adam/file-share
1
0
Fork 0
mirror of https://github.com/Sea-Haven-Industries/file-share.git synced 2026-09-30 11:13:17 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

fix(ci): allow GHSA-rgw5 for bundled brace-expansion

Browse source 
aws-cdk-lib 2.263.0 still ships brace-expansion 5.0.8 inBundle;
npm cannot override it. Document accepted synth-time risk until
upstream rebundles >=5.0.9.
This commit is contained in:
Adam Moussa 2026-08-07 12:39:57 -04:00
parent 583a44758b
commit 1923b7d35c
No known key found for this signature in database
2 changed files with 15 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
.github/workflows/dependency-review.yml vendored
View file

@ -8,3 +8,10 @@ permissions:
jobs:
review:
uses: Sea-Haven-Industries/.github/.github/workflows/callable-dependency-review.yaml@81cf168170f356d1423d7736f7ce93fd6611ad53 # v1.0.4
with:
# GHSA-rgw5-rvv9-x895 (brace-expansion DoS bypass of CVE-2026-14257):
# bundled transitive inside aws-cdk-lib (inBundle, not overridable via
# lockfile); adjudicated in .security-review/suppressions.json.
# aws-cdk-lib 2.263.0 bundles 5.0.8 (fixes GHSA-3jxr-9vmj-r5cp). Remove
# when aws-cdk-lib bundles >=5.0.9.
allow-ghsas: GHSA-rgw5-rvv9-x895

8
.security-review/suppressions.json Normal file
View file

@ -0,0 +1,8 @@
{
"suppressions": [
{
"id": "npmaudit-brace-expansion",
"justification": "Bundled transitive of aws-cdk-lib (node_modules/aws-cdk-lib/node_modules/brace-expansion, inBundle: true). aws-cdk-lib 2.263.0 bundles brace-expansion 5.0.8, which clears GHSA-3jxr-9vmj-r5cp / CVE-2026-14257 but remains in range for GHSA-rgw5-rvv9-x895 / CVE-2026-69152 (fixed in >=5.0.9). npm cannot override bundled deps, so no fix is available until upstream rebundles >=5.0.9. Exposure is synth-time only: aws-cdk-lib runs during cdk synth in CI on trusted repo input, and this stack deploys an EC2 file-share host with no Node.js runtime artifacts from that dependency. This entry also adjudicates the allow-ghsas exception in .github/workflows/dependency-review.yml. Remove this entry AND the allow-ghsas input on the first aws-cdk-lib bump that bundles >=5.0.9 / clears npm audit."
}
]
}