Swap the dependency-review exception to the follow-on advisory that
still affects aws-cdk-lib's bundled 5.0.8, and refresh the suppression
until upstream rebundles >=5.0.9.
brace-expansion 5.0.7 ships inBundle inside aws-cdk-lib and cannot be
overridden via the lockfile; dependency-review (fail-on-severity: high)
blocks any PR whose diff moves the bundled copy, currently Dependabot #15
(aws-cdk-lib 2.261.0 -> 2.262.1, bundled 5.0.6 -> 5.0.7).
- bump callable-dependency-review pin to org main HEAD (adds the
allow-ghsas input, absent at the old fd60e4c9 pin)
- pass allow-ghsas scoped to this single advisory
- adjudicate the accepted risk in .security-review/suppressions.json
per the org workflow input contract (synth-time-only exposure)
Remove the allow + suppression when aws-cdk-lib bundles >=5.0.8.
CDK stack for the EC2 syslog collector (rsyslog 514 -> CloudWatch agent ->
unifi-syslog), mirroring the file-share/forgejo pattern. Recreated from the
captured console config; EIP 184.72.154.32 imported + re-associated so the
UniFi forwarding target is unchanged. Deployed + verified 2026-06-09.
Note: deploy role can assume cdk-hnb659fds-* (account-admin via CDK
bootstrap) — same exposure as every org CDK deploy role; per-app qualifier
is a known org-wide follow-up.
