ci: restore the npm audit gate around the unpatchable image-size advisories

.github/workflows/deploy.yml

@@ -21,6 +21,7 @@ concurrency:
 jobs:
   build:
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - uses: actions/checkout@v7
       - uses: actions/setup-node@v6
@@ -39,6 +40,9 @@ jobs:
   deploy:
     needs: build
     runs-on: ubuntu-latest
+    # The `pages` concurrency group does not cancel in-progress runs, so a hung
+    # deploy would block every later deploy until it times out.
+    timeout-minutes: 15
     environment:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}

.github/workflows/test.yml

@@ -8,6 +8,9 @@ on:
 jobs:
   build:
     runs-on: ubuntu-latest
+    # An unbounded job is the real cost of the infinite-loop DoS advisories we
+    # tolerate below: without this, a hung build holds a runner for 6 hours.
+    timeout-minutes: 15
     steps:
       - uses: actions/checkout@v7
       - uses: actions/setup-node@v6
@@ -18,8 +21,8 @@ jobs:
         run: npm ci
       - name: Build website
         run: npm run build
-      # Fail the PR on high/critical advisories. The single known moderate
-      # (js-yaml, build-time only, via Docusaurus' own deps) is tolerated and
-      # documented in the README "Security" section.
+      # Fail the PR on high/critical advisories. Advisories with no upstream fix
+      # are allowlisted individually in audit-ci.jsonc, with the reasoning next
+      # to each entry; see also the README "Security" section.
       - name: Security audit (high/critical)
-        run: npm audit --audit-level=high
+        run: npx audit-ci --config audit-ci.jsonc

README.md

@@ -102,7 +102,21 @@ redirects here.
 
 Transitive advisories from the Docusaurus toolchain are pinned to patched versions
 via npm `overrides` in `package.json` (including `serialize-javascript`, `uuid`,
-`brace-expansion`, `minimatch`, `fast-uri`, `js-yaml`, `postcss`, `shell-quote`,
-`svgo`, `webpack-dev-server`, `body-parser`, and `dompurify`). Most of these packages are
-build-time or local-dev only and are **not present in the deployed static site**.
-CI fails on **high/critical** advisories (`npm audit --audit-level=high`).
+`brace-expansion`, `mermaid`, `minimatch`, `nanoid`, `fast-uri`, `js-yaml`, `postcss`,
+`shell-quote`, `svgo`, `webpack-dev-server`, `body-parser`, and `dompurify`). Most of these
+packages are build-time or local-dev only and are **not present in the deployed static site**.
+
+CI fails on **high/critical** advisories (`npx audit-ci --config audit-ci.jsonc`).
+Advisories that have no upstream fix are allowlisted one by one in `audit-ci.jsonc`, each
+with the reasoning recorded next to it — the gate still fails on anything not listed there.
+
+Currently allowlisted: the two `image-size` parser DoS advisories
+([CVE-2025-71330](https://github.com/advisories/GHSA-w3rx-r6r6-pgpr),
+[CVE-2025-71329](https://github.com/advisories/GHSA-5p2g-fcmc-qvqq)). `image-size` has had
+no release since 2025-04-02 and no patched version exists; Docusaurus tracks replacing it as
+a breaking change targeted at v4 ([#12231](https://github.com/facebook/docusaurus/issues/12231)),
+so it will not clear on the 3.x line. It is reached only through `@docusaurus/mdx-loader`
+when measuring images at build time, never in the deployed site.
+
+Build and deploy jobs carry a `timeout-minutes` bound so that an infinite-loop advisory of
+this kind can cost at most one short job rather than a 6-hour runner hold.

audit-ci.jsonc

@@ -0,0 +1,18 @@
+{
+  "$schema": "https://github.com/IBM/audit-ci/raw/main/docs/schema.json",
+  // Fail CI on high/critical advisories only, matching the previous
+  // `npm audit --audit-level=high` behaviour.
+  "high": true,
+  "allowlist": [
+    // image-size — unpatched DoS in the ICNS and JXL/HEIF parsers.
+    // No fixed release exists (2.0.2 is the latest, published 2025-04-02) and
+    // upstream Docusaurus tracks the swap as a breaking change targeted at v4,
+    // so this will not clear on the 3.x line:
+    //   https://github.com/facebook/docusaurus/issues/12231
+    // Reached only through `@docusaurus/mdx-loader` at build time; the parser
+    // never runs in the deployed static site, and the images it measures are
+    // the ones committed to this repo. Re-check when Docusaurus v4 lands.
+    "GHSA-w3rx-r6r6-pgpr", // CVE-2025-71330 — ICNS parser infinite loop
+    "GHSA-5p2g-fcmc-qvqq"  // CVE-2025-71329 — JXL/HEIF parser infinite loop
+  ]
+}