From a9c7a900d8fca9a6ee6f4403d39e1d2ff03b268c Mon Sep 17 00:00:00 2001 From: 1bcMax Date: Wed, 9 Sep 2026 23:27:58 -0400 Subject: [PATCH] fix(desktop): the staged runtime was still shipping axios 0.27.2 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit v0.12.238 pinned axios forward at the root with `"axios": "$axios"`, which is why the root tree carries exactly one copy at 1.19.0. The Desktop staged runtime is a SEPARATE pnpm install with its own overrides block, so none of the root pins reach it, and `@polymarket/builder-relayer-client@0.0.10` has been dragging axios 0.27.2 into it ever since — into the tree electron-builder packages and ships as the app. That is 26 of the repo's 35 open Dependabot alerts, all against apps/desktop/runtime/pnpm-lock.yaml rather than the root lockfile, which is why root-side override work never moved the number. Mirrors the root pin into runtime/pnpm-workspace.yaml and relocks. The relock is surgical — 14 lines: axios 0.27.2 and its follow-redirects / form-data transitives drop out, everything resolves onto the 1.20.0 the tree already carried, and the single @blockrun/clawrouter pin is untouched (runtime-version.test.ts passes). Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_015mUab3xrLHNpYqVHJLgJHL --- apps/desktop/runtime/pnpm-lock.yaml | 14 +++----------- apps/desktop/runtime/pnpm-workspace.yaml | 5 +++++ 2 files changed, 8 insertions(+), 11 deletions(-) diff --git a/apps/desktop/runtime/pnpm-lock.yaml b/apps/desktop/runtime/pnpm-lock.yaml index 0d6ef081..be24fbac 100644 --- a/apps/desktop/runtime/pnpm-lock.yaml +++ b/apps/desktop/runtime/pnpm-lock.yaml @@ -6,6 +6,7 @@ settings: overrides: '@blockrun/clawrouter': 0.12.267 + axios: ^1.19.0 importers: @@ -2955,6 +2956,7 @@ packages: '@smithy/node-http-handler@4.12.0': resolution: {integrity: sha512-0mq1pHadfyXCYCqm2cNpbjNIT+fbaUpNxewZb/YNr2L0IrEVMOb8gM/Fl4K6XvHCW3uSNDFwPl/+iKm0bx9jYg==} engines: {node: '>=18.0.0'} + deprecated: Depreacted due to a memory leak issue https://github.com/smithy-lang/smithy-typescript/issues/2258 '@smithy/node-http-handler@4.7.3': resolution: {integrity: sha512-/jPhevcTFPMVl6KNjbaI47iOg1zxC7IsnX4PQDGVZKMFceOXtB8IEYaB7a9VvkP/3oC60WzTeKocvSI7vLT0vA==} @@ -3506,9 +3508,6 @@ packages: asynckit@0.4.0: resolution: {integrity: sha512-Oei9OH4tRh0YqU3GxhX79dM/mwVgvbZJaSNaRk+bshkj0S5cfHcgYakreBjrHwatXKbz+IoIdYLxrKim2MjW0Q==} - axios@0.27.2: - resolution: {integrity: sha512-t+yRIyySRTp/wua5xEr+z1q60QmLq8ABsS5O9Me1AsE5dfKqgnCFzwiCZZ/cGNd1lq4/7akDWMxdhVlucjmnOQ==} - axios@1.20.0: resolution: {integrity: sha512-r8aOh8j9cGKpgQAqpzrUHnSIc6a59Y3Xf/cv8sy1DrHCkZHzQGEuoq1tARk6qSyDdtQGSDgpb9kFlruzPvrgwg==} @@ -8030,7 +8029,7 @@ snapshots: '@ethersproject/wallet': 5.8.0 '@polymarket/builder-abstract-signer': 0.0.1(zod@4.5.4) '@polymarket/builder-signing-sdk': 0.0.8 - axios: 0.27.2 + axios: 1.20.0 browser-or-node: 3.0.0 ethers: 5.8.0 tsx: 4.23.13 @@ -8760,13 +8759,6 @@ snapshots: asynckit@0.4.0: {} - axios@0.27.2: - dependencies: - follow-redirects: 1.16.0 - form-data: 4.0.6 - transitivePeerDependencies: - - debug - axios@1.20.0: dependencies: follow-redirects: 1.16.0 diff --git a/apps/desktop/runtime/pnpm-workspace.yaml b/apps/desktop/runtime/pnpm-workspace.yaml index cffa00fa..8cf0f223 100644 --- a/apps/desktop/runtime/pnpm-workspace.yaml +++ b/apps/desktop/runtime/pnpm-workspace.yaml @@ -9,5 +9,10 @@ packages: - "." overrides: "@blockrun/clawrouter": 0.12.267 + # Mirrors the root package.json security pins. This runtime is a SEPARATE pnpm + # install that electron-builder packages into the app, so the root `overrides` + # never reach it — @polymarket/builder-relayer-client was still dragging + # axios 0.27.2 in here long after v0.12.238 fixed it at the root. + axios: ^1.19.0 minimumReleaseAgeExclude: - "@blockrun/clawrouter@0.12.267"