fix(deps): pin dayjs to 1.11.13 in frontend tree (CI yarn audit)#2059
Merged
Conversation
…transitive subtree dayjs@1.11.16 was published with semantic-release + @semantic-release/* declared as runtime dependencies (legit dayjs has zero runtime deps), pulling in sigstore <=4.1.0 and tripping the yarn audit gate on the new HIGH advisory GHSA-52v5-jr5w-gjxr. The root package.json already pins "dayjs": "1.11.13"; the frontend resolutions block was missing it, so the frontend tree floated to the compromised 1.11.16. Mirror the root pin and regenerate the lockfile, removing the accidental semantic-release/sigstore/npm subtree. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
jmoreira-valory
approved these changes
Jul 2, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
CI
yarn audit (both trees)fails in the frontend tree with a HIGH advisory GHSA-52v5-jr5w-gjxr (sigstore <=4.1.0).Root cause is the dayjs supply-chain compromise:
dayjs@1.11.16was published withsemantic-release+@semantic-release/*declared as runtime dependencies (legitimate dayjs has zero runtime deps). That subtree drags insigstore, tripping the audit gate. This is time-based CI breakage from a newly-published advisory, not caused by any dependency change.The root
package.jsonalready defends against this with a resolution"dayjs": "1.11.13". The frontend resolutions block was missing that pin, so the frontend tree floated up to the compromised1.11.16.Fix
frontend/package.json— add"dayjs": "1.11.13"toresolutions(mirrors root).frontend/yarn.lock— regenerate: dayjs pinned to1.11.13, entire accidentalsemantic-release/sigstore/npmsubtree removed.Verification (local, frontend tree)
yarn audit:prod→ OK (0 allowlisted, no unlisted high/critical)yarn deps:check-pinned→ all specifiers exact-pinnedregistry.npmjs.org(lockfile-lint clean)No source changes — pure lockfile/security fix.
🤖 Generated with Claude Code