fix(deps): pull brace-expansion past GHSA-rgw5-rvv9-x895 - #2968
Conversation
The advisory published after the last green scan and fails the OSV step of workflow hygiene on every pull request, docs-only ones included. Patched releases exist on both affected lines (1.1.16 -> 1.1.18, 5.0.8 -> 5.0.9), so the lockfile moves instead of adding a second id-bound waiver next to the #2700 one. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
GitHub Actions
Inactive
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
|
Keiko for Quality — run summary ✅ complete · head
Budget: 108368 tokens allotted |
GitHub Actions
Inactive
|
Warning Review the following alerts detected in dependencies. According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.
|
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 99eb34c60f
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
The GHSA-mh99-v99m-4gvg entry recorded 'drop this entry as soon as brace-expansion ships a patched 1.x' — 1.1.18 is now in the lockfile, so the id-wide suppression would only hide a reintroduced vulnerable release from the one gate positioned to catch it. The triage record keeps the removal rationale. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
GitHub Actions
Inactive
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Pro Plus Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (1)
📜 Recent review details⏰ Context from checks skipped due to timeout. (17)
📝 WalkthroughWalkthroughThe OSV-Scanner configuration removes the ChangesVulnerability waiver configuration
Estimated code review effort: 1 (Trivial) | ~5 minutes Possibly related PRs
Suggested labels: 🚥 Pre-merge checks | ✅ 2 | ❌ 2❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
GitHub Actions
Inactive
|
1 participant
GHSA-rgw5-rvv9-x895(brace-expansion, CVSS 7.5, dev group) published after the last green scan ondevand now fails the OSV step ofworkflow hygieneon every pull request — #2967's docs-only diff was the first to trip it. Both affected lines have patched releases, so this bumps the lockfile (1.1.16 → 1.1.18,5.0.8 → 5.0.9, onenpm update brace-expansion) rather than adding a second id-bound waiver beside the #2700 entry — a fix version existing makes a waiver strictly worse.Verification: the lock now resolves brace-expansion to 1.1.18 and 5.0.9 only (the vulnerable pins are gone);
npm run gates:sonarPASS on the diff. Lockfile-only — no manifest ranges changed, no runtime dependency touched. After this merges, the redworkflow hygieneruns on open PRs need a rerun to pick up the fixed merge ref.🤖 Generated with Claude Code