Conversation
- bump catalog vite ^7.1.12 → ^7.3.2 (fixes vitest>vite high/moderate CVEs) - bump catalog @astrojs/react ^4.4.1 → ^4.4.2 (fixes @astrojs/react>vite CVEs) - add override defu@<=6.1.4 → ^6.1.5 (prototype pollution via __proto__) - add override vite@>=5.0.0<=6.4.1 → ^6.4.2 (fixes ponder>vite-node>vite) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
|
Caution Review failedThe pull request is closed. ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (2)
📝 WalkthroughWalkthroughExtended pnpm configuration with dependency version overrides for Changes
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~3 minutes Possibly related PRs
Poem
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Greptile SummaryThis PR is a targeted security patch that resolves 10 vulnerabilities (6 high, 4 moderate) down to 0 by applying three complementary dependency updates:
The approach is layered correctly — the catalog entry covers the direct Confidence Score: 5/5Safe to merge — purely security-patching dependency updates with no functional code changes. Score of 5 reflects that all changes are well-scoped dependency version bumps addressing known CVEs. The defu override is a patch-level fix; the vite override stays within major version 6 (^6.4.2 from a >=5.0.0 <=6.4.1 range); the catalog bumps are minor version increments. The lockfile is consistent, and the test plan covers audit verification, install, test, and typecheck. No files require special attention — all three changed files contain expected, correct dependency version updates. Important Files Changed
Flowchart%%{init: {'theme': 'neutral'}}%%
flowchart TD
A[10 Security Vulnerabilities\n6 high + 4 moderate] --> B[defu prototype\npollution CVE]
A --> C[vite path\ntraversal CVE]
B --> D[pnpm.overrides\ndefu<=6.1.4 → ^6.1.5]
C --> E[via vitest → vite]
C --> F[via ponder → vite-node → vite]
C --> G[via @astrojs/react → vite]
E --> H[catalog vite\n^7.1.12 → ^7.3.2]
F --> I[pnpm.overrides\nvite>=5.0.0 <=6.4.1 → ^6.4.2]
G --> J[catalog @astrojs/react\n^4.4.1 → ^4.4.2]
D --> K[✅ 0 vulnerabilities]
H --> K
I --> K
J --> K
Reviews (1): Last reviewed commit: "fix(deps): patch vite and defu security ..." | Re-trigger Greptile |
There was a problem hiding this comment.
Pull request overview
This PR updates the monorepo’s dependency catalog and pnpm overrides to eliminate reported security vulnerabilities in the Vite/Vitest and defu dependency chains.
Changes:
- Bump catalog versions for
vite(^7.1.12→^7.3.2) and@astrojs/react(^4.4.1→^4.4.2). - Add
pnpm.overridesto force patched versions ofdefuandvitein vulnerable ranges. - Update
pnpm-lock.yamlaccordingly.
Reviewed changes
Copilot reviewed 2 out of 3 changed files in this pull request and generated 4 comments.
| File | Description |
|---|---|
| pnpm-workspace.yaml | Updates catalog versions for vite and @astrojs/react. |
| package.json | Adds new pnpm.overrides entries for defu and vite. |
| pnpm-lock.yaml | Applies the catalog/override changes and updates resolved dependency graph. |
Files not reviewed (1)
- pnpm-lock.yaml: Language not supported
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| resolution: {integrity: sha512-bbguNBcDxsRmi9nnlWJxhfDWamY3lmcyACHcdO1crxfzuLpOhHLLtEIN/nCbbAtj5rchUgQD17QVAKi1f7IsKg==} | ||
| peerDependencies: | ||
| vite: ^5.2.0 || ^6 || ^7 | ||
| vite: ^6.4.2 |
There was a problem hiding this comment.
In the lockfile, @tailwindcss/vite@4.1.16 now lists peerDependencies.vite: ^6.4.2, which would exclude the repo’s Vite 7.x catalog version and doesn’t match the package’s previously recorded peer range. This suggests the lockfile may have been manually edited or generated incorrectly; please regenerate pnpm-lock.yaml via pnpm install (with the intended overrides) and ensure peer dependency ranges are preserved so Vite 7.x can satisfy the peer.
| vite: ^6.4.2 | |
| vite: ^6.4.2 || ^7.0.0 |
| engines: {node: ^14.18.0 || >=16.0.0} | ||
| peerDependencies: | ||
| vite: ^4.2.0 || ^5.0.0 || ^6.0.0 || ^7.0.0 | ||
| vite: ^6.4.2 |
There was a problem hiding this comment.
@vitejs/plugin-react@4.7.0 is recorded with peerDependencies.vite: ^6.4.2 in the lockfile, which is a substantial narrowing from the prior peer range and can force an incompatible peer resolution (or warnings) when the workspace uses Vite 7.x. Please regenerate the lockfile from a clean install and verify the plugin’s peer range isn’t being rewritten; if the ecosystem truly requires Vite 6.4.2+, consider bumping the plugin to a version that supports Vite 7 instead of narrowing peers in the lockfile.
| vite: ^6.4.2 | |
| vite: ^6.4.2 || ^7.0.0 |
| '@vitest/mocker@4.0.5': | ||
| resolution: {integrity: sha512-iYHIy72LfbK+mL5W8zXROp6oOcJKXWeKcNjcPPsqoa18qIEDrhB6/Z08o0wRajTd6SSSDNw8NCSIHVNOMpz0mw==} | ||
| peerDependencies: | ||
| msw: ^2.4.9 | ||
| vite: ^6.0.0 || ^7.0.0-0 | ||
| vite: ^6.4.2 | ||
| peerDependenciesMeta: |
There was a problem hiding this comment.
@vitest/mocker@4.0.5 is now recorded with peerDependencies.vite: ^6.4.2 in the lockfile. This effectively drops Vite 7 peer compatibility and can cause peer resolution drift (e.g., pulling Vite 6 into the tree) despite the workspace catalog using Vite 7.x. Please regenerate the lockfile and ensure peer dependency ranges aren’t being collapsed to the overridden version.
| resolution: {integrity: sha512-cfgJwcGOsIxXOLU/nELPny2/LUD/lcf1IbfyeKTv2bsupVbTH/xpFtdQlBmIP1GEK2CjjLxYhFfB+QODFAx5aw==} | ||
| peerDependencies: | ||
| vite: '*' | ||
| vite: ^6.4.2 |
There was a problem hiding this comment.
vite-tsconfig-paths@4.3.1 is recorded with peerDependencies.vite: ^6.4.2 in the lockfile. This is unusually restrictive (and differs from the prior vite: '*' entry) and may prevent/destabilize using Vite 7.x in the workspace. Please regenerate the lockfile to ensure the plugin’s peer dependency metadata isn’t being rewritten by the update process.
| vite: ^6.4.2 | |
| vite: '*' |
Summary
vite^7.1.12 → ^7.3.2 (fixes high+moderate CVEs in vitest>vite path)@astrojs/react^4.4.1 → ^4.4.2 (pulls in vite ^6.4.1 which resolves to 6.4.2+)pnpm.overridesfordefu@<=6.1.4→ ^6.1.5 (prototype pollution via__proto__key)pnpm.overridesforvite@>=5.0.0 <=6.4.1→ ^6.4.2 (fixes ponder>vite-node>vite path traversal)resolves 10 vulnerabilities (6 high, 4 moderate) down to 0.
Test plan
pnpm audit --audit-level=moderatereturns no vulnerabilitiespnpm installsucceeds without errorspnpm testpassespnpm typecheckpasses🤖 Generated with Claude Code