From a041979a60303ad6ac12d380a283399c9ee4dca5 Mon Sep 17 00:00:00 2001 From: Franz Hemmer Date: Sat, 7 Nov 2026 13:56:11 -0500 Subject: [PATCH 1/2] fix: store the npm audit fixture under non-manifest names The deliberately vulnerable KaTeX 0.18.1 fixture used by scripts/tests/npm-audit.test.cjs raised Dependabot alert 1, because GitHub's dependency graph reads every package.json and package-lock.json in the tree. Store both files with a .fixture suffix and have the test copy them to their real names in its temporary folder, so the audit still sees the vulnerable lock while the graph no longer does. Co-Authored-By: Claude Opus 5.5 --- docs/RUST_DEPENDENCY_SECURITY.md | 14 +++++++++----- ...package-lock.json => package-lock.json.fixture} | 0 .../{package.json => package.json.fixture} | 0 scripts/tests/npm-audit.test.cjs | 4 +++- 4 files changed, 12 insertions(+), 6 deletions(-) rename scripts/fixtures/npm-vulnerable-markdown/{package-lock.json => package-lock.json.fixture} (100%) rename scripts/fixtures/npm-vulnerable-markdown/{package.json => package.json.fixture} (100%) diff --git a/docs/RUST_DEPENDENCY_SECURITY.md b/docs/RUST_DEPENDENCY_SECURITY.md index 0deb23fe..da0fbed3 100644 --- a/docs/RUST_DEPENDENCY_SECURITY.md +++ b/docs/RUST_DEPENDENCY_SECURITY.md @@ -129,12 +129,16 @@ is passed, so read only counts or fields such as `number`, `state` and Two test fixtures contain vulnerable versions on purpose. Do not fix, rewrite or remove them to clear an alert. -- [`scripts/fixtures/npm-vulnerable-markdown/package-lock.json`](../scripts/fixtures/npm-vulnerable-markdown/package-lock.json) - locks KaTeX 0.18.1. It raised [Dependabot alert 1](https://github.com/hemsoft-dev/codexbar/security/dependabot/1), - low-severity GHSA-238p-pmpm-9mq7, with development scope. +- [`scripts/fixtures/npm-vulnerable-markdown/package-lock.json.fixture`](../scripts/fixtures/npm-vulnerable-markdown/package-lock.json.fixture) + locks KaTeX 0.18.1 (low-severity GHSA-238p-pmpm-9mq7). [`scripts/tests/npm-audit.test.cjs`](../scripts/tests/npm-audit.test.cjs) - requires that advisory and a failing audit. The alert does not involve the - root `package-lock.json` or the shipped app. It was left open, not dismissed. + copies it and `package.json.fixture` to a temporary folder under their real + names and requires that advisory and a failing audit. Under those names the + fixture raised [Dependabot alert 1](https://github.com/hemsoft-dev/codexbar/security/dependabot/1) + in the repository, so it is stored with a `.fixture` suffix. The dependency + graph reads only real manifest names, and Dependabot alerts come from the + graph: `dependabot.yml` options do not control them. Keep the suffix on any + new vulnerable npm fixture. - The cargo-audit fixtures under [`scripts/tests/fixtures/rust-advisory/`](../scripts/tests/fixtures/rust-advisory/) lock `idna 0.5.0` and `inconceivable 0.9.0`. On November 5, 2026 the diff --git a/scripts/fixtures/npm-vulnerable-markdown/package-lock.json b/scripts/fixtures/npm-vulnerable-markdown/package-lock.json.fixture similarity index 100% rename from scripts/fixtures/npm-vulnerable-markdown/package-lock.json rename to scripts/fixtures/npm-vulnerable-markdown/package-lock.json.fixture diff --git a/scripts/fixtures/npm-vulnerable-markdown/package.json b/scripts/fixtures/npm-vulnerable-markdown/package.json.fixture similarity index 100% rename from scripts/fixtures/npm-vulnerable-markdown/package.json rename to scripts/fixtures/npm-vulnerable-markdown/package.json.fixture diff --git a/scripts/tests/npm-audit.test.cjs b/scripts/tests/npm-audit.test.cjs index cc57fb68..d1bbf6bb 100644 --- a/scripts/tests/npm-audit.test.cjs +++ b/scripts/tests/npm-audit.test.cjs @@ -33,9 +33,11 @@ test('the current development dependency lock passes the all-severity policy', ( test('an actual vulnerable development lock fails even with conflicting npm defaults', () => { const directory = mkdtempSync(join(tmpdir(), 'codexbar-npm-audit-')); try { + // The fixture is stored under non-manifest names so GitHub's dependency graph does not + // raise a Dependabot alert for it; the audit sees the real file names in the copy. const fixture = join(root, 'scripts/fixtures/npm-vulnerable-markdown'); for (const file of ['package.json', 'package-lock.json']) { - cpSync(join(fixture, file), join(directory, file)); + cpSync(join(fixture, `${file}.fixture`), join(directory, file)); } const before = readFileSync(join(directory, 'package-lock.json')); const { status, report } = audit(directory, { From 08440d72e0c34fd9ff45a48c456575a97c7677d4 Mon Sep 17 00:00:00 2001 From: Franz Hemmer Date: Sat, 7 Nov 2026 14:25:45 -0500 Subject: [PATCH 2/2] docs: say the vulnerable fixtures stay out of the dependency graph The section heading and intro still said the fixtures were expected to raise alerts, which contradicted the new .fixture suffix guidance. Co-Authored-By: Claude Opus 5.5 --- docs/RUST_DEPENDENCY_SECURITY.md | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/docs/RUST_DEPENDENCY_SECURITY.md b/docs/RUST_DEPENDENCY_SECURITY.md index da0fbed3..9f71d586 100644 --- a/docs/RUST_DEPENDENCY_SECURITY.md +++ b/docs/RUST_DEPENDENCY_SECURITY.md @@ -124,10 +124,11 @@ secret scanning alert list returns the literal secret unless `hide_secret=true` is passed, so read only counts or fields such as `number`, `state` and `secret_type`. Dismiss an alert only with a stated reason after checking it. -### Expected alerts from test fixtures +### Vulnerable test fixtures -Two test fixtures contain vulnerable versions on purpose. Do not fix, rewrite -or remove them to clear an alert. +Two test fixtures contain vulnerable versions on purpose. Do not upgrade, edit +or delete them to clear an alert: the tests below need the vulnerable versions. +Keep them out of the dependency graph instead. - [`scripts/fixtures/npm-vulnerable-markdown/package-lock.json.fixture`](../scripts/fixtures/npm-vulnerable-markdown/package-lock.json.fixture) locks KaTeX 0.18.1 (low-severity GHSA-238p-pmpm-9mq7). @@ -143,8 +144,8 @@ or remove them to clear an alert. [`scripts/tests/fixtures/rust-advisory/`](../scripts/tests/fixtures/rust-advisory/) lock `idna 0.5.0` and `inconceivable 0.9.0`. On November 5, 2026 the dependency graph listed the root `Cargo.lock`, the root `package-lock.json` - and the npm fixture lock, but not these lockfiles. An alert for them would be - the same kind of expected fixture alert. + and the npm fixture lock, but not these lockfiles. If they ever raise an + alert, keep them out of the graph the same way rather than changing them. ### Limits and checks