Skip to content
This repository was archived by the owner on Oct 7, 2026. It is now read-only.

chore(deps): override mysql2 and deepmerge-ts to patched versions #102

Merged
shirasakaren merged 3 commits into from
Sep 24, 2026
Merged

chore(deps): override mysql2 and deepmerge-ts to patched versions #102

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
3b10032
chore(deps): override mysql2 and deepmerge-ts to patched versions
SyafaHadyan Sep 24, 2026
039877a
fix(deps): pin the mysql2/deepmerge-ts overrides to exact versions
SyafaHadyan Sep 24, 2026
3e97e32
Merge branch 'main' into chore/override-vulnerable-prisma-transitives
shirasakaren Sep 24, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
53 changes: 27 additions & 26 deletions pnpm-lock.yaml
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

10 changes: 10 additions & 0 deletions pnpm-workspace.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,16 @@
packages:
- "apps/*"
- "packages/*"
overrides:
Comment thread
SyafaHadyan marked this conversation as resolved.
# Both are transitive deps of prisma, pinned to patched versions for known
# advisories: mysql2 is a dormant multi-database driver this project's
# postgresql-only usage never exercises. deepmerge-ts is not dormant,
# @prisma/config calls it directly while loading configuration regardless
# of provider, so it's a real vulnerable dependency, not a dead one.
# Exact versions on purpose, not a >= range, so a routine lockfile
# refresh can't silently pull in an unreviewed future major.
mysql2: "3.24.4"
deepmerge-ts: "8.0.2"
allowBuilds:
"@prisma/engines": true
"@scarf/scarf": false
Expand Down
Loading