fix: patch Dependabot alerts #4, #9, #12 (path-to-regexp, picomatch, brace-expansion)#46
Conversation
|
x402-stellar PR Preview deployed: |
… picomatch, and brace-expansion Agent-Logs-Url: https://github.com/stellar/x402-stellar/sessions/63da46bc-19cc-40f0-a6b1-d4222b0440b7 Co-authored-by: sagpatil <1414227+sagpatil@users.noreply.github.com>
|
x402-stellar PR Preview deployed: |
There was a problem hiding this comment.
Pull request overview
This PR patches several Dependabot alerts affecting transitive npm dependencies by adding pnpm.overrides in the root package.json and regenerating pnpm-lock.yaml to ensure the patched versions are resolved across the workspace.
Changes:
- Added parent-scoped
pnpm.overridesforpicomatch(2.x vs 4.x) and version-scoped overrides forbrace-expansion(1.x vs 5.x), plus a global override forpath-to-regexp. - Regenerated
pnpm-lock.yamlto reflect the new override rules and resolved patched versions.
Reviewed changes
Copilot reviewed 1 out of 2 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| package.json | Introduces new pnpm.overrides entries to force patched transitive dependency versions. |
| pnpm-lock.yaml | Updates the lockfile override section and resolved dependency graph to the patched versions. |
Files not reviewed (1)
- pnpm-lock.yaml: Language not supported
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
All parent packages (router, anymatch, tinyglobby, minimatch) already use semver ranges (^) that allow the patched versions. A targeted pnpm update is sufficient to pin the fixes — no overrides needed. - path-to-regexp: 8.3.0 → 8.4.1 (GHSA-j3q9-mxjg-w52f, GHSA-27v5-c462-wpq7) - picomatch@2: 2.3.1 → 2.3.2 (GHSA-c2c7-rcm5-vvqj, GHSA-3v7f-55p6-f55p) - picomatch@4: 4.0.3 → 4.0.4 (same) - brace-expansion@1: 1.1.12 → 1.1.13 (GHSA-f886-m6hf-6m8v) - brace-expansion@5: 5.0.4 → 5.0.5 (same)
|
x402-stellar PR Preview deployed: |
Three sets of npm advisories published March 25–27, 2026 affect transitive dependencies. All are fixed by updating the lockfile directly — no
pnpm.overridesneeded.Vulnerabilities patched
path-to-regexppicomatch(2.x)picomatch(4.x)brace-expansion(1.x)brace-expansion(5.x)Approach
Every parent package already uses a
^semver range that allows the patched version:path-to-regexprouter@2.2.0^8.0.0picomatch@2.xanymatch@3.1.3^2.0.4picomatch@4.xtinyglobby^4.0.3brace-expansion@1.xminimatch@3.1.5^1.1.7brace-expansion@5.xminimatch@10.2.4^5.0.2Running
pnpm update path-to-regexp picomatch brace-expansionrefreshes the lockfile pins to the latest compatible versions (the patched ones).pnpm.overrideswould be unnecessary maintenance overhead — the lockfile is committed and deterministic, sopnpm installeverywhere uses the pinned fixed versions.Changes:
pnpm-lock.yamlonly —package.jsonis untouched (beyond the previousflattedoverride).