Repository navigation
fix: replace lerna with turbo and clear all advisories with zero overrides - #647
Merged
aversini merged 2 commits intoAug 13, 2026
Merged
Conversation
Refreshes transitive dependencies and adds a scoped security override block, clearing every open Dependabot alert on this repo. Five overrides added, each because a parent holds the vulnerable version and a plain refresh cannot move it — every parent verified against this repo's own lockfile: brace-expansion 5.0.8 <- nx@23.1.1 js-yaml 4.3.0 <- lerna@10.0.0 (declares it as an EXACT version) postcss 8.5.16 <- vite@8.1.0 (range ^8.5.15 already allows the fix) tar 7.5.20 <- lerna@10.0.0 (declares it as an EXACT version) undici 7.28.0 <- jsdom@29.1.1 The postcss override also lifts nanoid: nanoid 3.3.15 was pulled in by the old postcss, so no separate pin is needed. Unlike the sibling repos there is no leftover esbuild advisory here, so this one reaches zero. Note for future refreshes: a plain `pnpm install` only satisfies existing ranges and will not move transitives forward. The refresh has to be `pnpm update`. Verified: build clean (14 tasks), 558 tests passed across 27 files, lint clean. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PEemn4mVaZJjT9xShw2Mij
Reaches zero open advisories with zero overrides, by removing the tools that were dragging in the vulnerable transitives rather than pinning around them. Every override this repo carried traced back to something it did not need: brace-expansion <- nx (nx is never declared; it rides in with lerna) js-yaml, tar <- lerna@10.0.0, which declares them as EXACT versions undici <- a phantom jsdom postcss, nanoid <- stale resolution, already fixed by the refresh lerna was only a task runner here (`lerna run build|lint|test|...`). turbo already does that job in sassysaint, clubroad, episodia and ui-components, and those repos need none of these overrides -- turbo brings no equivalent baggage. So: turbo.json added, root scripts and all three workflows moved to `pnpm turbo run`, lerna.json deleted, lerna dropped from devDependencies. The publish step becomes `pnpm publish -r --no-git-checks`. That is equivalent to `lerna publish from-package --no-private`: pnpm skips private packages and any version already on the registry, and every published package here already declares publishConfig.access=public, so no --access flag is needed. `autoInstallPeers: false` stops the phantom jsdom. vitest declares jsdom as an OPTIONAL peer; this suite runs on happy-dom and nothing in the repo imports jsdom, so installing it only added a vulnerable undici. Install reports no peer warnings afterwards. Net effect: 907 resolved packages -> 559, and the overrides block is gone entirely, replaced by a comment recording why it must not come back. An override is invisible maintenance -- two in sassysaint had gone stale and were blocking the very fixes they were added for. Verified: build exit 0, 558 tests passed (unchanged), lint exit 0, and the lockfile contains no lerna, no nx and no jsdom. NOT verified locally: the CI publish path. `pnpm publish -r` is argued equivalent above but has not been exercised against the registry; worth watching the first release closely. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PEemn4mVaZJjT9xShw2Mij
aversini
changed the title
aversini
deleted the
fix_patch_all_26_open_security_advisories_in_dependencies
branch
August 13, 2026 22:05
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Refreshes transitive dependencies and adds a scoped security override block, clearing every open Dependabot alert on this repo (26 → 0).
Overrides added
Each exists because a parent holds the vulnerable version and a plain refresh cannot move it. Every parent was verified against this repo's own lockfile:
brace-expansionnx@23.1.1js-yamllerna@10.0.0— declares it as an exact versionpostcssvite@8.1.0— its^8.5.15range already allows the fixtarlerna@10.0.0— declares it as an exact versionundicijsdom@29.1.1The postcss override also lifts
nanoid: nanoid 3.3.15 was pulled in by the old postcss, so no separate pin is needed.Unlike the sibling repos there is no leftover
esbuildadvisory here, so this one reaches zero.Note for future refreshes
A plain
pnpm installonly satisfies existing ranges and will not move transitives forward — reproducing a lockfile from scratch brings every alert back. The periodic security refresh has to bepnpm update.Verification
pnpm buildpnpm testpnpm lint🤖 Generated with Claude Code
https://claude.ai/code/session_01PEemn4mVaZJjT9xShw2Mij