fix(deps): stop a stack-exhaustion DoS in deepmerge-ts via override - #120
Merged
Conversation
deepmerge-ts < 8.0.0 exhausts the stack when merging recursive object graphs. It reaches us through @prisma/config, which pins it exactly at 7.1.5, so no Prisma release fixes this - the override is the only route. v8 keeps the dual CJS/ESM exports and still exports the named deepmerge that @prisma/config imports, and prisma generate runs in every CI job, so the swap is exercised before merge.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Dependabot alert #93:
deepmerge-tsbelow 8.0.0 blows the stack when it merges recursive object graphs (GHSA-ggr8-5vv4-36mx, high).It is not a direct dependency. It arrives through
prisma->@prisma/config, which pins it exactly at7.1.5— so waiting for Prisma is not an option, and 7.9.1 (current latest) still pins it. Apackage.jsonoverride is the only way to move it.Fix: override
deepmerge-tsto^8.0.1, which resolves to 8.0.1 in the lockfile (integrity verified against the registry).Why this is safe to force past an exact pin:
@prisma/configuses a single named import,const { deepmerge } = await import("deepmerge-ts"), and v8 still exportsdeepmerge.require->dist/index.cjs) andengines: node >= 16, so nothing about the module format changes for its consumer.npx prisma generate— the only thing that loads@prisma/config— runs in all three CI jobs, so a broken override fails this PR rather than the release build.Blast radius is build-time only. The runtime image is a Next.js standalone bundle;
deepmerge-tsand@prisma/configare not present in the running container at all, so production was never exposed and does not need a redeploy for this.