github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-24 08:01:56 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[PR #9167] chore(deps): add pnpm overrides for vulnerable transitive dependencies #25382

New Issue
Open
opened 2026-04-15 22:51:45 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-04-15 22:51:45 -05:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/better-auth/better-auth/pull/9167
Author: @gustavovalverde
Created: 4/14/2026
Status: 🔄 Open

Base: main ← Head: chore/pnpm-overrides-for-vulnerable-transitives

📝 Commits (1)

  • 0fcfaa3 chore(deps): add pnpm overrides for vulnerable transitive dependencies

📊 Changes

2 files changed (+94 additions, -219 deletions)

View changed files

📝 pnpm-lock.yaml (+81 -219)
📝 pnpm-workspace.yaml (+13 -0)

📄 Description

Extends the pnpm-workspace.yaml overrides block so Dependabot-flagged transitives resolve to patched versions. Every advisory involved reaches our lockfile through docs tooling, e2e fixtures, dev build utilities, or Prisma/TanStack Start peer chains; no published package is exposed at runtime.

Each new override is scoped to the vulnerable range (pkg@<patched: '>=patched'), matching the existing h3@<2, brace-expansion@>=2 <4 pattern. Scoped selectors avoid forcing unintended upgrades onto future majors if any dependency ever pulls an unrelated newer range.

New entries (advisory IDs in parentheses):

  • defu@<6.1.5 (GHSA-737v-mqg7-c878)
  • undici@>=7 <7.24.0 (GHSA-vrm6-8vpv-qv8q, GHSA-v9p9-hfj2-hcw8, GHSA-f269-vfmq-vjvj)
  • tar@<7.5.11 (GHSA-9ppj-qmqm-q256, GHSA-qffp-2rhf-9h96)
  • minimatch@>=9 <9.0.7 (GHSA-7r86-cg39-jmmj, GHSA-23c5-xmqv-rm74, GHSA-3ppc-4f35-3m26)
  • flatted@<3.4.2 (GHSA-rf6f-7fwh-wjgh)
  • serialize-javascript@<7.0.3 (GHSA-5c6j-r48x-rmvq)
  • @remix-run/router@<1.23.2 (GHSA-2w69-qvjg-hvjx)
  • @remix-run/react@<2.17.3 (GHSA-8v8x-cx79-35w7)
  • @hono/node-server@<1.19.10 (GHSA-wc8c-qw6v-h7f6)
  • hono@<4.12.4 (GHSA-q5qw-h33p-qvwr)
  • express-rate-limit@<8.2.2 (GHSA-46wh-pxpv-q5gq)
  • effect@<3.20.0 (GHSA-38f7-945m-qr2g)

Special case: the v2 line of h3 enters the tree as an alias (h3-v2) declared by @tanstack/start-server-core so that h3 v1 and v2 can coexist. Standard package-name-scoped overrides do not match aliased deps, so the v2 bump targets the alias directly (h3-v2: 'npm:h3@^2.0.1-rc.15').

Install, typecheck, build, typecheck:dist, and the full workspace test suite all pass on the regenerated lockfile.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/better-auth/better-auth/pull/9167 **Author:** [@gustavovalverde](https://github.com/gustavovalverde) **Created:** 4/14/2026 **Status:** 🔄 Open **Base:** `main` ← **Head:** `chore/pnpm-overrides-for-vulnerable-transitives` --- ### 📝 Commits (1) - [`0fcfaa3`](https://github.com/better-auth/better-auth/commit/0fcfaa3ccf6009b9b69abdcd06f557baf9985c62) chore(deps): add pnpm overrides for vulnerable transitive dependencies ### 📊 Changes **2 files changed** (+94 additions, -219 deletions) <details> <summary>View changed files</summary> 📝 `pnpm-lock.yaml` (+81 -219) 📝 `pnpm-workspace.yaml` (+13 -0) </details> ### 📄 Description Extends the `pnpm-workspace.yaml` overrides block so Dependabot-flagged transitives resolve to patched versions. Every advisory involved reaches our lockfile through docs tooling, e2e fixtures, dev build utilities, or Prisma/TanStack Start peer chains; no published package is exposed at runtime. Each new override is scoped to the vulnerable range (`pkg@<patched: '>=patched'`), matching the existing `h3@<2`, `brace-expansion@>=2 <4` pattern. Scoped selectors avoid forcing unintended upgrades onto future majors if any dependency ever pulls an unrelated newer range. New entries (advisory IDs in parentheses): - `defu@<6.1.5` (GHSA-737v-mqg7-c878) - `undici@>=7 <7.24.0` (GHSA-vrm6-8vpv-qv8q, GHSA-v9p9-hfj2-hcw8, GHSA-f269-vfmq-vjvj) - `tar@<7.5.11` (GHSA-9ppj-qmqm-q256, GHSA-qffp-2rhf-9h96) - `minimatch@>=9 <9.0.7` (GHSA-7r86-cg39-jmmj, GHSA-23c5-xmqv-rm74, GHSA-3ppc-4f35-3m26) - `flatted@<3.4.2` (GHSA-rf6f-7fwh-wjgh) - `serialize-javascript@<7.0.3` (GHSA-5c6j-r48x-rmvq) - `@remix-run/router@<1.23.2` (GHSA-2w69-qvjg-hvjx) - `@remix-run/react@<2.17.3` (GHSA-8v8x-cx79-35w7) - `@hono/node-server@<1.19.10` (GHSA-wc8c-qw6v-h7f6) - `hono@<4.12.4` (GHSA-q5qw-h33p-qvwr) - `express-rate-limit@<8.2.2` (GHSA-46wh-pxpv-q5gq) - `effect@<3.20.0` (GHSA-38f7-945m-qr2g) Special case: the v2 line of `h3` enters the tree as an alias (`h3-v2`) declared by `@tanstack/start-server-core` so that h3 v1 and v2 can coexist. Standard package-name-scoped overrides do not match aliased deps, so the v2 bump targets the alias directly (`h3-v2: 'npm:h3@^2.0.1-rc.15'`). Install, typecheck, build, `typecheck:dist`, and the full workspace test suite all pass on the regenerated lockfile. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
GiteaMirror added the pull-request label 2026-04-15 22:51:45 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#25382
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?