fix(deps): pin critical native dependencies to exact versions#975
Open
xiaolai wants to merge 1 commit intostablyai:mainfrom
Open
fix(deps): pin critical native dependencies to exact versions#975xiaolai wants to merge 1 commit intostablyai:mainfrom
xiaolai wants to merge 1 commit intostablyai:mainfrom
Conversation
node-pty, @parcel/watcher, and electron are native modules that are rebuilt for a specific Electron ABI at install time (listed under pnpm.onlyBuiltDependencies). Using ^ constraints allows pnpm to silently pull in minor and patch upgrades that may ship a different native binary or introduce a vulnerable version before a lock-file refresh catches it. Pinning to exact versions makes the installed tree fully reproducible and reduces the supply-chain attack surface for the packages most likely to execute compiled code. Co-Authored-By: Claude Code <noreply@anthropic.com>
This was referenced Apr 23, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Security Fix (Low severity)
node-pty,@parcel/watcher, andelectronare native modules that are compiled for a specific Electron ABI at install time (they appear inpnpm.onlyBuiltDependencies). All three currently use^semver constraints, which allowspnpm installto silently pull in any compatible minor or patch release.Impact: An unexpected minor or patch bump for a native dependency can:
node-ptyin particular already has a patch file (patches/node-pty@1.1.0.patch) that targets exactly1.1.0— a^constraint could pull in1.2.0and silently skip that patch.Fix
Pin
node-pty,@parcel/watcher, andelectronto their current exact versions. Other dependencies are left as-is; this targets only the native packages where ABI stability and patch integrity matter most.Note: after merging, regenerate
pnpm-lock.yamlwithpnpm installto reflect the updated constraints.