adam/syslog-server
1
0
Fork 0
mirror of https://github.com/Sea-Haven-Industries/syslog-server.git synced 2026-09-30 06:33:15 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

chore(security): allowlist brace-expansion GHSA-rgw5-rvv9-x895

Browse source 
Swap the dependency-review exception to the follow-on advisory that
still affects aws-cdk-lib's bundled 5.0.8, and refresh the suppression
until upstream rebundles >=5.0.9.
This commit is contained in:
Adam Moussa 2026-08-05 19:00:01 -04:00
parent da37fca318
commit 9306dd6f9d
No known key found for this signature in database
2 changed files with 7 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
.github/workflows/dependency-review.yml vendored
View file

@ -9,7 +9,9 @@ jobs:
review:
uses: Sea-Haven-Industries/.github/.github/workflows/callable-dependency-review.yaml@3f746774229d41770727e2e4fd63ed5f5555a8b3 # v1.0.3
with:
# GHSA-3jxr-9vmj-r5cp (brace-expansion ReDoS): bundled transitive inside
# aws-cdk-lib (inBundle, not overridable via lockfile); adjudicated in
# .security-review/suppressions.json. Remove when aws-cdk-lib bundles >=5.0.8.
allow-ghsas: GHSA-3jxr-9vmj-r5cp
# GHSA-rgw5-rvv9-x895 (brace-expansion DoS bypass of CVE-2026-14257):
# bundled transitive inside aws-cdk-lib (inBundle, not overridable via
# lockfile); adjudicated in .security-review/suppressions.json.
# aws-cdk-lib 2.263.0 bundles 5.0.8 (fixes GHSA-3jxr-9vmj-r5cp). Remove
# when aws-cdk-lib bundles >=5.0.9.
allow-ghsas: GHSA-rgw5-rvv9-x895

2
.security-review/suppressions.json
View file

@ -2,7 +2,7 @@
"suppressions": [
{
"id": "npmaudit-brace-expansion",
"justification": "Bundled transitive of aws-cdk-lib (node_modules/aws-cdk-lib/node_modules/brace-expansion, inBundle: true). aws-cdk-lib 2.262.1 (latest as of 2026-07-28) still bundles the vulnerable range (GHSA-3jxr-9vmj-r5cp); npm cannot override bundled deps, so no fix is available until upstream rebundles >=5.0.8. Exposure is synth-time only: aws-cdk-lib runs during cdk synth in CI on trusted repo input, and this stack deploys an EC2 syslog host with no Node.js runtime artifacts. This entry also adjudicates the allow-ghsas exception in .github/workflows/dependency-review.yml, which would otherwise block Dependabot PRs that move the bundled copy (e.g. #15, 5.0.6 -> 5.0.7). Remove this entry AND the allow-ghsas input on the first aws-cdk-lib bump that bundles >=5.0.8 / clears npm audit."
"justification": "Bundled transitive of aws-cdk-lib (node_modules/aws-cdk-lib/node_modules/brace-expansion, inBundle: true). aws-cdk-lib 2.263.0 bundles brace-expansion 5.0.8, which clears GHSA-3jxr-9vmj-r5cp / CVE-2026-14257 but remains in range for GHSA-rgw5-rvv9-x895 / CVE-2026-69152 (fixed in >=5.0.9). npm cannot override bundled deps, so no fix is available until upstream rebundles >=5.0.9. Exposure is synth-time only: aws-cdk-lib runs during cdk synth in CI on trusted repo input, and this stack deploys an EC2 syslog host with no Node.js runtime artifacts. This entry also adjudicates the allow-ghsas exception in .github/workflows/dependency-review.yml. Remove this entry AND the allow-ghsas input on the first aws-cdk-lib bump that bundles >=5.0.9 / clears npm audit."
}
]
}