🔧 Use tilde ranges for security dependency overrides#6888
Merged
Conversation
Switch pnpm overrides from pinned versions to tilde ranges so security patch releases can be picked up without manually bumping each entry.
|
@fast-check/ava
fast-check
@fast-check/jest
@fast-check/packaged
@fast-check/poisoning
@fast-check/vitest
@fast-check/worker
commit: |
dubzzz
enabled auto-merge (squash)
April 18, 2026 19:32
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #6888 +/- ##
==========================================
- Coverage 94.75% 94.72% -0.04%
==========================================
Files 211 211
Lines 5778 5778
Branches 1528 1527 -1
==========================================
- Hits 5475 5473 -2
- Misses 295 297 +2
Partials 8 8
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
This was referenced Apr 18, 2026
dubzzz
added a commit
that referenced
this pull request
Apr 18, 2026
## Description Configure Renovate so it stops opening PRs that change the `pnpm.overrides` entries in the root `package.json`. These overrides are intentionally pinned via tilde ranges (see #6888) so that patch-level updates flow naturally through `pnpm-lock.yaml` (already covered by `lockFileMaintenance`), without rewriting the constraint string in `package.json` on every patch release. Renovate currently still opens PRs (e.g. #6884) to bump those override constraints — this change disables that behavior. The new `packageRule` matches the `pnpm.overrides` `depType` on the root `package.json` and disables updates for it. Lockfile maintenance keeps picking up resolvable patch versions automatically. ## Checklist — _Don't delete this checklist and make sure you do the following before opening the PR_ - [x] I have a full understanding of every line in this PR — whether the code was hand-written, AI-generated, copied from external sources or produced by any other tool - [ ] I flagged the impact of my change (minor / patch / major) either by running `pnpm run bump` or by following the instructions from the changeset bot - [x] I kept this PR focused on a single concern and did not bundle unrelated changes - [x] I followed the [gitmoji](https://gitmoji.dev/) specification for the name of the PR, including the package scope (e.g. `🐛(vitest) Something...`) when the change targets a package other than `fast-check` - [ ] I added relevant tests and they would have failed without my PR (when applicable) Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> Co-authored-by: Nicolas DUBIEN <[email protected]>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Updates pnpm dependency overrides to use tilde (
~) version ranges instead of exact versions for security-related packages. This allows patch-level updates while maintaining the minimum security threshold for:tmp@~0.2.4serialize-javascript@~7.0.5follow-redirects@~1.16.0lodash-es@~4.18.0dompurify@~3.4.0This change enables automatic patch updates for these critical security dependencies while preventing unintended minor or major version bumps that could introduce breaking changes.
Checklist
pnpm run bumpor by following the instructions from the changeset bothttps://claude.ai/code/session_01EoNkHTqq5eiJyDnwSGmmMQ