fix(deps): restore the security sweep's resolutions lost in the sync - #63
Merged
Conversation
Landing the 2026-08-08 sync took open Dependabot alerts from 6 to 27. The `overrides:` block survived intact — all 39 entries byte-identical — so the transitive pins were never at risk. What was lost was the other half of the sweep: the re-resolution. Each of the three `pnpm-lock.yaml` conflicts in the rebase was resolved with `--ours`, then the lock was regenerated with `pnpm install --lockfile-only`. That reads like the ledger's "regenerate rather than merge", but `--lockfile-only` *preserves any existing pin that still satisfies the semver range* — it does not float to newest. Seeding the regeneration from upstream's lock therefore kept upstream's older resolutions and silently reverted the sweep: undici 7.29.0 → 7.27.1 and 8.10.0 → 8.9.0, js-yaml 4.3.1 → 4.2.0, postcss 8.5.26 → 8.5.15, svgo 4.0.2 → 4.0.1, astro 7.2.0 → 7.0.3. Fixed by seeding from the fork's own post-sweep lock (`t3x/pre-sync-20260808`) and letting `--lockfile-only` reconcile that against upstream's new manifests, which still drops entries no longer required and adds upstream's new ones — it just keeps the higher resolutions where the ranges allow. Every version above is back; electron 41.10.3, web-push, the nanoid@3.3.17 dedupe and the infra/t3x-update-relay importer all re-verified present. Verified on the resulting tree: typecheck, lint, and the full suite green, including apps/web at 233/233 after astro's minor bump. Note for next sync: a reopened Dependabot alert keeps its ORIGINAL `created_at`, so "every open alert predates the sync" is not evidence the sync is innocent. Diff the resolved versions instead. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
|
Important Review skippedAuto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
github-actions Bot
pushed a commit
that referenced
this pull request
Aug 10, 2026
The 2026-08-08 sync ran in two passes. This is the second: four more upstream commits (usage page pingdotgg#5684 + chart fix pingdotgg#5697, mobile settings sheet pingdotgg#5625, desktop zoom-shortcut fix pingdotgg#5691), merge-base a20923c. Only two rows moved on the file-list half. ThreadComposer.tsx went +26/-4 to +27/-4 because pingdotgg#5625 rewrote the file around the fork's edit and the resolution re-attaches the line-break button to upstream's new single settings trigger. pnpm-lock.yaml went +196/-143 to +317/-737, which is PR #63's repair showing up rather than new churn. That second number is the reason the lockfile note grew a paragraph. The first pass resolved all three lock conflicts with --ours and ran pnpm install --lockfile-only, which preserves any existing pin that still satisfies the semver range instead of floating to the newest -- so seeding from upstream's lock silently discarded the security sweep and reopened 21 Dependabot alerts. The overrides: block survived byte-identical and did not save it. Seed from the fork's pre-sync lock. Churn and risk are regenerated in the same commit, so both halves of the ledger agree on one merge-base. server.ts churn 32 to 33.
radroid
added a commit
that referenced
this pull request
Aug 10, 2026
The 2026-08-08 sync ran in two passes. This is the second: four more upstream commits (usage page pingdotgg#5684 + chart fix pingdotgg#5697, mobile settings sheet pingdotgg#5625, desktop zoom-shortcut fix pingdotgg#5691), merge-base a20923c. Only two rows moved on the file-list half. ThreadComposer.tsx went +26/-4 to +27/-4 because pingdotgg#5625 rewrote the file around the fork's edit and the resolution re-attaches the line-break button to upstream's new single settings trigger. pnpm-lock.yaml went +196/-143 to +317/-737, which is PR #63's repair showing up rather than new churn. That second number is the reason the lockfile note grew a paragraph. The first pass resolved all three lock conflicts with --ours and ran pnpm install --lockfile-only, which preserves any existing pin that still satisfies the semver range instead of floating to the newest -- so seeding from upstream's lock silently discarded the security sweep and reopened 21 Dependabot alerts. The overrides: block survived byte-identical and did not save it. Seed from the fork's pre-sync lock. Churn and risk are regenerated in the same commit, so both halves of the ledger agree on one merge-base. server.ts churn 32 to 33.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Landing the sync took open Dependabot alerts 6 → 27. This restores them.
The
overrides:block survived the rebase intact (all 39 entries byte-identical), so the transitive pins were never at risk. What was lost is the other half of the sweep — the re-resolution.Cause. Each of the three
pnpm-lock.yamlconflicts was resolved with--ours, then the lock was regenerated withpnpm install --lockfile-only. That reads like the ledger's "regenerate rather than merge", but--lockfile-onlypreserves any existing pin that still satisfies the semver range — it does not float to newest. Seeding from upstream's lock therefore kept upstream's older resolutions:Fix. Seed from the fork's own post-sweep lock (
t3x/pre-sync-20260808) and let--lockfile-onlyreconcile that against upstream's new manifests. It still drops entries no longer required and adds upstream's new ones — it just keeps the higher resolutions where the ranges allow.Re-verified present afterwards: electron 41.10.3, web-push, the nanoid@3.3.17 dedupe, the
infra/t3x-update-relayimporter.Verification. typecheck, lint, and the full suite green.
apps/webre-run on its own at 233/233 because astro's 7.0.3 → 7.2.0 minor bump touches the markdown pipeline; one earlierMessagesTimelinehook timeout was machine contention (it imports in 724ms in isolation), not a regression.Worth carrying forward: a reopened Dependabot alert keeps its original
created_at, so "every open alert predates the sync" is not evidence the sync is innocent. Diff resolved versions instead. Recipe added to the dependency playbook.🤖 Generated with Claude Code