ci: restore the npm audit gate around the unpatchable image-size advisories - #29
Merged
Conversation
…sories The Security audit step has failed on every PR since the advisory database picked up three new entries on Aug 6-7 — none related to the PRs they blocked. The commit that passed on Aug 4 fails today with an identical package-lock.json. Two of the three are ours to fix, via overrides: - nanoid 3.3.16 -> 3.3.18 (CVE-2026-67213) - js-yaml 4.3.0 -> 4.3.1, and 3.15.0 -> 3.15.1 under gray-matter (GHSA-5p4m-2wfm-xmqj) Picked up the two moderates while here: dompurify 3.4.12 -> 3.4.13 and mermaid 11.16.0 -> 11.16.1. Mermaid renders client-side, so the diagrams in noosphere/ and x402/ were re-checked against a local serve, not just the build. The third is not fixable here. image-size has no patched release — 2.0.2 is the latest and was published 2025-04-02 — and Docusaurus treats replacing it as a breaking change targeted at v4 (facebook/docusaurus#12231), so it will not clear on the 3.x line. It arrives through @docusaurus/mdx-loader, which is why a single unfixable package accounts for 18 of the high findings. Rather than drop the gate, the step now runs audit-ci with those two advisories allowlisted by ID in audit-ci.jsonc, each with the reasoning recorded beside it. Anything not listed there still fails — verified exit 1 with the allowlist emptied. Both workflows also gain timeout-minutes: 15. An unbounded job is the real cost of an infinite-loop DoS advisory: without it a hung build holds a runner for six hours, and a hung deploy blocks the non-cancelling pages group for as long.
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The
Security audit (high/critical)step has failed on every PR since the advisory database picked up three new entries on Aug 6–7. None of them relate to the PRs they blocked — the commit that passed on Aug 4 (408d3ff) fails today as4df9bfdwith a byte-identicalpackage-lock.json.Two are ours to fix
Raised via
overrides:nanoidjs-yamljs-yaml(undergray-matter)Picked up the two moderates while here —
dompurify3.4.12 → 3.4.13,mermaid11.16.0 → 11.16.1. Mermaid renders client-side, so the diagrams innoosphere/andx402/were checked against a localnpm run serve, not just a passing build.One is not
image-sizehas no patched release — 2.0.2 is the latest and was published 2025-04-02 — and Docusaurus treats replacing it as a breaking change targeted at v4 (facebook/docusaurus#12231, PR #12235 still draft). It will not clear on the 3.x line, so waiting is not a plan. It arrives through@docusaurus/mdx-loader, which is why one unfixable package accounts for 18 of the high findings.Rather than drop the gate, the step now runs
audit-ciwith those two advisories allowlisted by ID inaudit-ci.jsonc, each with the reasoning recorded beside it. Anything not listed there still fails — verified:exit 1with the allowlist emptied,exit 0with it applied.The residual risk is bounded: the parser runs at build time only, never in the deployed static site, and it measures images committed to this repo.
Also:
timeout-minutes: 15Neither workflow had a timeout, so both defaulted to 360 minutes. That is the actual cost of an infinite-loop DoS advisory — a hung build holds a runner for six hours, and a hung deploy blocks the non-cancelling
pagesconcurrency group for just as long. Current build takes ~30s. This is not specific toimage-size; it bounds every future advisory of this shape.Notes for review
audit-ciadds 24 dev-only packages.npm ciin CI installs them; they are not in the site bundle.package-lock.jsondiff is exactly 5 version changes + theaudit-citree, 0 removals.builda required status check. It currently is not, which is why the red X never actually blocked a merge. If we want the gate to bite, that is a ruleset change onmainand a separate decision — happy to do it if you want.