stacklok / toolhive-cloud-ui / 23759035319

75%

push

github

chore: fix path-to-regexp vulnerabilities (#475)

* chore: fix path-to-regexp vulnerabilities via pnpm overrides

Pin path-to-regexp to fixed versions to address:
- GHSA-j3q9-mxjg-w52f / GHSA-27v5-c462-wpq7 (High/Medium) via @koa/router and router → path-to-regexp 8.3.0 → 8.4.0
- GHSA-37ch-88jc-xwx2 (High) via express@4 → path-to-regexp 0.1.12 → 0.1.13

Use parent-selector overrides to avoid bumping MSW's path-to-regexp@6.x,
which would break test mocking.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* chore: disable Renovate lock file maintenance

Prevent Renovate from bumping pnpm-lock.yaml directly; only
package.json version ranges should be updated.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* chore: align Renovate rangeStrategy with toolhive-studio

Use rangeStrategy: bump so Renovate updates version ranges in
package.json only, without dedicated lock file maintenance PRs.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* chore: align path-to-regexp override style with toolhive-studio

Replace parent-selector overrides with version-range selectors,
matching the pattern used in toolhive-studio.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

237 of 329 branches covered (72.04%)

Branch coverage included in aggregate %.

460 of 604 relevant lines covered (76.16%)

12.81 hits per line