Repository navigation
chore(deps): remediate the three critical npm advisories blocking every pull request - #1228
antoinetoussaint-byte wants to merge 1 commit into
Conversation
…ll request The job remediated correctly and force-pushed its branch, then died on `gh pr create` with "GitHub Actions is not permitted to create or approve pull requests". Because that call aborted the step, the `gh workflow run` line after it never ran, so the pushed head got no CI either, and no pull request existed to make the remediation visible. Six consecutive daily runs failed that way while three critical advisories sat remediated on the branch; the pull request had to be opened by hand (#1228). Adopt the DEPS_COMBINE_TOKEN that combine-deps.yml already documents for this exact constraint, falling back to GITHUB_TOKEN so the remediation half keeps working without it. A create that cannot succeed now records its status instead of aborting, prints what a maintainer must do, and lets the CI dispatch run before the step exits non-zero. The failure is deliberate, and the obvious alternative is wrong: by then the working tree holds the remediated lockfiles, so a passing step would let the residual audit gate report a clean audit and take the whole run green with an advisory on a branch nobody is looking at. The release-gate contract test pins the dispatch to run after a new or updated pull request and the dispatch's status to propagate; both still hold. It gains the token dimension it never had — the one this failure lived in — asserting that a refused create still pushes, still dispatches, still fails, and names DEPS_COMBINE_TOKEN as the remedy. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
lukazhupa
left a comment
lukazhupa
left a comment
There was a problem hiding this comment.
Approving. This clears the critical npm audit findings that fail the required supply-chain and release-gate checks on main. Verified locally at 4076d52: both production audits report 0 at high, and the frontend typecheck and build pass.
|
Closing: superseded, and by a better fix than this one. #1027 landed while this sat in the merge queue and carried the lockfile updates itself — That also made this pull request What was real: The branch is left in place; the daily job force-pushes it and will now exit early at |
Pull request was closed
This is the
Dependency audit auto-remediationworkflow's own output, opened by handbecause the workflow cannot open it itself.
What it changes
Two lockfiles, nothing else — no
package.json, no declared range, no major bump.Every new version already satisfied the range that was declared:
next(frontend + marketing)^16.2.12, unchangeddompurify(transitive, viaswagger-ui-react)^3.4.13, unchanged@sentry/nextjs^10.50.0, unchangedWhy it is urgent
Enforce first-party vulnerability gatefails on every open pull request in thisrepository, so nothing can merge. It fails on three critical advisories:
next16.0.0–16.4.0 — GHSA-2464-fhr4-w9xw(unauthenticated RCE in the Image Optimization API with SVG),
GHSA-673q-mjm6-r5xr
(unauthenticated RCE in
use cachereturning typed arrays),GHSA-p3m5-59mp-jv5r (DoS in App Router Server Actions)
dompurify<=3.4.16 — GHSA-cg2g-xh64-v4q7,GHSA-mrv2-3pqr-j5jr,
GHSA-c6gr-qvv4-5v3f
@sentry/nextjs<=10.75.1 — GHSA-mchm-gjx6-7h55(middleware bypass via the tunnel route)
Why the automation could not open it
.github/workflows/dep-audit.ymlruns daily, and it has failed every day since atleast 18 October — six consecutive runs. It is not failing at the audit: it
remediates correctly, passes
module/tools/module-verify.mjs, and force-pushes thisbranch. It dies on the next line:
.github/workflows/combine-deps.ymlalready documents this exact constraint and solvesit with a
DEPS_COMBINE_TOKENorg secret — but that secret is not set, socombine-deps.ymlhas failed every week since at least 21 September for the samereason.
dep-audit.ymlnever adopted the token at all; it still passessecrets.GITHUB_TOKEN.Two consequences worth separating:
gh pr list --head, so while this stays open the run skips create and reaches itsresidual-audit gate. That is a side effect, not a fix.
reposcope), after whichdep-audit.ymlshould use it the waycombine-deps.ymldoes — and its
gh workflow run ci.ymlworkaround can go, because a pull requestopened by a token triggers CI normally. Not done here; this pull request carries
only the bot's lockfile commit, because the branch is force-pushed daily and any
commit added on top would be clobbered by tomorrow's run.
Verified
npm audit --package-lock-only --omit=dev --audit-level=highon bothmodule/services/frontend/codeandmodule/services/marketing/codeat this head:found 0 vulnerabilities(both were critical before).main(55563cda2), zero commits behind, and its wholediff against
mainis the two lockfiles: 237 insertions, 255 deletions.module/tools/module-verify.mjspassed in the workflow run that produced the commit(
✓ frontend workspace install graph is in sync; no unsupported public claim.).Not verified: the build and the test suite have never run on this branch — the step
that would have triggered CI is the one that died, so this head has no CI history at
all. A 16.3.8 → 16.4.2 minor bump is where to look if anything reds.
🤖 Generated with Claude Code