Skip to content

Conversation

CalebGerman
Copy link
Collaborator

Summary

Added pnpm overrides to prevent installation of known malicious versions of eslint-plugin-prettier and eslint-config-prettier packages.

Changes

  • Added eslint-plugin-prettier: ">=5.5.3" override to ensure minimum safe version
  • Added eslint-config-prettier: ">=10.1.8" override to ensure minimum safe version

Security Context

Recent security advisories identified malicious code in specific versions of these packages:

  • eslint-config-prettier: 8.10.1, 9.1.1, 10.1.6, 10.1.7
  • eslint-plugin-prettier: 4.2.2, 4.2.3 (plus transitive dependencies synckit@0.11.9, @pkgr/core@0.2.8)

Impact

  • Prevents any package in the monorepo from installing vulnerable versions
  • Forces resolution to safe versions across all workspace packages
  • No breaking changes expected as overrides specify minimum versions beyond the vulnerable ranges

@CalebGerman CalebGerman requested a review from a team as a code owner July 24, 2025 19:57
@CalebGerman CalebGerman requested a review from diegopinate July 24, 2025 19:57
Copy link

changeset-bot bot commented Jul 24, 2025

🦋 Changeset detected

Latest commit: 5213db7

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 0 packages

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@CalebGerman CalebGerman merged commit 61284a8 into master Jul 24, 2025
4 checks passed
@CalebGerman CalebGerman deleted the cgerman/package_vulnerability_fix branch July 24, 2025 21:16
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants