Daily security sweep — backlog

Rolling backlog for the daily security sweep on this repo: advisories that were found but deliberately not bundled, plus structural things that stop the sweep from verifying honestly. Appended to on each run.

2026-09-04

Not bundled — out of scope (no Dependabot alert)

yaml@2.7.0 — GHSA-48c2-rrv3-qjmp, moderate (CVSS 4.3, CWE-674), stack overflow via deeply nested YAML collections. Vulnerable range >=2.0.0 <2.8.3; fixed in 2.8.3.

Location: root package-lock.json, dev-only, transitive via typedoc@0.27.8.
Not flagged by Dependabot (no alert number), so it fell outside this run's scope of "open alerts". Surfaced by npm audit while verifying the toml bundle.
Clean fix available: typedoc declares yaml: ^2.6.1, which accepts 2.8.3, and it is the only requester. A plain global override is correct here — no scoping needed:
```
"overrides": { "yaml": "^2.8.3" }
```
(Use the caret form, not >=2.8.3, so the override cannot jump the major.)
Left for a maintainer or a future sweep rather than mixed into PR fix(security): bump toml 3.0.0 → 4.3.0 (root lockfile) — closes 4 Dependabot alerts #40, which is scoped to the four toml alerts.

Structural: Dependabot PRs on this repo can never go green

Every Dependabot PR in the last several months is red on all checks, and none of the failures are dependency-related:

Tests (TS) — Error: VECTORIZE_API_KEY must be set (tests/testContext.ts:11). ci.yml reads secrets.VECTORIZE_TOKEN / secrets.VECTORIZE_ORG, which are not exposed to dependabot/* branches.
Tests (Python) — same root cause in tests/python.
Secret Detection — gitleaks-action@v2 fails without secrets.GITLEAKS_LICENSE, likewise unavailable.

Confirmed across dependabot/npm_and_yarn/toml-4.2.0 (#39), …/brace-expansion-2.1.4, …/tests/ts/postcss-8.5.25, …/linkify-it-5.0.2, …/pip/tests/python/pytest-9.0.3. On push to main the same GitLeaks job succeeds, which isolates the cause to the missing secret rather than a real finding.

Consequences worth a maintainer decision:

Dependabot security PRs carry no signal — they cannot be merged on a green check, so they accumulate. This is why the sweep recreates them on chore/security-daily-* branches (which do get secrets).
Consider populating Dependabot secrets (Settings → Secrets and variables → Dependabot) with VECTORIZE_TOKEN, VECTORIZE_ORG, GITLEAKS_LICENSE so Dependabot's own PRs become self-verifying, or gate the integration tests to skip cleanly when the key is absent.

Structural: `Tests (TS)` / `Tests (Python)` are live integration suites

Both jobs hit the real Vectorize API (VECTORIZE_ENV: dev). They are not runnable locally without credentials, and they exercise src/ts / src/python — neither touches the root package.json. A root-lockfile bundle therefore gets no meaningful coverage from CI, and verification has to be derived from the actual consumers (see PR #40's verification section). Not a defect, just a limitation to remember on future root-lockfile sweeps.

Also noted

Two workflows are both named CI (ci.yml and docs.yml). gh run list output is ambiguous as a result — the CI failures on push/main are docs.yml (GitHub Pages doc generation), not the test workflow, which only triggers on pull_request. Renaming one would make triage easier.
Label security did not exist and was created by this run. dependencies already existed.

Update — `Tests (Python)` on PR #40 resolved (fail, 3h33m)

It was not a hang. The job ran to completion and failed with 4 failures, and the cause is an account/plan problem, not a code problem:

Three tests got HTTP 402 Payment Required from api-dev.vectorize.io:

{"success":false,"error":"Upgrade Required",
 "message":"API access is available on paid plans only. Please upgrade to use this endpoint.",
 "code":"UPGRADE_REQUIRED"}

tests/test_client.py::test_get_pipelines — 402
tests/test_client.py::test_delete_system_connectors — 402
tests/test_client.py::test_upload_create_pipeline — 402
tests/test_client.py::test_extraction — polled GET /v1/org/***/extraction/f136ad02… for 3h31m returning 200 ready=False, then a terminal 502 Bad Gateway

The 3.5-hour runtime is the extraction test's ready-poll having no timeout and no failure ceiling — it will burn a full runner slot on every future run whenever the dev API stops advancing a job. That is worth capping independently of the plan issue.

This is very likely org-wide, not specific to this repo. The 2026-09-02 sweep of integrations-python recorded the identical signature — the Vectorize API returning 402 to CI — on PRs #10 and #11 there. Same error, different repo, two days apart. Whatever credential or org plan CI authenticates with appears to have lost paid API access.

What this means for PR #40

Nothing changes. The failures are provably outside the bundle's reach:

git diff main..branch -- src/python tests/python is empty
tests/python depends on path = "../../src/python", never the root manifest
the job's Build step (poetry install && poetry build) passed — the only packaging-adjacent part
Secret Detection passes

PR #40 stays open.

Added to this backlog

CI has lost paid Vectorize API access (402 UPGRADE_REQUIRED) — check whether the org plan or the CI credential changed. Cross-check integrations-python, which showed the same 402 on 2026-09-02.
test_extraction has an unbounded ready-poll — cap it so a stalled dev-API job fails in minutes rather than occupying a runner for 3.5 hours.

2026-09-05 sweep — no new bundle; correction to the 2026-09-04 `yaml` entry

Today's run found no un-covered open alerts. All four open alerts (#46–#49, the two toml advisories) are already carried by open PR #40, so nothing was re-bundled.

Correction: `yaml` was not "unflagged by Dependabot" — it was auto-dismissed

The 2026-09-04 entry above says yaml@2.7.0 was "not flagged by Dependabot (no alert number)". That is wrong, and the same mistake was about to be repeated for a second package today. Both actually have alerts, in state auto_dismissed:

Alert	Package	Path	Advisory	Severity	Scope	Auto-dismissed
#22	`yaml`	`package-lock.json`	GHSA-48c2-rrv3-qjmp	medium	`development`	2026-03-26
#44	`nanoid`	`tests/ts/package-lock.json`	GHSA-2v37-7h3g-55p8	high	`development`	2026-08-16

For both, created_at is byte-identical to auto_dismissed_at, and dismissed_by / dismissed_reason are null — the signature of a Dependabot auto-triage rule firing the instant the alert opened, not a human decision and not a missed alert. Both are scope: development, so the rule in force appears to dismiss dev-scope advisories.

Consequences for this sweep, worth recording:

gh api .../dependabot/alerts?state=open will never show these, but npm audit will. The two tools disagreeing is expected here, not a bug in either.
state=all is not a valid value for that endpoint (valid: open, dismissed, auto_dismissed, fixed). It returns an empty list rather than erroring, which silently looks like "this repo has no alert history". Query the states individually.
Auto-dismissed alerts are a policy decision, so the sweep will not bundle them or re-dismiss them. Recording them here for visibility only.

`nanoid` — available if a maintainer wants it (not bundled)

nanoid@3.3.16 in tests/ts/package-lock.json, high (CVSS 7.5, uncontrolled loop when size is 0), vulnerable < 3.3.18, fixed in 3.3.18. Dev-only, sole requester is postcss (via vitest → vite), which declares nanoid: ^3.3.16 — that accepts 3.3.18, so this is a plain in-range transitive fix needing no overrides:

npm update nanoid --package-lock-only    # in tests/ts/

Not opened as a PR for two reasons: the alert is auto-dismissed by policy (above), and tests/ts cannot be verified locally — its only script is vitest run, which is the live integration suite against api-dev.vectorize.io and needs VECTORIZE_TOKEN / VECTORIZE_ORG. Per the sweep's own rule, no green verify means no push.

Still-open structural items from 2026-09-04

Unchanged and still reproducing today:

PR fix(security): bump toml 3.0.0 → 4.3.0 (root lockfile) — closes 4 Dependabot alerts #40 is red on Tests (Python) and Tests (TS), both for the environmental reasons already documented in this issue (HTTP 402 UPGRADE_REQUIRED from the dev API on the paid-plan endpoints; pre-existing TS drift/timeout). Secret Detection passes. mergeStateStatus is BLOCKED. Nothing in that is caused by the toml bump — it remains the maintainer's call to merge.
Dependabot secrets are still unpopulated; Dependabot's own PRs still cannot go green.
ci.yml and docs.yml are still both named CI.

Also noted

There is no .github/dependabot.yml in this repo — version updates are not configured; the alerts come from the default security-update path only. Ecosystem coverage is therefore incidental. Nine manifests exist (root, src/ts [no lockfile], src/examples/node, tests/ts, src/python, tests/python); src/examples/node audits clean.

Sweep note — 2026-09-14

Two findings from today's sweep of tests/ts. Neither blocked the bundle (PR #43 is open and locally verified), but both cost time and will cost it again.

1. npm 10 cannot re-resolve tests/ts once vitest is bumped past 4.1.8.

npm error Cannot read properties of null (reading 'edgesOut')
  at #loadPeerSet (@npmcli/arborist/lib/arborist/build-ideal-tree.js:1289:38)

It dies walking vitest@4.1.11's optional peer set (@vitest/browser-playwright@5.0.0, @vitejs/devtools-vitest@^0.7.3). Reproduced on npm 10.9.8 and 10.8.2 — the latter is what node-version: "20.x" ships in ci.yml. Affects npm install, npm install --package-lock-only and npm update --package-lock-only alike. npm 11 resolves the identical tree cleanly with no flags.

CI is unaffected, because ci.yml only runs npm i against a lockfile that already matches the manifest, and that path needs no re-resolution (verified: npm ci on PR #43's lockfile exits 0 under npm 10.9.8 without rewriting the file). The trap is for whoever next re-locks tests/ts locally on npm 10 and reads the crash as a broken bump.

2. npm 10 silently strips libc markers from the lockfile.

The new lightningcss-linux-* and @rolldown/binding-linux-* entries declare "libc": ["glibc"] / ["musl"] — 10 keys in total, and Dependabot's own #42 lockfile carries exactly the same set. Any npm 10 write (npm i) removes all 10; npm 11 restores them. PR #43 commits the version with the markers. Please don't re-lock tests/ts on npm 10 and commit the result — it will quietly drop the glibc/musl discrimination that Linux installs use to pick the right native binary.

3. src/ts/package.json rewrites itself on every install. Unrelated to the above, but worth recording: src/ts has "preinstall": "npm install typescript", so any npm install that touches src/ts (including the file:../../src/ts link from tests/ts) rewrites its own manifest —

-    "typescript": "^4.0 || ^5.0"
+    "typescript": "^5.9.3"

— and drops an untracked src/ts/package-lock.json next to it. ci.yml's Install client step does exactly this on every run. It has to be reverted by hand before committing from any worktree, or the pin leaks into an unrelated PR.

Also re-confirmed today, no change since the last note: ci.yml has 23 recorded runs, all failures — the workflow has never been green. (Careful with gh run list here: ci.yml and docs.yml both declare name: CI, so counts are only meaningful when queried by workflow file path.) And gh run view --job <id> --log returns an empty file on this repo; gh api repos/{owner}/{repo}/actions/jobs/{id}/logs returns the real log.

402 status check — 2026-09-14

Tests (Python) on PR #43 (human-authored branch, secrets present) still fails with 402 UPGRADE_REQUIRED — "API access is available on paid plans only" — on test_get_pipelines, test_delete_system_connectors and test_upload_create_pipeline. Unchanged from #40 on 2026-09-04, so this has been live for at least 10 days and is blocking every green run of ci.yml. It is an account/plan problem on the CI credential's org: the branch authenticates, poetry install && poetry build passes, the client reaches the API, and the API returns 402. No dependency change can fix it and it needs an owner.

One piece of good news: test_extraction passed today — 27s in TS, ~8s in Python, whole Python job 2m23s. The 3h31m / 17.5 MB run on #40 was the dev API being unresponsive that day, not a permanent hang. The defect this issue tracks is unchanged though: no timeout, no failure ceiling, so the next bad day costs the same again.

Sweep note — 2026-09-20: no new bundle; 402 blocker now 16 days old

Today's sweep found no un-covered open alerts. All 6 open Dependabot alerts are already carried by the two open sweep PRs, so nothing was re-bundled and no new PR was opened.

Alerts	Advisory	Package / path	Carried by
#46, #48	GHSA-v5mp-jgw5-2x6j / CVE-2026-63376	`toml` — `package.json` + `package-lock.json`	#40
#47, #49	GHSA-82x6-q7mm-w9cf / CVE-2026-77465	`toml` — `package.json` + `package-lock.json`	#40
#50, #51	GHSA-82fw-gwwq-j7x9 / CVE-2026-84373	`@vitest/mocker`, `vitest` — `tests/ts/package-lock.json`	#43

Coverage re-verified against the branch contents, not just the PR bodies:

chore/security-daily-20260904-vectorize-clients-npm-root — root package.json carries "toml": "^4.2.0", lockfile resolves toml@4.3.0. Clears both toml advisories (≥4.1.2 and ≥4.2.0).
chore/security-daily-20260914-vectorize-clients-npm-tests-ts — tests/ts lockfile resolves vitest@4.1.11 and @vitest/mocker@4.1.11.

Both branches are 0 commits behind main and both report MERGEABLE. Neither has drifted.

The blocker is unchanged and is now aging two PRs

Both PRs sit at mergeStateStatus: BLOCKED purely on the red Tests (TS) / Tests (Python) checks. Secret Detection is green on both. The cause is the 402 UPGRADE_REQUIRED from api-dev.vectorize.io documented in the 2026-09-04 and 2026-09-14 comments above — an account/plan problem on the CI credential's org, which no dependency change can fix.

What is new is only the duration:

First recorded 2026-09-04 on fix(security): bump toml 3.0.0 → 4.3.0 (root lockfile) — closes 4 Dependabot alerts #40, still present 2026-09-14 on fix(security): bump vitest 4.1.8 → 4.1.11 in tests/ts — closes alerts #50, #51 (GHSA-82fw-gwwq-j7x9) #43 → now 16 days live.
fix(security): bump toml 3.0.0 → 4.3.0 (root lockfile) — closes 4 Dependabot alerts #40 is 15 days old and its checks have not re-run since 2026-09-04T20:27 — that result is two weeks stale.
fix(security): bump vitest 4.1.8 → 4.1.11 in tests/ts — closes alerts #50, #51 (GHSA-82fw-gwwq-j7x9) #43 is 5 days old, checks last run 2026-09-14T15:30.
The same 402 signature was recorded in integrations-python (feat: generate for 0.2 #10, Create secret-scan.yml #11) on 2026-09-02, so this is org-wide, not repo-specific.

Net effect: four high-severity toml alerts on a runtime-scope dependency have been fully fixed and sitting in a mergeable PR for over two weeks, held open only by an unrelated billing failure. This needs an owner on the plan/credential side — it is the single thing standing between this repo and zero open alerts.

No alerts were dismissed and no new backlog items were found this run.

Removed the security and p1 labels. This is a long-lived tracker for the daily sweep, not a security issue, and it never closes. Carrying those labels put it in Vanta's P1 security SLA test, where it could only ever be overdue. The individual security PRs it tracks are labelled and prioritised on their own.

Navigation Menu

Repository navigation

Daily security sweep — backlog #41

2026-09-04

Not bundled — out of scope (no Dependabot alert)

Structural: Dependabot PRs on this repo can never go green

Structural: `Tests (TS)` / `Tests (Python)` are live integration suites

Also noted

Update — `Tests (Python)` on PR #40 resolved (fail, 3h33m)

What this means for PR #40

Added to this backlog

2026-09-05 sweep — no new bundle; correction to the 2026-09-04 `yaml` entry

Correction: `yaml` was not "unflagged by Dependabot" — it was auto-dismissed

`nanoid` — available if a maintainer wants it (not bundled)

Still-open structural items from 2026-09-04

Also noted

Sweep note — 2026-09-14

402 status check — 2026-09-14

Sweep note — 2026-09-20: no new bundle; 402 blocker now 16 days old

The blocker is unchanged and is now aging two PRs

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Daily security sweep — backlog #41

Description

2026-09-04

Not bundled — out of scope (no Dependabot alert)

Structural: Dependabot PRs on this repo can never go green

Structural: Tests (TS) / Tests (Python) are live integration suites

Also noted

Activity

benfrank241 commented on Sep 4, 2026

Update — Tests (Python) on PR #40 resolved (fail, 3h33m)

What this means for PR #40

Added to this backlog

benfrank241 commented on Sep 5, 2026

2026-09-05 sweep — no new bundle; correction to the 2026-09-04 yaml entry

Correction: yaml was not "unflagged by Dependabot" — it was auto-dismissed

nanoid — available if a maintainer wants it (not bundled)

Still-open structural items from 2026-09-04

Also noted

benfrank241 commented on Sep 14, 2026

Sweep note — 2026-09-14

benfrank241 commented on Sep 14, 2026

402 status check — 2026-09-14

benfrank241 commented on Sep 20, 2026

Sweep note — 2026-09-20: no new bundle; 402 blocker now 16 days old

The blocker is unchanged and is now aging two PRs

cdbartholomew commented on Sep 23, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Structural: `Tests (TS)` / `Tests (Python)` are live integration suites

Update — `Tests (Python)` on PR #40 resolved (fail, 3h33m)

2026-09-05 sweep — no new bundle; correction to the 2026-09-04 `yaml` entry

Correction: `yaml` was not "unflagged by Dependabot" — it was auto-dismissed

`nanoid` — available if a maintainer wants it (not bundled)