From b8ada7d5cfcde0598cf1d96d0ba7048a20e88fbc Mon Sep 17 00:00:00 2001 From: april418 Date: Mon, 19 Oct 2026 21:03:03 +0900 Subject: [PATCH 1/2] =?UTF-8?q?chore(deps):=20pnpm=20=E3=82=92=2011.28.5?= =?UTF-8?q?=20=E3=81=AB=E6=9B=B4=E6=96=B0=E3=81=99=E3=82=8B?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit pnpm 11.9.0 は GHSA-vx52-2968-3vc6 / GHSA-c59q-g84q-2gj5 / GHSA-vq4v-j7r6-jq4m（いずれも high、11.11.0 で修正）に該当する。 pnpm 本体は依存ではないので pnpm audit には出ず、CI も手元も 脆弱な版のまま動いていた。 packageManager と pnpm/action-setup の version を、公開から 7 日以上 経った 11.28.5 にそろえる。 lockfile は v9.0 形式のままで再生成は不要。 Co-Authored-By: Claude Opus 5.5 --- .github/workflows/prune-supply-chain.yml | 2 +- .github/workflows/publish-to-artifactregistry.yml | 2 +- .github/workflows/test.yml | 2 +- package.json | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/prune-supply-chain.yml b/.github/workflows/prune-supply-chain.yml index 7a039f3..3dca328 100644 --- a/.github/workflows/prune-supply-chain.yml +++ b/.github/workflows/prune-supply-chain.yml @@ -19,7 +19,7 @@ jobs: - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9 with: - version: 11.9.0 + version: 11.28.5 - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: diff --git a/.github/workflows/publish-to-artifactregistry.yml b/.github/workflows/publish-to-artifactregistry.yml index ed9a1c8..a585c89 100644 --- a/.github/workflows/publish-to-artifactregistry.yml +++ b/.github/workflows/publish-to-artifactregistry.yml @@ -30,7 +30,7 @@ jobs: - name: Setup pnpm uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9 with: - version: 11.9.0 + version: 11.28.5 - name: Use Node.js uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 33e38b7..8a1eb0f 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -16,7 +16,7 @@ jobs: - name: Setup pnpm uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9 with: - version: 11.9.0 + version: 11.28.5 - name: Use Node.js ${{ matrix.node-version }} uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 diff --git a/package.json b/package.json index b9e0d45..ebfd6b6 100644 --- a/package.json +++ b/package.json @@ -70,5 +70,5 @@ "vite": "8.0.16", "vitest": "4.1.11" }, - "packageManager": "pnpm@11.9.0" + "packageManager": "pnpm@11.28.5" } From ef1675a72970ce728ba4204b623fe2bb4b227706 Mon Sep 17 00:00:00 2001 From: april418 Date: Mon, 19 Oct 2026 21:03:47 +0900 Subject: [PATCH 2/2] =?UTF-8?q?chore(deps):=20pnpm=2011=20=E3=81=A7?= =?UTF-8?q?=E5=89=8A=E9=99=A4=E3=81=95=E3=82=8C=E3=81=9F=20packageManagerS?= =?UTF-8?q?trictVersion=20=E3=82=92=E6=B6=88=E3=81=99?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit packageManagerStrictVersion は pnpm 11.0.0 で削除された設定で、 11.9.0 でも効いていなかった。11.23.0 以降は認識しない設定として 実行のたびに WARN が出る。 packageManager と違う版の pnpm 11 を直接起動したときは、既定の pmOnFail: download で packageManager の版へ切り替わるので、行を 消しても挙動は変わらない。移行先の pmOnFail: error は、切り替えずに 止まるよう挙動を変えるため採らない。 Co-Authored-By: Claude Opus 5.5 --- pnpm-workspace.yaml | 1 - 1 file changed, 1 deletion(-) diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index 0ba3c74..70d5f95 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -21,7 +21,6 @@ overrides: 'minimatch@<10.0.0': '>=10.2.4' 'postcss@<8.5.18': '>=8.5.18' 'fast-uri@>=3.0.0 <3.1.4': '>=3.1.4' -packageManagerStrictVersion: true savePrefix: "" trustPolicy: no-downgrade trustPolicyIgnoreAfter: 10080 # 1 week