adam/syslog-server
1
0
Fork 0
mirror of https://github.com/Sea-Haven-Industries/syslog-server.git synced 2026-10-07 16:18:58 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Compare commits

base: adam:3a9dcf010c9c6d2c459232b5f6e1e33c4e59d263
Branches Tags
adam:main
adam:chore/enqueue-as-seahaven-bot
...
compare: adam:6cb77243e58583487233962d08198da589ec4375
Branches Tags
adam:main
adam:chore/enqueue-as-seahaven-bot

2 commits
3a9dcf010c ... 6cb77243e5

Author SHA1 Message Date
dependabot[bot]
6cb77243e5
chore(deps): bump the minor-and-patch group across 1 directory with 3 updates 
Bumps the minor-and-patch group with 3 updates in the / directory: [aws-cdk-lib](https://github.com/aws/aws-cdk/tree/HEAD/packages/aws-cdk-lib), [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) and [aws-cdk](https://github.com/aws/aws-cdk-cli/tree/HEAD/packages/aws-cdk).


Updates `aws-cdk-lib` from 2.261.0 to 2.262.1
- [Release notes](https://github.com/aws/aws-cdk/releases)
- [Changelog](https://github.com/aws/aws-cdk/blob/main/CHANGELOG.v2.alpha.md)
- [Commits](https://github.com/aws/aws-cdk/commits/v2.262.1/packages/aws-cdk-lib)

Updates `@types/node` from 26.1.1 to 26.1.2
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `aws-cdk` from 2.1132.0 to 2.1133.0
- [Release notes](https://github.com/aws/aws-cdk-cli/releases)
- [Commits](https://github.com/aws/aws-cdk-cli/commits/aws-cdk@v2.1133.0/packages/aws-cdk)

---
updated-dependencies:
- dependency-name: "@types/node"
  dependency-version: 26.1.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: aws-cdk
  dependency-version: 2.1133.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: aws-cdk-lib
  dependency-version: 2.262.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-28 19:49:21 +00:00
Adam Moussa
b056a29ba6
ci(security): allow GHSA-3jxr-9vmj-r5cp in dependency review (#16) 
brace-expansion 5.0.7 ships inBundle inside aws-cdk-lib and cannot be
overridden via the lockfile; dependency-review (fail-on-severity: high)
blocks any PR whose diff moves the bundled copy, currently Dependabot #15
(aws-cdk-lib 2.261.0 -> 2.262.1, bundled 5.0.6 -> 5.0.7).

- bump callable-dependency-review pin to org main HEAD (adds the
  allow-ghsas input, absent at the old fd60e4c9 pin)
- pass allow-ghsas scoped to this single advisory
- adjudicate the accepted risk in .security-review/suppressions.json
  per the org workflow input contract (synth-time-only exposure)

Remove the allow + suppression when aws-cdk-lib bundles >=5.0.8.
 2026-07-28 15:47:30 -04:00
4 changed files with 54 additions and 31 deletions
Show stats Expand all files Collapse all files

7
.github/workflows/dependency-review.yml vendored
View file

@ -3,4 +3,9 @@ on:
pull_request:
jobs:
review:
uses: Sea-Haven-Industries/.github/.github/workflows/callable-dependency-review.yaml@fd60e4c9041784f666ac0fdefb9bec3c7fbf5143 # main
uses: Sea-Haven-Industries/.github/.github/workflows/callable-dependency-review.yaml@7a8243248b4dfcc42cbd238ab98e6d35e705d6e2 # main
with:
# GHSA-3jxr-9vmj-r5cp (brace-expansion ReDoS): bundled transitive inside
# aws-cdk-lib (inBundle, not overridable via lockfile); adjudicated in
# .security-review/suppressions.json. Remove when aws-cdk-lib bundles >=5.0.8.
allow-ghsas: GHSA-3jxr-9vmj-r5cp

8
.security-review/suppressions.json Normal file
View file

@ -0,0 +1,8 @@
{
"suppressions": [
{
"id": "npmaudit-brace-expansion",
"justification": "Bundled transitive of aws-cdk-lib (node_modules/aws-cdk-lib/node_modules/brace-expansion, inBundle: true). aws-cdk-lib 2.262.1 (latest as of 2026-07-28) still bundles the vulnerable range (GHSA-3jxr-9vmj-r5cp); npm cannot override bundled deps, so no fix is available until upstream rebundles >=5.0.8. Exposure is synth-time only: aws-cdk-lib runs during cdk synth in CI on trusted repo input, and this stack deploys an EC2 syslog host with no Node.js runtime artifacts. This entry also adjudicates the allow-ghsas exception in .github/workflows/dependency-review.yml, which would otherwise block Dependabot PRs that move the bundled copy (e.g. #15, 5.0.6 -> 5.0.7). Remove this entry AND the allow-ghsas input on the first aws-cdk-lib bump that bundles >=5.0.8 / clears npm audit."
}
]
}

64
package-lock.json generated
View file

@ -8,15 +8,15 @@
"name": "syslog-server",
"version": "1.0.0",
"dependencies": {
"aws-cdk-lib": "2.261.0",
"aws-cdk-lib": "2.262.1",
"constructs": "^10.7.1"
},
"bin": {
"app": "bin/app.js"
},
"devDependencies": {
"@types/node": "^26.1.1",
"aws-cdk": "^2.1132.0",
"@types/node": "^26.1.2",
"aws-cdk": "^2.1133.0",
"source-map-support": "^0.5.21",
"tsx": "4.23.1",
"typescript": "~7.0.2"
@ -35,9 +35,9 @@
"license": "Apache-2.0"
},
"node_modules/@aws-cdk/cloud-assembly-schema": {
"version": "54.8.0",
"resolved": "https://registry.npmjs.org/@aws-cdk/cloud-assembly-schema/-/cloud-assembly-schema-54.8.0.tgz",
"integrity": "sha512-f891G+Uv4x0/PWTYkA7psEoxHj4//uXEYklB853uFZVHq2zwoH5Eko+uL07wUXZsUiXpZZl8c72KJVnEidR+zg==",
"version": "54.14.0",
"resolved": "https://registry.npmjs.org/@aws-cdk/cloud-assembly-schema/-/cloud-assembly-schema-54.14.0.tgz",
"integrity": "sha512-JCZCzgp3SuXQVljaKqXnttHzcezEHt9Ag/YipK0XwUFD+Iz2T4jY7gUc3pA25Uq6pzY2n9DvO/nEU++dPXW4Rw==",
"bundleDependencies": [
"jsonschema",
"semver"
@ -45,7 +45,7 @@
"license": "Apache-2.0",
"dependencies": {
"jsonschema": "^1.5.0",
"semver": "^7.8.4"
"semver": "^7.8.5"
},
"engines": {
"node": ">= 18.0.0"
@ -60,7 +60,7 @@
}
},
"node_modules/@aws-cdk/cloud-assembly-schema/node_modules/semver": {
"version": "7.8.4",
"version": "7.8.5",
"inBundle": true,
"license": "ISC",
"bin": {
@ -513,9 +513,9 @@
}
},
"node_modules/@types/node": {
"version": "26.1.1",
"resolved": "https://registry.npmjs.org/@types/node/-/node-26.1.1.tgz",
"integrity": "sha512-nxAkRSVkN1Y0JC1W8ky/fTfkGsMmcrRsbx+3XoZE+rMOX71kLYTV7fLXpqud1GpbpP5TuffXFqfX7fH2GgZREw==",
"version": "26.1.2",
"resolved": "https://registry.npmjs.org/@types/node/-/node-26.1.2.tgz",
"integrity": "sha512-Vu4a5UFA9rIIFJ7rB/Vaafh9lrCQszopTCx6KjFboXTGQbPNasehVR5TEiithSDGyd1DEiUByggTZsg8jukeIg==",
"dev": true,
"license": "MIT",
"dependencies": {
@ -863,9 +863,9 @@
}
},
"node_modules/aws-cdk": {
"version": "2.1132.0",
"resolved": "https://registry.npmjs.org/aws-cdk/-/aws-cdk-2.1132.0.tgz",
"integrity": "sha512-kcIzBZQO+2v+F97iaeI29fdOUQEx44wr0qDb9HXNqdU82V+1ZKI1KuFlHwH2nq7+6iNc1bu60se4hFf+2d7vXg==",
"version": "2.1133.0",
"resolved": "https://registry.npmjs.org/aws-cdk/-/aws-cdk-2.1133.0.tgz",
"integrity": "sha512-DGlCBwqxSHTe1u/IoT5WV+Bbd2K3UhwFHsdMqb2nQa1fkJmaQgoNFu0It+p3HxyMWeW+gKsVzT5KcjQPQ6Kzuw==",
"dev": true,
"license": "Apache-2.0",
"bin": {
@ -876,10 +876,11 @@
}
},
"node_modules/aws-cdk-lib": {
"version": "2.261.0",
"resolved": "https://registry.npmjs.org/aws-cdk-lib/-/aws-cdk-lib-2.261.0.tgz",
"integrity": "sha512-e52e3Abjg0HkuRWlWwtSv5+ZiMW1rhCDdL9ff7lzWXInU8xdfLJpuoimfa0IJwjiNGyphppgg52Azx9M80OA0g==",
"version": "2.262.1",
"resolved": "https://registry.npmjs.org/aws-cdk-lib/-/aws-cdk-lib-2.262.1.tgz",
"integrity": "sha512-B6YP4r6ojUZCDhl+qBu/CrWzcipR8sIgshcqYvgw013sghPXmVkYdJ3yuI9+DKML3YLSjQrHy1nGJs+Nqq7JCg==",
"bundleDependencies": [
"@aws/cloudformation-validate",
"@balena/dockerignore",
"@aws-cdk/cloud-assembly-api",
"case",
@ -896,17 +897,18 @@
"dependencies": {
"@aws-cdk/asset-awscli-v1": "2.2.282",
"@aws-cdk/asset-node-proxy-agent-v6": "^2.1.2",
"@aws-cdk/cloud-assembly-api": "^2.2.5",
"@aws-cdk/cloud-assembly-schema": "^54.0.0",
"@aws-cdk/cloud-assembly-api": "^2.2.6",
"@aws-cdk/cloud-assembly-schema": "^54.11.0",
"@aws/cloudformation-validate": "1.5.1-beta",
"@balena/dockerignore": "^1.0.2",
"case": "1.6.3",
"fs-extra": "^11.3.5",
"fs-extra": "^11.3.6",
"ignore": "^5.3.2",
"jsonschema": "^1.5.0",
"mime-types": "^2.1.35",
"minimatch": "^10.2.5",
"punycode": "^2.3.1",
"semver": "^7.8.1",
"semver": "^7.8.5",
"yaml": "1.10.3"
},
"engines": {
@ -917,18 +919,26 @@
}
},
"node_modules/aws-cdk-lib/node_modules/@aws-cdk/cloud-assembly-api": {
"version": "2.2.5",
"version": "2.2.6",
"inBundle": true,
"license": "Apache-2.0",
"dependencies": {
"jsonschema": "^1.5.0",
"semver": "^7.8.0"
"semver": "^7.8.4"
},
"engines": {
"node": ">= 18.0.0"
},
"peerDependencies": {
"@aws-cdk/cloud-assembly-schema": ">=53.28.0"
"@aws-cdk/cloud-assembly-schema": ">=54.5.0"
}
},
"node_modules/aws-cdk-lib/node_modules/@aws/cloudformation-validate": {
"version": "1.5.1-beta",
"inBundle": true,
"license": "Apache-2.0",
"engines": {
"node": ">=20.0.0"
}
},
"node_modules/aws-cdk-lib/node_modules/@balena/dockerignore": {
@ -945,7 +955,7 @@
}
},
"node_modules/aws-cdk-lib/node_modules/brace-expansion": {
"version": "5.0.6",
"version": "5.0.7",
"inBundle": true,
"license": "MIT",
"dependencies": {
@ -964,7 +974,7 @@
}
},
"node_modules/aws-cdk-lib/node_modules/fs-extra": {
"version": "11.3.5",
"version": "11.3.6",
"inBundle": true,
"license": "MIT",
"dependencies": {
@ -1050,7 +1060,7 @@
}
},
"node_modules/aws-cdk-lib/node_modules/semver": {
"version": "7.8.1",
"version": "7.8.5",
"inBundle": true,
"license": "ISC",
"bin": {

6
package.json
View file

@ -12,14 +12,14 @@
"diff": "cdk diff"
},
"devDependencies": {
"@types/node": "^26.1.1",
"aws-cdk": "^2.1132.0",
"@types/node": "^26.1.2",
"aws-cdk": "^2.1133.0",
"source-map-support": "^0.5.21",
"tsx": "4.23.1",
"typescript": "~7.0.2"
},
"dependencies": {
"aws-cdk-lib": "2.261.0",
"aws-cdk-lib": "2.262.1",
"constructs": "^10.7.1"
}
}