Added in PR #49 to get CI's audit gate green.
pnpm-workspace.yaml now carries:
"deepmerge-ts@<8.0.0": "8.0.1"
GHSA-ggr8-5vv4-36mx — stack exhaustion when merging recursive object graphs. It reaches us only through examples/order-infrastructure > prisma > @prisma/config > deepmerge-ts, i.e. the Prisma CLI at generate time, never a published package's runtime deps.
There was nothing upstream to take: prisma@7.9.1 was already latest and @prisma/config@latest still pinned deepmerge-ts@^7. The override is the same version-scoped shape as the vite@<6.4.3 entry beside it, so only the affected line moves.
This is a hold, not a fix. Forcing a major bump into a package that pins ^7 is a compatibility bet — it happens to work (examples/order-infrastructure 18/18, full gate green), but it is our bet, not Prisma's.
Acceptance
- Drop the
deepmerge-ts line from pnpm-workspace.yaml's overrides once @prisma/config ships deepmerge-ts@^8 itself.
- Confirm
pnpm audit is clean without it before removing.
Added in PR #49 to get CI's audit gate green.
pnpm-workspace.yamlnow carries:GHSA-ggr8-5vv4-36mx — stack exhaustion when merging recursive object graphs. It reaches us only through
examples/order-infrastructure > prisma > @prisma/config > deepmerge-ts, i.e. the Prisma CLI atgeneratetime, never a published package's runtime deps.There was nothing upstream to take:
prisma@7.9.1was already latest and@prisma/config@lateststill pinneddeepmerge-ts@^7. The override is the same version-scoped shape as thevite@<6.4.3entry beside it, so only the affected line moves.This is a hold, not a fix. Forcing a major bump into a package that pins
^7is a compatibility bet — it happens to work (examples/order-infrastructure18/18, full gate green), but it is our bet, not Prisma's.Acceptance
deepmerge-tsline frompnpm-workspace.yaml'soverridesonce@prisma/configshipsdeepmerge-ts@^8itself.pnpm auditis clean without it before removing.