Repository navigation
fix(website): pass npm audit at high again - #63
Merged
Merged
Conversation
- story:website-dependencies-pass-npm-audit records the scheduled Audit failure of 2026-10-05, the advisories left after a non-forcing npm audit fix, and the acceptance: npm audit at high exits 0, braces vendored with depth guards in the image-size pattern, tinypool and serialize-javascript moved to patched versions, the site still builds.
…endencies The scheduled Audit run of 2026-10-05 failed at `npm audit --audit-level=high` in website/. After a non-forcing `npm audit fix`, two high-or-critical roots were left that npm could not fix on its own: - braces <= 3.0.3 (GHSA-vfj7-8cjw-p6xm, high): the recursive AST walkers have no depth guard, so a deeply nested pattern under the length limit overflows the stack. No patched release exists. website/vendor/braces/ carries 3.0.3 with the six lib/ hunks of upstream pull request micromatch/braces#78 (at 97308a01), which throw the same SyntaxError the length limit already throws and guard each walker, so a caller-supplied AST is bounded too. It installs as the tarball vendor/braces-3.0.4-b10x.1.tgz through dependencies + overrides, in the pattern image-size already uses; B10X-PATCH.md says how to drop it. - tinypool <= 2.1.1 (GHSA-5gmw-xhrv-c9v3, GHSA-85c8-ppgw-ccpr, critical): overridden to 2.1.2. A build with DOCUSAURUS_SSG_WORKER_THREAD_COUNT=2 created the pool and produced the same 157 files as a single-thread build. Also moved by override: serialize-javascript 7.1.1 -> 7.1.2 (GHSA-gfhx-hw2g-v5hg) and postcss-selector-parser -> 7.1.6 (GHSA-rj75-hqrm-r3gf); the built site is byte-identical with and without the latter. katex stays: its fix (0.18.2) is outside mermaid's ^0.16.47 range, and it is low severity. `npm run vendor-check` now also feeds 11 hostile patterns (8 overflow the stack on published 3.0.3, 3 are accepted there) and 7 ordinary ones through the source and the installed copy, each hostile case in a fresh process. Both B10X-PATCH.md notes now name the tarball in the repack command: `npm install --package-lock-only` alone keeps the old integrity. npm audit --audit-level=high: 47 vulnerabilities (3 low, 13 moderate, 14 high, 17 critical), exit 1 -> 4 low severity vulnerabilities, exit 0.
- story:website-dependencies-pass-npm-audit records the verification (npm audit at high: 47 findings, exit 1 -> 4 low, exit 0) and the per-command results on 9c254cf, and moves active -> implemented.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Weekly
Auditrun of 2026-10-05 failed atnpm audit (website). This makesnpm audit --audit-level=highinwebsite/exit 0.braces≤ 3.0.3 (GHSA-vfj7-8cjw-p6xm)website/vendor/braces-3.0.4-b10x.1.tgzwith the depth guards of micromatch/braces#78, same pattern asimage-sizetinypool≤ 2.1.1 (GHSA-5gmw-xhrv-c9v3, GHSA-85c8-ppgw-ccpr)serialize-javascript7.1.1 (GHSA-gfhx-hw2g-v5hg)postcss-selector-parser(GHSA-rj75-hqrm-r3gf)npm audit fixkatex(GHSA-238p-pmpm-9mq7)^0.16.47Local,
website/at 9c254cf:npm audit --audit-level=high4 low severity vulnerabilities, exit 0 (was 47: 3 low, 13 moderate, 14 high, 17 critical, exit 1)npm run vendor-checknpm ci,npm run typecheck,npm run buildThe Audit workflow runs only on schedule and
workflow_dispatch, so this PR's checks do not run it.