pnpm.overrides: 13 security floors no longer exclude the versions their advisories cover
Thirteen entries in the root pnpm.overrides block sit below the versions their advisories now require, so the floor no longer excludes anything vulnerable. Two are pinned exactly at the affected version.
Same block as #6423, different defect. That issue is about overrides contradicting package declarations. This one is about floors going stale over time. #7102 added the comment that states the intent:
"//": "Next.js overrides keep each supported major on its security floor"
Thirteen other entries no longer do that.
The two clearest cases
"js-yaml": ">=4.1.1", // 4.1.1 is the affected version; needs >=4.3.2
"socket.io-parser": ">=4.2.6", // 4.2.6 is the affected version; needs >=4.2.7Both came in with 868f6b171 (2026-04-12, "fix: deep security vulnerability sweep — 155 → 3 remaining"). They were correct that day. Advisories published since moved the line and the floors did not follow.
Full list
| override | current floor | installed | first non-vulnerable | severity |
|---|---|---|---|---|
tar |
>=7.5.11 |
7.5.13 | 7.5.21 | critical |
js-yaml |
>=4.1.1 |
4.1.1 | 4.3.2 | high |
socket.io-parser |
>=4.2.6 |
4.2.6 | 4.2.7 | high |
hono |
>=4.11.7 |
4.12.15 | 4.13.5 | high |
axios |
>=1.15.0 |
1.15.2 | 1.18.0 | high |
langsmith |
>=0.5.18 |
0.5.25 | 0.6.0 | high |
svgo |
>=3.3.3 |
4.0.1 | 4.1.0 | high |
dompurify |
>=3.3.2 |
3.4.1 | 3.4.13 | medium |
fast-xml-parser |
>=4.5.2 |
5.5.8 | 5.7.0 | medium |
qs |
>=6.14.2 |
6.15.1 | 6.16.0 | medium |
@hono/node-server |
>=1.19.13 |
2.0.0 | 2.0.10 | medium |
body-parser |
>=1.20.3 |
2.2.2 | 2.3.0 | low |
esbuild |
>=0.25.4 |
0.27.3 | 0.28.1 | low |
Measured on 130e9d92e, so after #7089 and #7102 landed.
Effect of refreshing them
116 findings to 99. 17 resolved, none introduced. Four of the seventeen (follow-redirects, @ai-sdk/provider-utils, baseline-browser-mapping, fast-xml-builder) come along in the cascade rather than being targeted directly.
The other 99 are packages with no override entry, which is a much bigger question and not one I am trying to answer here.
Fix options
- Refresh the thirteen floors in place.
- Same, bounded to the installed major (
">=4.3.2 <5"rather than">=4.3.2"). Left unbounded,js-yamlresolves to 5.4.2 and the lockfile churn roughly doubles. My PR takes this option. If the bare>=style is deliberate I can drop the bounds. - Leave them and track the drift another way, if this block is on its way out.
I have option 2 implemented and tested, and will open a PR against this issue shortly. One file plus the regenerated lockfile.
Separately
Three overrides target packages that are not in the resolved tree at all, appearing only in the overrides declaration: @isaacs/brace-expansion, jsondiffpatch, and markdown-it, where only @types/markdown-it is installed. No effect today, but they read as protection that is not there. I left them out of the PR in case they were added deliberately for something optional. I can fold them in if you would rather.
Found with cve-lite-cli, an OWASP project I maintain. I can post the full before and after scans if that is useful.
Source: CopilotKit/CopilotKit