ci: fail builds on high/critical dependency advisories - #61
Merged
Conversation
Bump vulnerable dependencies and resolve two CodeQL warnings. Dependencies (via resolutions + recursive lockfile bumps): - axios ^1.16.0 -> ^1.18.1 and form-data -> ^4.0.6 (ship to consumers via apisauce and casper-js-sdk): CRLF injection, prototype pollution, proxy and maxBodyLength bypasses, and formDataToJSON DoS advisories. - Dev-only tooling to patched versions: brace-expansion, js-yaml, minimatch, picomatch, tar, undici, flatted, @babel/core. Code scanning: - address.ts: drop the useless initial assignment in formatAddress by returning directly from each branch. - validators.ts: remove the always-true minAmount guard in getMinAmount. Signed-off-by: Dmytro Vynnyk <simbiatoff@gmail.com>
Add a dependency-audit enforcement gate to the CI build job that runs `yarn npm audit --all --severity high --recursive` and fails on any high/critical advisory across the whole tree (dev + transitive). This complements Dependabot, which only detects and opens PRs, by preventing vulnerable code from being merged. Only high/critical are gated; low/moderate are intentionally not enforced. Because the audit covers the whole tree, a new unfixable high would go red on every branch, so .yarnrc.yml gains an npmAuditIgnoreAdvisories escape hatch — empty by policy, currently holding one documented, consciously accepted entry: lodash _.template code injection (GHSA-r5fr-rjxr-66jc), a dev-only advisory pulled transitively by the ESLint preset, on the latest published lodash with no fix available. Signed-off-by: Dmytro Vynnyk <simbiatoff@gmail.com>
…code-scanning-alerts
Comp0te
changed the base branch from
fix/dependabot-and-code-scanning-alerts
to
master
July 22, 2026 12:20
2 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Adds a dependency-audit enforcement gate to the CI
buildjob:It audits the whole tree (dev + transitive) and fails the build on any high/critical advisory. Low/moderate are intentionally not gated — they are noise and would erode trust in the check.
Because the audit covers the whole tree, a new unfixable high would go red on every branch. So
.yarnrc.ymlgains annpmAuditIgnoreAdvisoriesescape hatch — empty by policy, currently holding a single documented, consciously accepted entry: thelodash_.templateadvisory (GHSA-r5fr-rjxr-66jc), a dev-only advisory pulled transitively by the ESLint preset, on the latest publishedlodashwith no fix. Each entry must name its package, GHSA, and reason. (Yarn 4 matches the numeric advisory id, not the GHSA slug.)Motivation
Dependabot only detects vulnerabilities and opens PRs; nothing stops vulnerable code from being merged. This gate is the enforcement half — it blocks merges that introduce new high/critical advisories.
Related issues
Stacked on #60. This PR targets
fix/dependabot-and-code-scanning-alerts(which clears the current high/critical set so the gate is green); retarget tomasteronce #60 merges.Notes for reviewers
Verified locally: the gate command exits 0 on this tree, still exits non-zero at
--severity moderate(the ignore is narrow, not a blanket disable),yarn install --immutablepasses, and both YAML files parse. The step uses only staticrun:— nogithub.event.*input.