Skip to content

Drop the deepmerge-ts override once @prisma/config ships ^8 #54

Description

@btravers

Added in PR #49 to get CI's audit gate green.

pnpm-workspace.yaml now carries:

  "deepmerge-ts@<8.0.0": "8.0.1"

GHSA-ggr8-5vv4-36mx — stack exhaustion when merging recursive object graphs. It reaches us only through examples/order-infrastructure > prisma > @prisma/config > deepmerge-ts, i.e. the Prisma CLI at generate time, never a published package's runtime deps.

There was nothing upstream to take: prisma@7.9.1 was already latest and @prisma/config@latest still pinned deepmerge-ts@^7. The override is the same version-scoped shape as the vite@<6.4.3 entry beside it, so only the affected line moves.

This is a hold, not a fix. Forcing a major bump into a package that pins ^7 is a compatibility bet — it happens to work (examples/order-infrastructure 18/18, full gate green), but it is our bet, not Prisma's.

Acceptance

  • Drop the deepmerge-ts line from pnpm-workspace.yaml's overrides once @prisma/config ships deepmerge-ts@^8 itself.
  • Confirm pnpm audit is clean without it before removing.

Metadata

Metadata

Assignees

No one assigned

    Labels

    P2Wanted, not urgentdependenciesPull requests that update a dependency file

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions