From 1923b7d35c92c3a43c0bf3d060bddecaf9723e16 Mon Sep 17 00:00:00 2001 From: Adam Moussa Date: Fri, 7 Aug 2026 12:39:57 -0400 Subject: [PATCH] fix(ci): allow GHSA-rgw5 for bundled brace-expansion aws-cdk-lib 2.263.0 still ships brace-expansion 5.0.8 inBundle; npm cannot override it. Document accepted synth-time risk until upstream rebundles >=5.0.9. --- .github/workflows/dependency-review.yml | 7 +++++++ .security-review/suppressions.json | 8 ++++++++ 2 files changed, 15 insertions(+) create mode 100644 .security-review/suppressions.json diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml index 8c1aec9..6f933a2 100644 --- a/.github/workflows/dependency-review.yml +++ b/.github/workflows/dependency-review.yml @@ -8,3 +8,10 @@ permissions: jobs: review: uses: Sea-Haven-Industries/.github/.github/workflows/callable-dependency-review.yaml@81cf168170f356d1423d7736f7ce93fd6611ad53 # v1.0.4 + with: + # GHSA-rgw5-rvv9-x895 (brace-expansion DoS bypass of CVE-2026-14257): + # bundled transitive inside aws-cdk-lib (inBundle, not overridable via + # lockfile); adjudicated in .security-review/suppressions.json. + # aws-cdk-lib 2.263.0 bundles 5.0.8 (fixes GHSA-3jxr-9vmj-r5cp). Remove + # when aws-cdk-lib bundles >=5.0.9. + allow-ghsas: GHSA-rgw5-rvv9-x895 diff --git a/.security-review/suppressions.json b/.security-review/suppressions.json new file mode 100644 index 0000000..d9405e5 --- /dev/null +++ b/.security-review/suppressions.json @@ -0,0 +1,8 @@ +{ + "suppressions": [ + { + "id": "npmaudit-brace-expansion", + "justification": "Bundled transitive of aws-cdk-lib (node_modules/aws-cdk-lib/node_modules/brace-expansion, inBundle: true). aws-cdk-lib 2.263.0 bundles brace-expansion 5.0.8, which clears GHSA-3jxr-9vmj-r5cp / CVE-2026-14257 but remains in range for GHSA-rgw5-rvv9-x895 / CVE-2026-69152 (fixed in >=5.0.9). npm cannot override bundled deps, so no fix is available until upstream rebundles >=5.0.9. Exposure is synth-time only: aws-cdk-lib runs during cdk synth in CI on trusted repo input, and this stack deploys an EC2 file-share host with no Node.js runtime artifacts from that dependency. This entry also adjudicates the allow-ghsas exception in .github/workflows/dependency-review.yml. Remove this entry AND the allow-ghsas input on the first aws-cdk-lib bump that bundles >=5.0.9 / clears npm audit." + } + ] +}