From b056a29ba6454943f36d691b8be25139b56e19e7 Mon Sep 17 00:00:00 2001
From: Adam Moussa <166072409+amoussa1229@users.noreply.github.com>
Date: Tue, 28 Jul 2026 15:47:30 -0400
Subject: [PATCH] ci(security): allow GHSA-3jxr-9vmj-r5cp in dependency review
 (#16)

brace-expansion 5.0.7 ships inBundle inside aws-cdk-lib and cannot be
overridden via the lockfile; dependency-review (fail-on-severity: high)
blocks any PR whose diff moves the bundled copy, currently Dependabot #15
(aws-cdk-lib 2.261.0 -> 2.262.1, bundled 5.0.6 -> 5.0.7).

- bump callable-dependency-review pin to org main HEAD (adds the
  allow-ghsas input, absent at the old fd60e4c9 pin)
- pass allow-ghsas scoped to this single advisory
- adjudicate the accepted risk in .security-review/suppressions.json
  per the org workflow input contract (synth-time-only exposure)

Remove the allow + suppression when aws-cdk-lib bundles >=5.0.8.
---
 .github/workflows/dependency-review.yml | 7 ++++++-
 .security-review/suppressions.json      | 8 ++++++++
 2 files changed, 14 insertions(+), 1 deletion(-)
 create mode 100644 .security-review/suppressions.json

diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml
index 2cd8119..0e70f93 100644
--- a/.github/workflows/dependency-review.yml
+++ b/.github/workflows/dependency-review.yml
@@ -3,4 +3,9 @@ on:
   pull_request:
 jobs:
   review:
-    uses: Sea-Haven-Industries/.github/.github/workflows/callable-dependency-review.yaml@fd60e4c9041784f666ac0fdefb9bec3c7fbf5143 # main
+    uses: Sea-Haven-Industries/.github/.github/workflows/callable-dependency-review.yaml@7a8243248b4dfcc42cbd238ab98e6d35e705d6e2 # main
+    with:
+      # GHSA-3jxr-9vmj-r5cp (brace-expansion ReDoS): bundled transitive inside
+      # aws-cdk-lib (inBundle, not overridable via lockfile); adjudicated in
+      # .security-review/suppressions.json. Remove when aws-cdk-lib bundles >=5.0.8.
+      allow-ghsas: GHSA-3jxr-9vmj-r5cp
diff --git a/.security-review/suppressions.json b/.security-review/suppressions.json
new file mode 100644
index 0000000..75b7b76
--- /dev/null
+++ b/.security-review/suppressions.json
@@ -0,0 +1,8 @@
+{
+  "suppressions": [
+    {
+      "id": "npmaudit-brace-expansion",
+      "justification": "Bundled transitive of aws-cdk-lib (node_modules/aws-cdk-lib/node_modules/brace-expansion, inBundle: true). aws-cdk-lib 2.262.1 (latest as of 2026-07-28) still bundles the vulnerable range (GHSA-3jxr-9vmj-r5cp); npm cannot override bundled deps, so no fix is available until upstream rebundles >=5.0.8. Exposure is synth-time only: aws-cdk-lib runs during cdk synth in CI on trusted repo input, and this stack deploys an EC2 syslog host with no Node.js runtime artifacts. This entry also adjudicates the allow-ghsas exception in .github/workflows/dependency-review.yml, which would otherwise block Dependabot PRs that move the bundled copy (e.g. #15, 5.0.6 -> 5.0.7). Remove this entry AND the allow-ghsas input on the first aws-cdk-lib bump that bundles >=5.0.8 / clears npm audit."
+    }
+  ]
+}