From c55d12f9be7b1f791ea30c73137f24c9931a3255 Mon Sep 17 00:00:00 2001 From: Sag Date: Wed, 11 Nov 2026 13:00:28 +0100 Subject: [PATCH] Removed the Fedify dependency overrides ref https://github.com/TryGhost/ActivityPub/security/dependabot/197 ref https://github.com/TryGhost/ActivityPub/security/dependabot/195 The overrides added in #2416 cost more to maintain than the alerts they cleared. Renovate treats each override value as a range to raise, and it has already widened the srvx cap once (#2418) and proposed moving Fedify onto srvx 1.x and @opentelemetry/sdk-metrics 3.x (#2420, #2419). Each of those puts Fedify on versions it doesn't support, in code CI doesn't exercise. Neither vulnerable path runs in our service, so going back to the versions Fedify asks for doesn't expose anyone: - @opentelemetry/core 2.7.1 is only used inside sdk-metrics. Nothing registers its W3C baggage propagator; Sentry installs its own. - srvx only comes in through @fedify/cli, a dev dependency that isn't in the production image. The alerts will be dismissed as not applicable, and the pins go away when Fedify updates its dependencies. --- pnpm-lock.yaml | 47 +++++++++++++++++++++++++++++++-------------- pnpm-workspace.yaml | 12 ------------ 2 files changed, 33 insertions(+), 26 deletions(-) diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index f53cbc07..fb34ea06 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -162,10 +162,6 @@ settings: autoInstallPeers: true excludeLinksFromLockfile: false -overrides: - '@opentelemetry/sdk-metrics@<2.8.0': ^2.12.0 - srvx@<0.11.13: '>=0.11.13 <0.12.9' - importers: .: @@ -1273,6 +1269,12 @@ packages: peerDependencies: '@opentelemetry/api': '>=1.0.0 <1.10.0' + '@opentelemetry/core@2.7.1': + resolution: {integrity: sha512-QAqIj32AtK6+pEVNG7EOVxHdE06RP+FM5qpiEJ4RtDcFIqKUZHYhl7/7UY5efhwmwNAg7j8QbJVBLxMerc0+gw==} + engines: {node: ^18.19.0 || >=20.6.0} + peerDependencies: + '@opentelemetry/api': '>=1.0.0 <1.10.0' + '@opentelemetry/core@3.1.0': resolution: {integrity: sha512-TS/6jqU5gilzjvjGnsTEKVFF/0MMAtBc2psxaX39IGCBYLat83/iHxYBWn+O6WB+pnyB0SwiH46rvTEp/OeYxA==} engines: {node: '>=22.15.0'} @@ -1285,8 +1287,14 @@ packages: peerDependencies: '@opentelemetry/api': '>=1.3.0 <1.10.0' - '@opentelemetry/sdk-metrics@2.12.0': - resolution: {integrity: sha512-mVMaEHwCUJuY3S4Esn+nT0yQA3qCEGh+SOPJsXygU0Gl453WcsDNjtEa8EfdewMwoLyr1tlofB4fXytVpiXuow==} + '@opentelemetry/resources@2.7.1': + resolution: {integrity: sha512-DeT6KKolmC4e/dRQvMQ/RwlnzhaqeiFOXY5ngoOPJ07GgVVKxZOg9EcrNZb5aTzUn+iCrJldAgOfQm1O/QfPAQ==} + engines: {node: ^18.19.0 || >=20.6.0} + peerDependencies: + '@opentelemetry/api': '>=1.3.0 <1.10.0' + + '@opentelemetry/sdk-metrics@2.7.1': + resolution: {integrity: sha512-MpDJdkiFDs3Pm1RHO3KByuZbuBdJEXEAkiC0+yJdsZGVCdf1RpHR6n+LHDcS7ffmfrt5kVCzJSCfm4z2C7v0uQ==} engines: {node: ^18.19.0 || >=20.6.0} peerDependencies: '@opentelemetry/api': '>=1.9.0 <1.10.0' @@ -3317,8 +3325,8 @@ packages: resolution: {integrity: sha512-6CKD38c31SENivxOADeMNLdukOnUxUcflKtzVWzace7Riv1v7cAEym5Cx9Q7gYZ3ezIJI7ZpqecQq8cqNeSSFg==} engines: {bun: '>=1.0.0', deno: '>=2.0.0', node: '>=12.0.0'} - srvx@0.11.21: - resolution: {integrity: sha512-GWTHjKMeekX8CwJf4VU9Oo6mJpSGaflGMddbCvR+Cmmh9sslRMiGbAoqqZacE0r1ncARh6buCEETr2W52F8b1w==} + srvx@0.8.16: + resolution: {integrity: sha512-hmcGW4CgroeSmzgF1Ihwgl+Ths0JqAJ7HwjP2X7e3JzY7u4IydLMcdnlqGQiQGUswz+PO9oh/KtCpOISIvs9QQ==} engines: {node: '>=20.16.0'} hasBin: true @@ -4114,7 +4122,7 @@ snapshots: pngjs: 7.0.0 shiki: 1.29.2 smol-toml: 1.9.1 - srvx: 0.11.21 + srvx: 0.8.16 temporal-polyfill: 1.0.8 valibot: 1.5.0(typescript@7.0.2) yaml: 2.9.1 @@ -4133,7 +4141,7 @@ snapshots: '@logtape/logtape': 2.4.2 '@opentelemetry/api': 1.9.1 '@opentelemetry/core': 2.12.0(@opentelemetry/api@1.9.1) - '@opentelemetry/sdk-metrics': 2.12.0(@opentelemetry/api@1.9.1) + '@opentelemetry/sdk-metrics': 2.7.1(@opentelemetry/api@1.9.1) '@opentelemetry/sdk-trace-base': 2.12.0(@opentelemetry/api@1.9.1) '@opentelemetry/semantic-conventions': 1.45.0 '@standard-schema/spec': 1.1.0 @@ -4890,6 +4898,11 @@ snapshots: '@opentelemetry/api': 1.9.1 '@opentelemetry/semantic-conventions': 1.45.0 + '@opentelemetry/core@2.7.1(@opentelemetry/api@1.9.1)': + dependencies: + '@opentelemetry/api': 1.9.1 + '@opentelemetry/semantic-conventions': 1.45.0 + '@opentelemetry/core@3.1.0(@opentelemetry/api@1.10.0)': dependencies: '@opentelemetry/api': 1.10.0 @@ -4901,11 +4914,17 @@ snapshots: '@opentelemetry/core': 2.12.0(@opentelemetry/api@1.9.1) '@opentelemetry/semantic-conventions': 1.45.0 - '@opentelemetry/sdk-metrics@2.12.0(@opentelemetry/api@1.9.1)': + '@opentelemetry/resources@2.7.1(@opentelemetry/api@1.9.1)': dependencies: '@opentelemetry/api': 1.9.1 - '@opentelemetry/core': 2.12.0(@opentelemetry/api@1.9.1) - '@opentelemetry/resources': 2.12.0(@opentelemetry/api@1.9.1) + '@opentelemetry/core': 2.7.1(@opentelemetry/api@1.9.1) + '@opentelemetry/semantic-conventions': 1.45.0 + + '@opentelemetry/sdk-metrics@2.7.1(@opentelemetry/api@1.9.1)': + dependencies: + '@opentelemetry/api': 1.9.1 + '@opentelemetry/core': 2.7.1(@opentelemetry/api@1.9.1) + '@opentelemetry/resources': 2.7.1(@opentelemetry/api@1.9.1) '@opentelemetry/sdk-trace-base@2.12.0(@opentelemetry/api@1.9.1)': dependencies: @@ -6812,7 +6831,7 @@ snapshots: sql-escaper@1.5.2: {} - srvx@0.11.21: {} + srvx@0.8.16: {} stackframe@1.3.4: {} diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index 9dc07125..e2367073 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -9,15 +9,3 @@ allowBuilds: # 24h check. Fedify updates are reviewed by a human before merge. minimumReleaseAgeExclude: - '@fedify/*' - -# Fedify 2.4.5 pins transitive dependencies to outdated versions. Each selector -# matches only the outdated range, so it stops applying once Fedify moves past -# it and can then be removed. -# - @opentelemetry/sdk-metrics 2.7.1 pins @opentelemetry/core 2.7.1. -# - @fedify/cli depends on srvx ^0.8.7, which can't reach 0.11.x. -# Capped below 0.11.22, which stops trusting X-Forwarded-Proto unless the -# server opts in with `trustProxy`. The CLI doesn't, so its tunnelled -# temporary server would advertise http:// actor URLs instead of https://. -overrides: - '@opentelemetry/sdk-metrics@<2.8.0': ^2.12.0 - 'srvx@<0.11.13': '>=0.11.13 <0.12.9'