mirror of
https://github.com/Sea-Haven-Industries/syslog-server.git
synced 2026-09-30 06:33:15 +00:00
b056a29ba6
brace-expansion 5.0.7 ships inBundle inside aws-cdk-lib and cannot be overridden via the lockfile; dependency-review (fail-on-severity: high) blocks any PR whose diff moves the bundled copy, currently Dependabot #15 (aws-cdk-lib 2.261.0 -> 2.262.1, bundled 5.0.6 -> 5.0.7). - bump callable-dependency-review pin to org main HEAD (adds the allow-ghsas input, absent at the old fd60e4c9 pin) - pass allow-ghsas scoped to this single advisory - adjudicate the accepted risk in .security-review/suppressions.json per the org workflow input contract (synth-time-only exposure) Remove the allow + suppression when aws-cdk-lib bundles >=5.0.8.
8 lines
887 B
JSON
8 lines
887 B
JSON
{
|
|
"suppressions": [
|
|
{
|
|
"id": "npmaudit-brace-expansion",
|
|
"justification": "Bundled transitive of aws-cdk-lib (node_modules/aws-cdk-lib/node_modules/brace-expansion, inBundle: true). aws-cdk-lib 2.262.1 (latest as of 2026-07-28) still bundles the vulnerable range (GHSA-3jxr-9vmj-r5cp); npm cannot override bundled deps, so no fix is available until upstream rebundles >=5.0.8. Exposure is synth-time only: aws-cdk-lib runs during cdk synth in CI on trusted repo input, and this stack deploys an EC2 syslog host with no Node.js runtime artifacts. This entry also adjudicates the allow-ghsas exception in .github/workflows/dependency-review.yml, which would otherwise block Dependabot PRs that move the bundled copy (e.g. #15, 5.0.6 -> 5.0.7). Remove this entry AND the allow-ghsas input on the first aws-cdk-lib bump that bundles >=5.0.8 / clears npm audit."
|
|
}
|
|
]
|
|
}
|