Repository navigation
v2/main is running vulnerable dependency versions already fixed on main #2057
Description
v2/main is running the vulnerable dependency versions that were fixed on main weeks ago.
Dependabot security updates always target the default branch (main) — target-branch in .github/dependabot.yml scopes version updates only and is documented as not applying to security updates. Our version-update entries do correctly target v2/main (#1976, #1921–#1927), but every security PR has landed on main: #1833, #1840, #1913, #1925, #2004.
Because main only ever receives milestone merges and is never merged back into v2/main, those fixes have no path to the develop branch. So v2/main — where all development happens and where every contributor's npm install runs — still resolves the vulnerable versions, and Dependabot will not re-raise them because they are already fixed on the branch it watches.
The drift
Measured as git diff origin/v2/main <merge-of-main-and-v2/main>, main's unique content is exactly six dependency files and nothing else — no source, CI, or docs gap.
Root package-lock.json:
| Package | v2/main |
main |
|---|---|---|
| body-parser | 2.2.2 | 2.3.0 |
| es-object-atoms | 1.1.1 | 1.1.2 |
| express-rate-limit | 8.3.2 | 8.6.2 |
| fast-uri | 3.1.0 | 3.1.5 |
| hasown | 2.0.2 | 2.0.4 |
| hono | 4.12.25 | 4.13.1 |
| ip-address | 10.1.0 | 10.5.0 |
| qs | 6.15.1 | 6.15.3 |
| side-channel | 1.1.0 | 1.1.1 |
| type-is | 2.0.1 | 2.1.0 |
| undici | 8.5.0 | 8.9.0 |
Per-client: clients/web hono 4.12.33 → 4.13.1; clients/cli undici 8.5.0 → 8.9.0 and fast-uri 3.1.2 → 3.1.5; clients/tui fast-uri 3.1.2 → 3.1.5. clients/launcher is identical.
Two direct declarations move with them: clients/cli undici ^8.5.0 → ^8.9.0, and clients/web hono ^4.12.18 → ^4.13.1.
Scope
Apply those six files to v2/main so the two branches are content-identical on dependencies, then npm run ci.
Keeping them identical is worth more than the one-time fix: a Dependabot PR opened against main can then be retargeted to v2/main with a clean, minimal diff, because merge-base(v2/main, <branch cut from main>) is v2/main's own tip and the branches carry no other divergence. While they differ, retargeting drags every main-only commit into the diff instead.
Follow-up (not this issue)
Getting Dependabot to open against v2/main in the first place needs one of: retargeting each security PR, a workflow that retargets them on open, a scheduled npm audit fix --package-lock-only PR against v2/main, or making v2/main the default branch — which is currently blocked by the org-level ~DEFAULT_BRANCH ruleset (see discussion).
Activity