Override smol-toml past GHSA-7w5x-hrqm-74c2 - #2802
Merged
chalin merged 4 commits intoSep 10, 2026
Merged
Conversation
- Unblocks every PR's `build` job: the npm-audit gate rejects the high-severity smol-toml DoS advisory (published 2026-09-09) reached via markdownlint-cli2's exact 1.7.0 pin; fixed 1.7.1+ exists, so bump rather than accept - Root override resolves the lock to 1.8.0 (29 days old, past the cooldown); markdownlint-cli2 has no newer release, so Renovate can't remediate - Supply-chain audit's reviewed-overrides check generalized to a table, one row per security override
…ull range - Scans every lock node for an overridden package, not only the hoisted one, so a vulnerable copy left under the parent's node_modules goes red - smol-toml's fixed-version pattern now spans the whole ^1.7.1 range instead of a truncated minor window - Comment and assert messages trimmed to what the code doesn't say
…sions - Covers the theme's standalone lock, which the root override doesn't reach - Anchors the version patterns, so prereleases fail and minors of any width pass
…anifest - Comment named the check's value as pinning the lock, which npm ci already validates on the hoisted path; it now names the gaps the check closes - Rejects overrides in theme/package.json, the one manifest root npm ci never reads - Fails with a labeled assertion, not a TypeError, when a parent isn't hoisted
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
npm cileaves: every security override, both locks, every hoisted or nested copy, the theme manifestmainalready carries the bump