adam/syslog-server
1
0
Fork 0
mirror of https://github.com/Sea-Haven-Industries/syslog-server.git synced 2026-09-30 07:43:15 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

ci(security): allow GHSA-3jxr-9vmj-r5cp in dependency review

Browse source 
brace-expansion 5.0.7 ships inBundle inside aws-cdk-lib and cannot be
overridden via the lockfile; dependency-review (fail-on-severity: high)
blocks any PR whose diff moves the bundled copy, currently Dependabot #15
(aws-cdk-lib 2.261.0 -> 2.262.1, bundled 5.0.6 -> 5.0.7).

- bump callable-dependency-review pin to org main HEAD (adds the
  allow-ghsas input, absent at the old fd60e4c9 pin)
- pass allow-ghsas scoped to this single advisory
- adjudicate the accepted risk in .security-review/suppressions.json
  per the org workflow input contract (synth-time-only exposure)

Remove the allow + suppression when aws-cdk-lib bundles >=5.0.8.
This commit is contained in:
Adam Moussa 2026-07-28 15:42:35 -04:00
parent ef622ded7f
commit 0d3d45f17b
No known key found for this signature in database
2 changed files with 14 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
.github/workflows/dependency-review.yml vendored
View file

@ -3,4 +3,9 @@ on:
pull_request:
jobs:
review:
uses: Sea-Haven-Industries/.github/.github/workflows/callable-dependency-review.yaml@fd60e4c9041784f666ac0fdefb9bec3c7fbf5143 # main
uses: Sea-Haven-Industries/.github/.github/workflows/callable-dependency-review.yaml@7a8243248b4dfcc42cbd238ab98e6d35e705d6e2 # main
with:
# GHSA-3jxr-9vmj-r5cp (brace-expansion ReDoS): bundled transitive inside
# aws-cdk-lib (inBundle, not overridable via lockfile); adjudicated in
# .security-review/suppressions.json. Remove when aws-cdk-lib bundles >=5.0.8.
allow-ghsas: GHSA-3jxr-9vmj-r5cp

8
.security-review/suppressions.json Normal file
View file

@ -0,0 +1,8 @@
{
"suppressions": [
{
"id": "npmaudit-brace-expansion",
"justification": "Bundled transitive of aws-cdk-lib (node_modules/aws-cdk-lib/node_modules/brace-expansion, inBundle: true). aws-cdk-lib 2.262.1 (latest as of 2026-07-28) still bundles the vulnerable range (GHSA-3jxr-9vmj-r5cp); npm cannot override bundled deps, so no fix is available until upstream rebundles >=5.0.8. Exposure is synth-time only: aws-cdk-lib runs during cdk synth in CI on trusted repo input, and this stack deploys an EC2 syslog host with no Node.js runtime artifacts. This entry also adjudicates the allow-ghsas exception in .github/workflows/dependency-review.yml, which would otherwise block Dependabot PRs that move the bundled copy (e.g. #15, 5.0.6 -> 5.0.7). Remove this entry AND the allow-ghsas input on the first aws-cdk-lib bump that bundles >=5.0.8 / clears npm audit."
}
]
}