C2FO / fast-csv / 37039115386

97%

master: 96%

push

github

Juanrios/october vulns (#1280)

* juanrios/october-vulns

* chore(deps): patch October security advisories in transitive dependencies

Branch: juanrios/october-vulns
Closes issue: not provided in request.

Resolved: axios 1.20.0, baseline-browser-mapping 2.11.26, body-parser 1.20.8,
brace-expansion 1.1.21/2.1.7/5.0.12, browserslist 4.29.1, colord 2.10.0,
fast-uri 3.1.8, image-size 2.0.4, ip-address 10.7.2, joi 18.2.9,
js-yaml 3.15.2/4.3.2, pacote 21.5.1, postcss-selector-parser 6.1.4/7.1.6,
qs 6.16.0, smol-toml 1.9.0, svgo 3.3.5, undici 6.29.0.

Co-authored-by: Cursor <cursoragent@cursor.com>

* juanrios/october-vulns: minimize pnpm overrides

Branch: juanrios/october-vulns
Closes issue: not provided in request.

Reduce overrides from 40 to 8 parent-scoped/major-jump pins. Patched
versions that fit existing semver ranges now come from a lockfile refresh
(nx 22.7.12, express 4.22.3 -> qs 6.16.0, tar, brace-expansion, js-yaml,
pacote, etc.).

Remaining overrides:
- lerna>js-yaml, lerna>pacote, lerna>tar: lerna 9.0.7 pins exact vulnerable
  versions; lerna 10 still pins vulnerable pacote/js-yaml and drops Node 20/21.
- nx>axios, nx>brace-expansion, nx>smol-toml: every nx release through 23.2.1
  pins vulnerable versions.
- serialize-javascript, uuid: parents only allow vulnerable majors.

Co-Authored-By: Cursor <cursoragent@cursor.com>

---------

Co-authored-by: Cursor <cursoragent@cursor.com>

450 of 471 branches covered (95.54%)

Branch coverage included in aggregate %.

749 of 767 relevant lines covered (97.65%)

2916734.1 hits per line