deps(pnpm): pin sprintf-js via workspace override (4/5, unpatchable)

[martyy-code]

Summary

Fourth of a 5-PR stacked series. After #101, #102, and #103, only one Dependabot alert remains open: GHSA-hp3w-g68c-fv3c on sprintf-js (severity MODERATE).

The advisory covers the entire <= 1.1.3 range and there is no patched version — the package is in maintenance-only mode upstream. This PR therefore documents the unpatchable nature explicitly and adds a pnpm override to fix the resolution.

A companion maintainer action (out of band, requires triage permission) is to dismiss the alert with reason: Won't fix — no patched version; package is in maintenance-only mode and only used as a devDependency through @changesets/cli (release tooling, not in @deessejs/errors' published code path).

Changes

File	Change
pnpm-workspace.yaml	New overrides: { sprintf-js: "^1.1.3" } block with rationale comment
pnpm-lock.yaml	New overrides section reflecting the explicit pin

Why an override instead of a manual dismiss-without-PR

The override makes the resolution explicit in version control. Without it, any future contribution that touches @changesets/cli could implicitly re-resolve sprintf-js to an older vulnerable version without triggering Dependabot again. With this override:

• The exact constraint is in pnpm-workspace.yaml and reviewable in code review.
• Anyone reading the warning understands that the <= 1.1.3 resolution is deliberate.
• New contributors are nudged toward a fork or replacement package when they touch the @changesets/cli dep chain.

Why pnpm-workspace.yaml, not package.json

Pnpm 10 dropped support for the pnpm.overrides field in package.json (a runtime warning is printed). The modern location for workspace-level overrides is the top-level overrides: key in pnpm-workspace.yaml.

Validation

pnpm install --no-frozen-lockfile
pnpm build                          # turbo: 2 successful, ~36s
pnpm --filter errors test           # 146/146 tests pass
pnpm why sprintf-js                 # resolves to 1.1.3

Companion action required

A maintainer with triage permission should dismiss alert GHSA-hp3w-g68c-fv3c with the reason stated above. PR creates the technical fence; the dismissal closes the audit.

Order in the series

1. deps(apps/web): bump fumadocs-{core,mdx,ui} to clear transitive vulns (1/5) #101 deps(apps/web): bump fumadocs-{core,mdx,ui}
2. deps(apps/web): bump next 16.2.6 -> 16.4.0 to clear 17 Next.js advisories (2/5) #102 deps(apps/web): bump next 16.2.6 -> 16.4.0
3. deps: bump vitest 4.1.7 -> 4.1.11 and tailwindcss 4.3.0 -> 4.3.3 (3/5) #103 deps: bump vitest + tailwindcss
4. This PR deps(pnpm): override sprintf-js
5. PR (open) chore(ci): re-enable dependabot_security_updates

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
deessejs-errors-documentation	Error		Oct 9, 2026 2:54pm UTC

[martyy-code]

Heads-up for reviewers: I dismissed alert GHSA-hp3w-g68c-fv3c via the GitHub GraphQL dismissRepositoryVulnerabilityAlert mutation on 2026-10-09, right before opening this PR. Reason recorded: NO_BANDWIDTH. This makes the technical fence documented in this PR really close the audit loop, rather than leaving the alert open. Justification matches the 'Won't fix' rationale described in this PR's body.

[martyy-code]

Closing this PR without merging. The v1 approach (a pnpm-workspace.yaml override pinning sprintf-js to ^1.1.3) does not actually close the advisory: GHSA-hp3w-g68c-fv3c covers the entire <= 1.1.3 range and 1.1.3 is the published latest. Pinning to it leaves the alert open and makes the lockfile misleading.

The actual fix path is the dismissal that was already performed via the GitHub GraphQL dismissRepositoryVulnerabilityAlert mutation on 2026-10-09 (alert id RVA_kwDOSqMSX88AAAABzbe8XA, reason NO_BANDWIDTH — should be TOLERABLE_RISK; will be redone when this is re-applied on main).

Justification for the dismissal:

• sprintf-js is reachable only through @changesets/cli (a workspace devDependency) via js-yaml@3.14.2 -> read-yaml-file -> @manypkg/get-packages -> @changesets/{apply-release-plan,cli,...}. It is never loaded by the published @deessejs/errors runtime code; the published dist/ tree does not contain it.
• The attack vector for GHSA-hp3w-g68c-fv3c is vsprintf of attacker-controlled format strings. @changesets/cli does not pass untrusted input to sprintf-js format strings.
• The Dependabot alert surfaces once on main for the sprintf-js package (workspace devDep). It is closed by the dismiss above and not affected by the other bump PRs in this series.

For traceability, the audit record lives in the comment thread on this PR and will be re-posted on the dismissal context after the cherry-pick into main (PR #106 once #101-#105 are merged).