From 9306dd6f9d666d548fda5c698eb9e79b9e85f150 Mon Sep 17 00:00:00 2001 From: Adam Moussa Date: Wed, 5 Aug 2026 19:00:01 -0400 Subject: [PATCH] chore(security): allowlist brace-expansion GHSA-rgw5-rvv9-x895 Swap the dependency-review exception to the follow-on advisory that still affects aws-cdk-lib's bundled 5.0.8, and refresh the suppression until upstream rebundles >=5.0.9. --- .github/workflows/dependency-review.yml | 10 ++++++---- .security-review/suppressions.json | 2 +- 2 files changed, 7 insertions(+), 5 deletions(-) diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml index c855392..b416806 100644 --- a/.github/workflows/dependency-review.yml +++ b/.github/workflows/dependency-review.yml @@ -9,7 +9,9 @@ jobs: review: uses: Sea-Haven-Industries/.github/.github/workflows/callable-dependency-review.yaml@3f746774229d41770727e2e4fd63ed5f5555a8b3 # v1.0.3 with: - # GHSA-3jxr-9vmj-r5cp (brace-expansion ReDoS): bundled transitive inside - # aws-cdk-lib (inBundle, not overridable via lockfile); adjudicated in - # .security-review/suppressions.json. Remove when aws-cdk-lib bundles >=5.0.8. - allow-ghsas: GHSA-3jxr-9vmj-r5cp + # GHSA-rgw5-rvv9-x895 (brace-expansion DoS bypass of CVE-2026-14257): + # bundled transitive inside aws-cdk-lib (inBundle, not overridable via + # lockfile); adjudicated in .security-review/suppressions.json. + # aws-cdk-lib 2.263.0 bundles 5.0.8 (fixes GHSA-3jxr-9vmj-r5cp). Remove + # when aws-cdk-lib bundles >=5.0.9. + allow-ghsas: GHSA-rgw5-rvv9-x895 diff --git a/.security-review/suppressions.json b/.security-review/suppressions.json index 75b7b76..41436b3 100644 --- a/.security-review/suppressions.json +++ b/.security-review/suppressions.json @@ -2,7 +2,7 @@ "suppressions": [ { "id": "npmaudit-brace-expansion", - "justification": "Bundled transitive of aws-cdk-lib (node_modules/aws-cdk-lib/node_modules/brace-expansion, inBundle: true). aws-cdk-lib 2.262.1 (latest as of 2026-07-28) still bundles the vulnerable range (GHSA-3jxr-9vmj-r5cp); npm cannot override bundled deps, so no fix is available until upstream rebundles >=5.0.8. Exposure is synth-time only: aws-cdk-lib runs during cdk synth in CI on trusted repo input, and this stack deploys an EC2 syslog host with no Node.js runtime artifacts. This entry also adjudicates the allow-ghsas exception in .github/workflows/dependency-review.yml, which would otherwise block Dependabot PRs that move the bundled copy (e.g. #15, 5.0.6 -> 5.0.7). Remove this entry AND the allow-ghsas input on the first aws-cdk-lib bump that bundles >=5.0.8 / clears npm audit." + "justification": "Bundled transitive of aws-cdk-lib (node_modules/aws-cdk-lib/node_modules/brace-expansion, inBundle: true). aws-cdk-lib 2.263.0 bundles brace-expansion 5.0.8, which clears GHSA-3jxr-9vmj-r5cp / CVE-2026-14257 but remains in range for GHSA-rgw5-rvv9-x895 / CVE-2026-69152 (fixed in >=5.0.9). npm cannot override bundled deps, so no fix is available until upstream rebundles >=5.0.9. Exposure is synth-time only: aws-cdk-lib runs during cdk synth in CI on trusted repo input, and this stack deploys an EC2 syslog host with no Node.js runtime artifacts. This entry also adjudicates the allow-ghsas exception in .github/workflows/dependency-review.yml. Remove this entry AND the allow-ghsas input on the first aws-cdk-lib bump that bundles >=5.0.9 / clears npm audit." } ] }