fix: override deepmerge-ts to 8.0.0 to resolve GHSA-ggr8-5vv4-36mx (DEVX-8520)

[warp-agent-staging]

Summary

Overrides the transitive deepmerge-ts dependency from 7.1.5 to 8.0.0 to resolve GHSA-ggr8-5vv4-36mx / CVE-2026-40345 (DEVX-8520), a high-severity (CVSS v4 8.2) uncontrolled-recursion (CWE-674) DoS: deepmerge()/deepmergeInto() recurse without cycle detection, so merging two objects that both self-reference at the same key path crashes the process with RangeError: Maximum call stack size exceeded.

deepmerge-ts is not a direct dependency here — it's pulled in transitively by @prisma/config@7.9.1 (a dependency of the direct prisma package), which pins it at the exact version 7.1.5. @prisma/config@latest is still 7.9.1 and still pins 7.1.5, so there is no upstream bump to wait for. The vulnerable range is < 8.0.0 with 8.0.0 as the first patched version and no 7.x backport, so an npm overrides pin to 8.0.0 — matching the existing style of this repo's overrides block — is the correct, minimal lever.

8.0.0 is a major version bump. It keeps the same dual CJS/ESM exports and the same engines.node >=16.0.0 as 7.1.5. Its documented breaking changes (Map values deep-merged by default, a couple of renamed/deprecated TypeScript types, and deepmergeInto no longer leak-mutating inputs) do not affect this repo's usage, since deepmerge-ts is only reached indirectly through @prisma/config's internal config-merging logic, not called directly from this codebase.

Changes

• package.json: add "deepmerge-ts": "8.0.0" to the overrides block (exact pin, matching the style of the other entries).
• package-lock.json: updated the single node_modules/deepmerge-ts entry (version, resolved, integrity, funding) to 8.0.0 using npm's own computed values. deepmerge-ts remains transitive/override-only — it was not added to dependencies or devDependencies, and no other package was touched.

Note: a plain npm install/npm install --package-lock-only in this environment also strips the "peer": true flag from ~20 unrelated lockfile entries, even on an unmodified package.json — this reproduces even without this change, so it's an artifact of the local npm version (11.3.0) rather than something caused by this fix. That unrelated churn was reverted; only the deepmerge-ts entry was updated, using the version/resolved/integrity/funding fields npm itself computed for 8.0.0.

Verification

• git diff — confirmed the diff touches only the deepmerge-ts override line in package.json and the single deepmerge-ts entry in package-lock.json.
• npm ci — succeeds cleanly with the regenerated lockfile.
• npm ls deepmerge-ts — resolves to deepmerge-ts@8.0.0 overridden (previously 7.1.5), with no residual 7.1.5 anywhere in the tree.
• npm audit — the deepmerge-ts/GHSA-ggr8-5vv4-36mx finding is gone. Three unrelated pre-existing advisories remain (@hono/node-server path traversal, fast-uri host confusion, nanoid infinite loop via postcss) — out of scope for this change.
• Manual PoC re-check — ran the advisory's exact reproduction (two objects that each self-reference via the same key, merged with deepmerge()) against the installed deepmerge-ts@8.0.0: it no longer throws RangeError: Maximum call stack size exceeded; it returns a merged object preserving the self-reference.
• npx prisma generate — succeeds ("Loaded Prisma config from prisma.config.ts" confirms @prisma/config, the actual consumer of deepmerge-ts, exercised the override successfully).
• npx prisma validate — succeeds ("The schema at prisma/schema.prisma is valid").
• npm run lint — passes (0 errors; 6 pre-existing warnings unrelated to this change).
• npm run build (prisma generate && next build) — production build succeeds.
• Skipped: no automated test suite was run against a live database/auth provider, since that requires credentials not available here.

Co-Authored-By: Warp agent@warp.dev

[warp-agent-staging]

This PR was generated with Warp.

Comment @warp-agent on this PR to send it follow-up work.

 

[warp-agent-staging]

Overview

Forces deepmerge-ts to 8.0.0 through an npm overrides entry to clear GHSA-ggr8-5vv4-36mx, which is only reachable here transitively via @prisma/config. The remediation is correct and minimal; one judgment call is left to a human before merge.

Concerns

• The override forces a major version (7.1.5 -> 8.0.0) onto @prisma/config@7.9.1, which pins deepmerge-ts at the exact version 7.1.5, so this configuration is not one Prisma supports or tests. @prisma/config dynamically imports deepmerge-ts and hands deepmerge to c12 with extend, rcFile, packageJson and giget all disabled, and this repo's Prisma config contains only plain records, strings and arrays — so 8.0.0's two behavioural breaks (Map values now deep-merged by default, deepmergeInto no longer mutating inputs) are not exercised today. Accept the residual risk knowingly, and re-check this override if Prisma config ever gains Map-valued options or @prisma/config changes how it uses the merger.
• package-lock.json was not left exactly as stock npm emitted it: npm 11.3.0 in the authoring environment strips "peer": true from 22 unrelated entries even with an unmodified package.json, so that churn was reverted and only the deepmerge-ts entry was applied. Reproduced independently, and the retained entry's version/resolved/integrity match the published deepmerge-ts@8.0.0 tarball (SHA-512 recomputed from npm pack), with npm ci succeeding from clean — so the lockfile is internally consistent, but a contributor on a different npm version will see that peer-flag churn reappear on their next npm install.

Verdict

Checks: build pass, tests n/a (no suite exercised; dependency-only change), CI green (CodeQL), visual proof n/a

Found: 0 critical, 0 important, 0 suggestions, 0 nits, 2 questions for a human