurifyandform-datapnpm-lock.yaml: net −219 lines (unused OTel subtree removed)Verification
pnpm whyconfirms@opentelemetry/coreandprotobufjsare gone;dompurify@3.4.10andform-data@4.0.6resolve everywhere.pnpm typecheck· ✅pnpm test:ts(200/200) · ✅pnpm build:web· ✅ pre-commit hook (cargo fmt/clippy + eslint + tsc)