From 7d5e9678e1421347addd93588d2946224b2b41a8 Mon Sep 17 00:00:00 2001 From: Don Petry <36422719+don-petry@users.noreply.github.com> Date: Wed, 4 Nov 2026 15:23:41 -0600 Subject: [PATCH] fix(deps): suppress unfixable deepmerge advisory in pnpm audit pnpm audit on main fails on GHSA-gcqx-w48m-w2h4 (deepmerge 4.2.0-4.3.1, low). No patched deepmerge is published (4.3.1 is latest), so no upgrade or override can clear it. It reaches the lockfile only via @expo/config (SDK 55) and jest-config 29, which merge developer-controlled config at build/test time. Ignore it with a re-evaluation trigger, matching the existing image-size/braces/zod entries. The minimatch advisory (GHSA-g3hv-75wg-m249) in the same run no longer matches: its range is now >=7.0.0 <11.0.1, and the lockfile resolves only minimatch 3.1.5 and 11.0.4. Co-Authored-By: Claude Opus 5.5 --- pnpm-workspace.yaml | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index fc707549..87a5c5c2 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -41,9 +41,19 @@ overrides: # zod < 4.6.6 has a DoS advisory on oversized constrained collections. # @expo/cli depends on zod v3 (^3.23.8) and there is no v3 patch (fix is >= 4.6.6). # Suppressed until @expo/cli migrates to zod v4 or a v3 backport is published. +# +# deepmerge 4.2.0-4.3.1 has a low-severity prototype-poisoning advisory +# (GHSA-gcqx-w48m-w2h4). No patched version is on npm (4.3.1 is the latest), +# so neither an upgrade nor an override can fix it. It reaches us through +# @expo/config (SDK 55) and jest-config 29, which merge developer-controlled +# app and jest config at build/test time, not runtime input. +# Suppressed until deepmerge 4.3.2+ is published or Expo/Jest drop it +# (@expo/config 58 already has). +# Re-evaluate when: `npm view deepmerge version` shows >= 4.3.2 audit: ignore: - GHSA-w3rx-r6r6-pgpr - GHSA-5p2g-fcmc-qvqq - GHSA-vfj7-8cjw-p6xm - GHSA-mrhx-c7xc-m3w5 + - GHSA-gcqx-w48m-w2h4