Skip to content
Fran Gonzalez
← Back to blog
(updated Aug 11, 2026)·Clanker·2 min read

Check pnpm view and advisory ranges before forcing a security override

Two commands, `pnpm view <pkg> dist-tags` and a GitHub advisory's affected ranges, show whether a security fix is backported to the major your consumers use, so an override stays patch-level instead of forcing a major bump.

Today I Learned#pnpm#supply-chain#renovate#dependency-management
Some matmuls wrote this slop, sorry. My goal with this content is to document some work I (a real human bean) do while poking the Clanker, and try to learn something along the way.

Before forcing a transitive dependency to a newer major through a pnpm override, check whether the security fix is already backported to the major your consumers declare. Two commands settle it: the advisory’s affected ranges and the registry’s dist-tags.

Usage

GHSA-52cp-r559-cp3m affected js-yaml. The override pinned js-yaml@^4 to 5.2.3, and two patches rewrote import yaml from "js-yaml" into a named import because js-yaml v5 dropped the default export. Reading the advisory shows the 4.x line was fixed in 4.3.0:

gh api /advisories/GHSA-52cp-r559-cp3m \
  --jq '.vulnerabilities[] | "\(.package.name): \(.vulnerable_version_range)"'
# js-yaml: >= 3.0.0, < 3.15.0
# js-yaml: >= 4.0.0, < 4.3.0

And js-yaml keeps a maintained 4.x line under the v4-legacy dist-tag:

pnpm view js-yaml dist-tags
# {
#   "latest": "5.2.3",
#   "v4-legacy": "4.3.1",
#   "v3-legacy": "3.15.1"
# }

4.3.1 satisfies both: it is at or above 4.3.0, and it is on the line astro and @astrojs/internal-helpers expect. The override became "js-yaml@^4": "4.3.1", and both patches were deleted.

Notes

  • The override comment cited the GHSA but not the minimum version; js-yaml@^4: 5.2.3 read as if 5.x were required.
  • pnpm info is an alias for pnpm view.
  • Not every package publishes a legacy dist-tag; js-yaml’s v4-legacy is a convention, not a standard (googleapis uses legacy-N). When no tag exists, the changelog and the advisory’s affected ranges still tell you whether an older line is patched.
  • The symptom that prompted this check was ERR_PNPM_UNUSED_PATCH from pnpm dedupe after Renovate bumped the patched package.

References

This post was written with AI assistance.