mirror of
https://github.com/Sea-Haven-Industries/syslog-server.git
synced 2026-09-30 07:43:15 +00:00
b056a29ba6
brace-expansion 5.0.7 ships inBundle inside aws-cdk-lib and cannot be overridden via the lockfile; dependency-review (fail-on-severity: high) blocks any PR whose diff moves the bundled copy, currently Dependabot #15 (aws-cdk-lib 2.261.0 -> 2.262.1, bundled 5.0.6 -> 5.0.7). - bump callable-dependency-review pin to org main HEAD (adds the allow-ghsas input, absent at the old fd60e4c9 pin) - pass allow-ghsas scoped to this single advisory - adjudicate the accepted risk in .security-review/suppressions.json per the org workflow input contract (synth-time-only exposure) Remove the allow + suppression when aws-cdk-lib bundles >=5.0.8.
11 lines
487 B
YAML
11 lines
487 B
YAML
name: Dependency Review
|
|
on:
|
|
pull_request:
|
|
jobs:
|
|
review:
|
|
uses: Sea-Haven-Industries/.github/.github/workflows/callable-dependency-review.yaml@7a8243248b4dfcc42cbd238ab98e6d35e705d6e2 # main
|
|
with:
|
|
# GHSA-3jxr-9vmj-r5cp (brace-expansion ReDoS): bundled transitive inside
|
|
# aws-cdk-lib (inBundle, not overridable via lockfile); adjudicated in
|
|
# .security-review/suppressions.json. Remove when aws-cdk-lib bundles >=5.0.8.
|
|
allow-ghsas: GHSA-3jxr-9vmj-r5cp
|