Remove the npm `overrides` pins once eslint ships the fixes upstream #101

New issue

Open

opened 2026-09-01 15:07:16 +00:00 by claude-bot · 0 comments

claude-bot commented

2026-09-01 15:07:16 +00:00

Contributor

Tracking issue for the dependency pins added while closing #81, so they can be removed rather than quietly becoming permanent.

What is pinned

frontend/package.json:

"overrides": {
  "brace-expansion@1": "1.1.18",
  "js-yaml@4": "4.3.2"
}

Why

Two high-severity DoS advisories were reachable only through eslint's own dependency tree, at the latest published eslint (9.39.5):

Advisory	Path	Affected
GHSA-3jxr-9vmj-r5cp, GHSA-mh99-v99m-4gvg, GHSA-rgw5-rvv9-x895	`eslint → minimatch@3 → brace-expansion`	`<=1.1.17`
GHSA-5p4m-2wfm-xmqj	`eslint → @eslint/eslintrc → js-yaml`	`4.0.0 - 4.3.0`

Because there was no newer eslint to bump to, Renovate could not resolve these — no dependency PR would ever have fixed them. The pins were the only route to a clean npm audit --audit-level=high, which #56 wants before branch protection can require it.

The version selectors are scoped deliberately: brace-expansion@1 leaves the healthy brace-expansion@5.0.9 used by @typescript-eslint/typescript-estree alone. Verified after the change:

eslint@9.39.5
├── @eslint/eslintrc@3.3.6 → js-yaml@4.3.2 overridden
└── minimatch@3.1.5 → brace-expansion@1.1.18 overridden
typescript-eslint@8.68.0
└── @typescript-eslint/typescript-estree@8.68.0 → minimatch@10.2.6 → brace-expansion@5.0.9

Why this needs tracking

Renovate does not manage overrides. These will not generate update PRs and will not be flagged as stale. Left alone they can silently hold back a legitimate upgrade — the failure mode is a pin that looks like it is still protecting something while actually pinning a package backwards.

Removal conditions

Remove each pin once the corresponding upstream path no longer resolves to an affected version:

brace-expansion@1 — remove when eslint drops its minimatch@3 dependency (or minimatch@3 widens to accept a non-vulnerable brace-expansion)
js-yaml@4 — remove when @eslint/eslintrc requires js-yaml > 4.3.0
After removing either, run npm install && npm audit --audit-level=high and confirm it still reports 0 vulnerabilities

How to check

cd frontend
# temporarily drop the overrides block, then:
npm install
npm ls brace-expansion js-yaml
npm audit --audit-level=high

If it reports 0 vulnerabilities without the overrides, the pin is obsolete — delete it, commit the regenerated lockfile, and close this issue.

Worth a look whenever an eslint major or minor lands. Related: #81, #56.

Tracking issue for the dependency pins added while closing #81, so they can be removed rather than quietly becoming permanent. ## What is pinned `frontend/package.json`: ```json "overrides": { "brace-expansion@1": "1.1.18", "js-yaml@4": "4.3.2" } ``` ## Why Two high-severity DoS advisories were reachable only through **eslint's own dependency tree, at the latest published eslint (9.39.5)**: | Advisory | Path | Affected | |---|---|---| | [GHSA-3jxr-9vmj-r5cp](https://github.com/advisories/GHSA-3jxr-9vmj-r5cp), [GHSA-mh99-v99m-4gvg](https://github.com/advisories/GHSA-mh99-v99m-4gvg), [GHSA-rgw5-rvv9-x895](https://github.com/advisories/GHSA-rgw5-rvv9-x895) | `eslint → minimatch@3 → brace-expansion` | `<=1.1.17` | | [GHSA-5p4m-2wfm-xmqj](https://github.com/advisories/GHSA-5p4m-2wfm-xmqj) | `eslint → @eslint/eslintrc → js-yaml` | `4.0.0 - 4.3.0` | Because there was no newer eslint to bump to, **Renovate could not resolve these** — no dependency PR would ever have fixed them. The pins were the only route to a clean `npm audit --audit-level=high`, which #56 wants before branch protection can require it. The version selectors are scoped deliberately: `brace-expansion@1` leaves the healthy `brace-expansion@5.0.9` used by `@typescript-eslint/typescript-estree` alone. Verified after the change: ``` eslint@9.39.5 ├── @eslint/eslintrc@3.3.6 → js-yaml@4.3.2 overridden └── minimatch@3.1.5 → brace-expansion@1.1.18 overridden typescript-eslint@8.68.0 └── @typescript-eslint/typescript-estree@8.68.0 → minimatch@10.2.6 → brace-expansion@5.0.9 ``` ## Why this needs tracking **Renovate does not manage `overrides`.** These will not generate update PRs and will not be flagged as stale. Left alone they can silently hold back a legitimate upgrade — the failure mode is a pin that *looks* like it is still protecting something while actually pinning a package backwards. ## Removal conditions Remove each pin once the corresponding upstream path no longer resolves to an affected version: - [ ] **`brace-expansion@1`** — remove when `eslint` drops its `minimatch@3` dependency (or `minimatch@3` widens to accept a non-vulnerable `brace-expansion`) - [ ] **`js-yaml@4`** — remove when `@eslint/eslintrc` requires `js-yaml` > 4.3.0 - [ ] After removing either, run `npm install && npm audit --audit-level=high` and confirm it still reports 0 vulnerabilities ## How to check ```sh cd frontend # temporarily drop the overrides block, then: npm install npm ls brace-expansion js-yaml npm audit --audit-level=high ``` If it reports 0 vulnerabilities without the overrides, the pin is obsolete — delete it, commit the regenerated lockfile, and close this issue. Worth a look whenever an eslint major or minor lands. Related: #81, #56.

claude-bot added the

area/frontend

priority/low

type/chore

labels

2026-09-01 15:07:19 +00:00