From 2abc98258e66f9c7215c26f8bca1f46cd467138a Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" Date: Mon, 2 Nov 2026 08:18:42 +0000 Subject: [PATCH 1/2] fix(deps): update vulnerable npm packages in package-lock.json --- package-lock.json | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/package-lock.json b/package-lock.json index e7c7ef5b57..f95a98c23d 100644 --- a/package-lock.json +++ b/package-lock.json @@ -26069,9 +26069,9 @@ "license": "MIT" }, "node_modules/follow-redirects": { - "version": "1.16.1", - "resolved": "https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.16.1.tgz", - "integrity": "sha512-FNvFGzoMLWmE6Yj9spb/zjd7yiNCHiAW9/Tg9CXrQ8wuu32HtlJOwWO11OJafl5FfY3DxTdQ0vj42zU1kvv5jg==", + "version": "1.16.2", + "resolved": "https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.16.2.tgz", + "integrity": "sha512-/kVP2U8z596Ia0gwFrwyIeo74ta5aVmSeU1FfAUMAmcEP5EP7zydmag3SLiN64NaRKef3lxsq7i/g7ltJQDGow==", "funding": [ { "type": "individual", @@ -28845,9 +28845,9 @@ } }, "node_modules/joi": { - "version": "17.13.8", - "resolved": "https://registry.npmjs.org/joi/-/joi-17.13.8.tgz", - "integrity": "sha512-iPKOGmiRw1jxf/JOPwxmCcUQAOdF359mdzYiP2DJ+TMX0YK2zjK3D+zYOaGjpumWxOFF/l2xVWjRVK5bGSLdEw==", + "version": "17.13.9", + "resolved": "https://registry.npmjs.org/joi/-/joi-17.13.9.tgz", + "integrity": "sha512-llFCT2rVtfwgBCaIqxtjim+iHqrgss4ONiGSYiiGH9jnjWq90ppSRffqmqKvwpa8W+YfILyQV6XyGcegXX2T4g==", "license": "BSD-3-Clause", "dependencies": { "@hapi/hoek": "^9.3.0", From 305ccfe7a4dda5e1fdfa2890f4811dec341f26e2 Mon Sep 17 00:00:00 2001 From: Mark Scott Date: Mon, 2 Nov 2026 11:05:12 +0000 Subject: [PATCH 2/2] fix(deps): override glob and minimatch, suppress unfixable copies Override glob to ^14.0.2 and minimatch@^10 to ^11.0.1 to fix GHSA-3g3m-2fjr-6pw4 and GHSA-g3hv-75wg-m249. Suppress the copies that cannot move, with matching VEX statements: minimatch 3.1.5 (no optimizationLevel code) and the glob and minimatch copies bundled in npm for the CLI release job. --- osv-scanner.toml | 21 +++++++++++ package-lock.json | 34 ++++++++++------- package.json | 2 + vex/calm.openvex.json | 85 +++++++++++++++++++++++++++++++++++++++++-- 4 files changed, 126 insertions(+), 16 deletions(-) diff --git a/osv-scanner.toml b/osv-scanner.toml index 2a05b671d1..945755ff61 100644 --- a/osv-scanner.toml +++ b/osv-scanner.toml @@ -106,3 +106,24 @@ reason = "deepmerge 4.3.1 runs only at build time: vite-plugin-svelte merges pro id = "GHSA-ccrj-gw8r-854m" ignoreUntil = 2026-11-30 reason = "CALM Hub turns off the OpenTelemetry SDK by default, and Quarkus then does not parse inbound tracestate headers. Deployments that set CALM_OTEL_DISABLED=false are exposed until Quarkus manages OpenTelemetry >= 1.67.0. Remove when the Quarkus BOM moves to it." + +# glob 13.0.6 is bundled inside npm 11.21.1, which comes in only through +# @semantic-release/npm for the CLI release job. npm overrides cannot change a bundled +# dependency, and no npm 11.x release bundles the fix (14.0.2). The flaw is that an +# aborted walk keeps reading directories, and npm never passes a signal to glob. The +# root glob copy is overridden to 14.x. +[[IgnoredVulns]] +id = "GHSA-3g3m-2fjr-6pw4" +ignoreUntil = 2026-12-31 +reason = "glob 13.0.6 is bundled in npm under @semantic-release/npm, used only by the CLI release job. npm never passes an AbortSignal to glob, so the abort bypass cannot occur. Not shipped. Remove when an npm release bundles glob >= 14.0.2." + +# minimatch has no fix below 11.0.1. The root copy is overridden to 11.x. Two kinds of +# copy remain. 3.1.5 (eslint and its plugins, @stoplight/spectral-core, serve-handler) +# cannot take an override, because minimatch 11 has a different export shape, and it does +# not contain the vulnerable code: the globParts amplification is in the optimizationLevel 2 +# preprocessing that minimatch 7 added. 10.2.5 is bundled inside npm 11.21.1 for the CLI +# release job, and npm never sets optimizationLevel, so it stays at the default of 1. +[[IgnoredVulns]] +id = "GHSA-g3hv-75wg-m249" +ignoreUntil = 2026-12-31 +reason = "minimatch 3.1.5 has no optimizationLevel preprocessing, so the vulnerable code is not present. minimatch 10.2.5 is bundled in npm for the CLI release job only, and npm never sets optimizationLevel 2. Remove when eslint, spectral-core and serve-handler move off minimatch 3 and an npm release bundles minimatch >= 11.0.1." diff --git a/package-lock.json b/package-lock.json index f95a98c23d..5127a56ae0 100644 --- a/package-lock.json +++ b/package-lock.json @@ -9712,6 +9712,13 @@ "node": ">=18.0.0" } }, + "node_modules/@isaacs/nonrecursive-glob-match": { + "version": "1.0.3", + "resolved": "https://registry.npmjs.org/@isaacs/nonrecursive-glob-match/-/nonrecursive-glob-match-1.0.3.tgz", + "integrity": "sha512-SI7kyKHq4XXDRozw+r9GlRZkia1ZkFrpLW98r2IC2Bpr8YkFGE3fvjzmxCG0x78A++69HmDNrDvSMYBZmHGpKA==", + "dev": true, + "license": "BlueOak-1.0.0" + }, "node_modules/@jest/schemas": { "version": "29.6.3", "resolved": "https://registry.npmjs.org/@jest/schemas/-/schemas-29.6.3.tgz", @@ -26470,15 +26477,15 @@ "license": "ISC" }, "node_modules/glob": { - "version": "13.0.6", - "resolved": "https://registry.npmjs.org/glob/-/glob-13.0.6.tgz", - "integrity": "sha512-Wjlyrolmm8uDpm/ogGyXZXb1Z+Ca2B8NbJwqBVg0axK9GbBeoS7yGV6vjXnYdGm6X53iehEuxxbyiKp8QmN4Vw==", + "version": "14.0.3", + "resolved": "https://registry.npmjs.org/glob/-/glob-14.0.3.tgz", + "integrity": "sha512-A1vjIwC3qpdCso45Iw127gnp7sPhqgY8lUQhDrArIs+GbmfaaVPFuoyy7WyLT9EPZCRZ7j7aLdwUhQmHWesEow==", "dev": true, "license": "BlueOak-1.0.0", "dependencies": { - "minimatch": "^10.2.2", + "minimatch": "^11.0.2", "minipass": "^7.1.3", - "path-scurry": "^2.0.2" + "path-scurry": "^3.0.0" }, "engines": { "node": "18 || 20 || >=22" @@ -32925,16 +32932,17 @@ "license": "ISC" }, "node_modules/minimatch": { - "version": "10.2.6", - "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.2.6.tgz", - "integrity": "sha512-vpLQEs+VLCr1nU0BXS07maYoFwlDAH0gngQuuttxIwutDFEMHq2blX+8vpgxDdK3J1PwjCJiep77OitTZ4Ll1A==", + "version": "11.0.4", + "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-11.0.4.tgz", + "integrity": "sha512-/UJ1dEoVQTjPNDh6SGlUo+ueLMmoHTas4q+8yaAR/5t6nLAIiBDJtoYUh20IYleix7ehiQkgczb84PE3uzHkxg==", "dev": true, "license": "BlueOak-1.0.0", "dependencies": { - "brace-expansion": "^5.0.8" + "@isaacs/nonrecursive-glob-match": "^1.0.3", + "brace-expansion": "^5.0.12" }, "engines": { - "node": "18 || 20 || >=22" + "node": "20 || >=22" }, "funding": { "url": "https://github.com/sponsors/isaacs" @@ -36445,9 +36453,9 @@ "license": "MIT" }, "node_modules/path-scurry": { - "version": "2.0.2", - "resolved": "https://registry.npmjs.org/path-scurry/-/path-scurry-2.0.2.tgz", - "integrity": "sha512-3O/iVVsJAPsOnpwWIeD+d6z/7PmqApyQePUtCndjatj/9I5LylHvt5qluFaBT3I5h3r1ejfR056c+FCv+NnNXg==", + "version": "3.0.0", + "resolved": "https://registry.npmjs.org/path-scurry/-/path-scurry-3.0.0.tgz", + "integrity": "sha512-1pTbQqH1wIwMi/eleQ5leFTTCkzFsPcgXNjwOA8YGGW/W4/kHT3dssE7Z6NH+zuqNLOzOB0uaD61yl7cAcVhgg==", "dev": true, "license": "BlueOak-1.0.0", "dependencies": { diff --git a/package.json b/package.json index 57128b04b3..7489db3a91 100644 --- a/package.json +++ b/package.json @@ -111,6 +111,7 @@ "esbuild": "^0.28.2", "esrap": "2.2.11", "fast-uri": "^3.1.8", + "glob": "^14.0.2", "joi": "^17.13.8", "js-yaml": "^4.3.2", "on-headers": "^1.1.0", @@ -120,6 +121,7 @@ "lodash": "^4.18.1", "lodash-es": "^4.18.1", "markdown-it": "^14.3.1", + "minimatch@^10.0.0": "^11.0.1", "picomatch": "^4.0.7", "postcss": "^8.5.29", "sharp": "^0.35.0", diff --git a/vex/calm.openvex.json b/vex/calm.openvex.json index be582b9971..fdcc9b53f5 100644 --- a/vex/calm.openvex.json +++ b/vex/calm.openvex.json @@ -3,8 +3,8 @@ "@id": "https://github.com/finos/architecture-as-code/blob/main/vex/calm.openvex.json", "author": "Architecture as Code (CALM) Maintainers", "role": "Project maintainers", - "timestamp": "2026-10-29T00:00:00Z", - "version": 19, + "timestamp": "2026-11-02T00:00:00Z", + "version": 20, "tooling": "Maintained by hand alongside osv-scanner.toml", "statements": [ { @@ -305,7 +305,86 @@ "status_notes": "Review again by 2026-11-30, when the suppression in osv-scanner.toml expires.", "justification": "vulnerable_code_not_in_execute_path", "impact_statement": "opentelemetry-api 1.62.0 comes in through the Quarkus 3.40 BOM. The flaw is quadratic CPU use when the W3C propagator parses an inbound tracestate header. CALM Hub turns off the OpenTelemetry SDK by default (CALM_OTEL_DISABLED=true). Quarkus then builds a no-op SDK and disables the HTTP server instrumenter, so it does not parse tracestate. A deployment that sets CALM_OTEL_DISABLED=false is exposed. The fix (1.67.0) cannot be overridden, because Quarkus 3.40 does not start with OpenTelemetry 1.67. It needs a Quarkus release that manages OpenTelemetry 1.67.0 or later." + }, + { + "vulnerability": { + "name": "GHSA-3g3m-2fjr-6pw4", + "aliases": [ + "CVE-2026-118773" + ] + }, + "products": [ + { + "@id": "pkg:npm/%40finos/calm-cli", + "subcomponents": [ + { + "@id": "pkg:npm/glob@13.0.6" + } + ] + } + ], + "status": "not_affected", + "status_notes": "Review again by 2026-12-31, when the suppression in osv-scanner.toml expires.", + "justification": "vulnerable_code_not_in_execute_path", + "impact_statement": "glob 13.0.6 is bundled inside npm 11.21.1, which is pulled in only by @semantic-release/npm for the CLI release job. It is not part of the published @finos/calm-cli package. npm overrides cannot change a bundled dependency, and no npm 11.x release bundles the fix (14.0.2). The flaw is that a walk keeps reading directories after its AbortSignal fires. npm never passes a signal to glob, so no walk is aborted. The other glob copy in the lockfile is 14.0.3, which has the fix." + }, + { + "vulnerability": { + "name": "GHSA-g3hv-75wg-m249", + "aliases": [ + "CVE-2026-118764" + ] + }, + "products": [ + { + "@id": "pkg:npm/%40finos/calm-cli", + "subcomponents": [ + { + "@id": "pkg:npm/minimatch@3.1.5" + }, + { + "@id": "pkg:npm/minimatch@10.2.5" + } + ] + }, + { + "@id": "pkg:github/finos/architecture-as-code#calm-plugins/vscode", + "subcomponents": [ + { + "@id": "pkg:npm/minimatch@3.1.5" + } + ] + }, + { + "@id": "pkg:github/finos/architecture-as-code#calm-lab", + "subcomponents": [ + { + "@id": "pkg:npm/minimatch@3.1.5" + } + ] + }, + { + "@id": "pkg:npm/%40finos/calm-docusaurus-plugin", + "subcomponents": [ + { + "@id": "pkg:npm/minimatch@3.1.5" + } + ] + }, + { + "@id": "pkg:github/finos/architecture-as-code#docs", + "subcomponents": [ + { + "@id": "pkg:npm/minimatch@3.1.5" + } + ] + } + ], + "status": "not_affected", + "status_notes": "Review again by 2026-12-31, when the suppression in osv-scanner.toml expires.", + "justification": "vulnerable_code_not_present", + "impact_statement": "The flaw is unbounded growth of globParts in the preprocessing that minimatch runs at optimizationLevel 2 or higher. minimatch 3.1.5 comes in through @stoplight/spectral-core (in @finos/calm-shared, so the CLI, the VS Code extension and CALM Lab), serve-handler (Docusaurus), and eslint and its plugins (development only). minimatch 3 has no optimizationLevel option and no such preprocessing, so the vulnerable code is not present. An override to 11.x is not possible, because minimatch 11 has a different export shape. minimatch 10.2.5 is bundled inside npm 11.21.1, which is pulled in only by @semantic-release/npm for the CLI release job and is not part of the published package. npm never sets optimizationLevel, so the default of 1 applies and the vulnerable code does not run. The other minimatch 10 copies are overridden to 11.0.4, which has the fix." } ], - "last_updated": "2026-10-29T00:00:00Z" + "last_updated": "2026-11-02T00:00:00Z" }