fix(deps): bump fast-jwt and fastify to patched versions via catalog#1404
Open
legreffier[bot] wants to merge 1 commit into
Open
fix(deps): bump fast-jwt and fastify to patched versions via catalog#1404legreffier[bot] wants to merge 1 commit into
legreffier[bot] wants to merge 1 commit into
Conversation
Clears the two direct-dependency security advisories using the catalog (the workspace version-policy mechanism), not pnpm.overrides: - fast-jwt ^6.1.0 -> ^6.2.4 (critical: GHSA-mvf2-f6gm-w987, GHSA-rp9m-7r4c-75qg, GHSA-gmvf-9v4p-v8jc) for libs/auth - fastify ^5.8.3 -> ^5.8.5 (high: GHSA-247c-9743-5963) Also drops the redundant 'fastify: >=5.8.3' pnpm.override, which was pinning fastify below the patched version and defeating the catalog bump. Remaining advisories are transitive-only (protobufjs, hono, ws, grpc-js, fast-uri, qs, tar, @opentelemetry/core, and transitive fast-jwt via @fastify/jwt) and are intentionally left for their parent packages to update upstream rather than force-pinned via overrides. Verified: typecheck green for auth/mcp-server/rest-api; all 113 @moltnet/auth tests pass on fast-jwt 6.2.4. MoltNet-Diary: 42bdb169-6042-40a7-a5f3-5b9c947ce20c Task-Group: dep-audit-direct-bumps Task-Family: infra Task-Completes: true
Contributor
✅ CLI go.mod matches internal Go module releases
|
Contributor
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Clears the two direct-dependency security advisories flagged by the
pnpm audit --prodCI gate, using the catalog (pnpm-workspace.yaml) — the workspace's version-policy mechanism for deps we declare directly:fast-jwt^6.1.0^6.2.4libs/auth)fastify^5.8.3^5.8.5Also removes the stale
fastify: >=5.8.3pnpm.override. Sincefastifyis a direct catalog dep, that override was redundant and was pinning fastify below the patched version — defeating the catalog bump until removed.Scope: catalog only, by design
The remaining audit advisories are transitive-only — they live inside parents we don't control:
protobufjs,@grpc/grpc-js← OTel exporters / pi-ai / pino-otel-transporthono,@hono/node-server,fast-uri,qs,ip-address←@modelcontextprotocol/sdk(already on its latest1.29.0, which still declares the vulnerable ranges)ws←@dbos-inc/dbos-sdk,@earendil-works/pi-aitar←@huggingface/transformers(fix needs a major bump 3→4)fast-jwt6.1.0/5.0.6←@fastify/jwtand the@getlarge/fastify-mcpforkelliptic(low) ←get-jwks— no upstream fix existsPer maintainer decision, these are left for the parent packages to update their transitives upstream, rather than force-pinning every one via
overrides. Apnpm.overrideand a catalog entry are not equivalent — overrides reach all transitive paths (a security floor), catalog entries only govern directcatalog:consumers — so the few existing overrides that double as security floors (undici,smol-toml) are intentionally kept.Verification
nx typecheckgreen for@moltnet/auth,@moltnet/mcp-server,@moltnet/rest-api@moltnet/authtests pass onfast-jwt@6.2.4fastifyresolves to a single5.8.5;@moltnet/authresolvesfast-jwt@6.2.4MoltNet-Diary: 42bdb169-6042-40a7-a5f3-5b9c947ce20c