From cb53a43422c2fc6a628757a6205528da5c130199 Mon Sep 17 00:00:00 2001 From: le king fu Date: Mon, 5 Oct 2026 19:34:25 -0400 Subject: [PATCH] fix(security): scope http-cache-semantics floor to major 4 Review follow-up on #131: a blanket override would force any future 5.x consumer down to 4.x. The version-scoped key keeps the floor within the current major, like postcss-selector-parser. No lockfile change. Refs #128 Co-Authored-By: Claude Opus 5.5 --- package.json | 2 +- tests/smoke.test.cjs | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/package.json b/package.json index f32e54a..afae8f0 100644 --- a/package.json +++ b/package.json @@ -72,7 +72,7 @@ "uuid": "^11.1.1", "postcss": "^8.5.18", "postcss-selector-parser@^6.0.0": "^6.1.3", - "http-cache-semantics": "^4.3.0", + "http-cache-semantics@^4.0.0": "^4.3.0", "js-yaml@^3.0.0": "^3.15.2", "js-yaml@^4.0.0": "^4.3.2", "brace-expansion@^1.0.0": "^1.1.21", diff --git a/tests/smoke.test.cjs b/tests/smoke.test.cjs index e9ae2cc..78cfb23 100644 --- a/tests/smoke.test.cjs +++ b/tests/smoke.test.cjs @@ -307,7 +307,7 @@ check('every installed undici copy is >= 6.28.1', () => { }); // --- Override floors (#128, #129) --- -// http-cache-semantics: blanket floor, a single copy (@expo/ngrok > got). +// http-cache-semantics: version-scoped to major 4, a single copy (@expo/ngrok > got). // postcss-selector-parser: version-scoped to major 6 (tailwindcss@3 pipeline); // any other major is unexpected and must fail loudly.