Add overrides to pnpm workspace for compat installs to address CVEs#27293
Conversation
|
Hi! Thank you for opening this PR. Want me to review it? Based on the diff (339 lines, 3 files), I've queued these reviewers:
How this works
|
There was a problem hiding this comment.
Pull request overview
This PR adds pnpm workspace-level overrides in the test-version-utils compat workspace to force patched dependency versions (primarily addressing an axios 0.28.1 security alert), and regenerates the committed lockfile to reflect the new resolution.
Changes:
- Add
pnpmoverridesincompat-workspaces/full/pnpm-workspace.yamlto pin safer versions ofaxios,jsrsasign,serialize-javascript, anduuid. - Regenerate
compat-workspaces/full/pnpm-lock.yamlso the resolved versions (and the overrides block) match the new configuration.
Reviewed changes
Copilot reviewed 1 out of 2 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| packages/test/test-version-utils/compat-workspaces/full/pnpm-workspace.yaml | Adds override rules to force patched dependency versions during compat workspace installs. |
| packages/test/test-version-utils/compat-workspaces/full/pnpm-lock.yaml | Updates the lockfile to reflect the new overrides and resulting resolved versions. |
Files not reviewed (1)
- packages/test/test-version-utils/compat-workspaces/full/pnpm-lock.yaml: Language not supported
|
FYI @ChumpChief @jason-ha . Where possible we've been starting to use |
|
Description
Adds a few overrides to the pnpm workspace for compat installs. We got an alert for axios 0.28.1, so that was the main thing to fix, but applied a few others that we also have in other places.
Reviewer Guidance
The review process is outlined on this wiki page.