Fail CI when a pnpm.overrides pin is declared but never applied - #3017
Merged
Conversation
pnpm install --frozen-lockfile only checks that the lockfile matches the manifest. It will not catch a security override whose selector never rewrote the resolved graph.
Keep it as its own job so it does not wait on the frontend install and build.
gyanu2507
requested review from
asvishnyakov,
hayescode and
sandangel
as code owners
August 22, 2026 17:43
dosubot
Bot
added
size:L
![cubic-dev-ai[bot]](https://cdn.statically.io/img/avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
All reported issues were addressed across 3 files
Reply with feedback, questions, or to request a fix.
Re-trigger cubic
Contributor
There was a problem hiding this comment.
All reported issues were addressed across 1 file (changes from recent commits).
Reply with feedback, questions, or to request a fix.
Re-trigger cubic
It was recorded in the lockfile but @babel/core@7.29.0 stayed resolved as a peer of cypress-split, so the new overrides gate failed after merging main. Unscoped and version-scoped pins both left that version in place; dropping the dead pin is the honest fix.
dokterbob
enabled auto-merge
August 26, 2026 08:45
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
pnpm install --frozen-lockfileonly checks that the lockfile agrees with the manifest. It does not check that apnpm.overridespin actually rewrote the resolved graph, which is how a security override can merge while the vulnerable version is still installed.scripts/check-pnpm-overrides.mjsreadspnpm.overridesfrom the workspace package.json files and fails if a resolved version is still inside the override selector range, or if it does not satisfy the override target. It runs as its own CI job so it does not need the frontend install.Locally:
pnpm check-overridesornode scripts/check-pnpm-overrides.mjs.Fixes #3000
Summary by cubic
Fail CI when a
pnpm.overridespin is declared but not applied. Previously CI only checked lockfile-manifest consistency and misread>; now a dedicated job verifies overrides rewrite resolved dependencies, treats>,>=,<,<=,=as version comparators, and rejects parent-scoped selectors (including digit-leading children).scripts/check-pnpm-overrides.mjsto ensure each override is recorded in the lockfile, resolved versions satisfy the target, and no versions remain in the selector range; reject parent-scoped selectors likeengine.io-client>wsorfoo>123in favor of package selectors (e.g.,ws@>=8.21.0).check-overridesnpm script for local runs.Written for commit c02aa67. Summary will update on new commits.