chore(deps): resolve Dependabot security alerts via pnpm overrides

[intech]

What

Raise pnpm override floors to close open Dependabot security advisories. Supersedes #118 (which only raised protobufjs to 7.5.6 — below the required 7.5.8 — and had a stale lockfile).

Package	Floor	Path	Severity
protobufjs	<7.5.5 → 7.5.8	runtime (@grpc/grpc-js → @grpc/proto-loader)	—
@grpc/grpc-js	<1.14.4 → 1.14.4	runtime (OTLP/gRPC exporters)	high
fast-uri	<3.1.2 → 3.1.2	dev-only (ajv → @commitlint)	high
qs	<6.15.2 → 6.15.2	dev-only (@exodus/test)	medium

Not in this PR (by design)

• protobufjs@8.x (via @opentelemetry/otlp-transformer) — resolved separately by upgrading OpenTelemetry to 0.219.0 (its transformer dropped protobufjs in 0.218), not by an override.
• esbuild advisory — deferred. esbuild@0.28.x is incompatible with the current tsup (esbuild ^0.25, no tsup release supports 0.28.x), and esbuild is a build-time tool that does not ship in the compiled dist.

Verification

Applied floors confirmed in the tree: protobufjs@7.5.8, @grpc/grpc-js@1.14.4, fast-uri@3.1.2, qs@6.15.2.

Local: build 16/16 ✅, typecheck ✅, otel/core/interceptors tests ✅, lint ✅.

Summary by CodeRabbit

Release Notes

• Security
  • Resolved critical and high-severity vulnerabilities across multiple dependencies to enhance application stability and security.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 51ac3c66-c11a-4130-ba3e-2a03f7a2afbf

📥 Commits

Reviewing files that changed from the base of the PR and between 2ea8170 and eaba5ee.

⛔ Files ignored due to path filters (1)

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (2)

• .changeset/security-overrides.md
• pnpm-workspace.yaml

---

📝 Walkthrough

Walkthrough

This PR introduces pnpm dependency overrides to mitigate critical and high-severity CVEs in transitive dependencies. A security changeset documents the override strategy, including rationale for version floor changes, dev-only constraints, and deferred advisories. The pnpm-workspace.yaml configuration implements the overrides for affected packages and updates version constraints.

Changes

Security dependency overrides

Layer / File(s)	Summary
Security overrides configuration and documentation .changeset/security-overrides.md, pnpm-workspace.yaml	Changeset documents pnpm override resolutions for CVEs in basic-ftp, rollup, and minimatch, version floor adjustments for protobufjs and @grpc/grpc-js, dev-only floors for fast-uri and qs, and clarifies why a protobufjs@8.x conflict is handled via OpenTelemetry upgrade and why an esbuild advisory is deferred. pnpm-workspace.yaml applies these overrides, raising protobufjs <7.x minimum to 7.5.8.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Possibly related PRs

• Connectum-Framework/connectum#37: Overlaps in pnpm overrides pins for the same security-fixing transitive deps (basic-ftp, rollup, minimatch) and security changeset.
• Connectum-Framework/connectum#111: Both PRs modify pnpm-workspace.yaml overrides rules for protobufjs and related dependencies.
• Connectum-Framework/connectum#80: Overlaps in pnpm override rules for the transitive dependency chain (rollup, brace-expansion, minimatch, picomatch).

Suggested labels

type:chore, dependencies, priority:high

Poem

🐰 Dependencies once broken, now they're tight,
With pnpm pins we patch each CVE's bite,
From basic-ftp to minimatch's dance,
Security overrides give us a fighting chance! 🛡️

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'chore(deps): resolve Dependabot security alerts via pnpm overrides' accurately and specifically describes the main purpose of the PR, which is to address security vulnerabilities through dependency override configurations.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/security-overrides-2026-06

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[pkg-pr-new]

Open in StackBlitz

@connectum/auth

npm i https://pkg.pr.new/@connectum/auth@145

@connectum/cli

npm i https://pkg.pr.new/@connectum/cli@145

@connectum/core

npm i https://pkg.pr.new/@connectum/core@145

@connectum/events

npm i https://pkg.pr.new/@connectum/events@145

@connectum/events-amqp

npm i https://pkg.pr.new/@connectum/events-amqp@145

@connectum/events-kafka

npm i https://pkg.pr.new/@connectum/events-kafka@145

@connectum/events-nats

npm i https://pkg.pr.new/@connectum/events-nats@145

@connectum/events-redis

npm i https://pkg.pr.new/@connectum/events-redis@145

@connectum/healthcheck

npm i https://pkg.pr.new/@connectum/healthcheck@145

@connectum/interceptors

npm i https://pkg.pr.new/@connectum/interceptors@145

@connectum/otel

npm i https://pkg.pr.new/@connectum/otel@145

@connectum/reflection

npm i https://pkg.pr.new/@connectum/reflection@145

@connectum/testing

npm i https://pkg.pr.new/@connectum/testing@145

commit: eaba5ee