fix(ci): unblock dependency audit - patch shell-quote, ignore unreachable uuid advisory#81
Merged
Merged
Conversation
…able uuid advisory The Security Audit job and the PR-only dependency-review step were failing on every PR because of two advisories that surfaced after master last ran CI: - shell-quote@1.8.3 (GHSA-w7jw-789q-3m8p, critical, dev-only via concurrently): forced to ^1.8.4 via a pnpm override — a real patch, removes the critical. - uuid@8.3.2 (GHSA-w5hq-g745-h8pq, moderate, transitive prod dep of next-auth@4 which is locked to uuid v8): vulnerable v3/v5/v6 buffer path is unreachable via next-auth, so it is ignored (pnpm.auditConfig.ignoreGhsas + dependency-review allow-ghsas) until the next-auth v5 upgrade. Also migrate the pnpm `overrides`/`onlyBuiltDependencies` from package.json to pnpm-workspace.yaml: pnpm v10 no longer reads them from package.json and was silently ignoring them. Co-Authored-By: Makar Dzhehur <100146104+dzhhem@users.noreply.github.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
dzhhem
approved these changes
Jun 10, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Every open Dependabot PR is currently red on the same single check — the
Security Auditjob. Two advisories were published after master last ran CI:dev-only transitive dep by
concurrently@9.2.1. Fixed for real via a pnpmoverride to
^1.8.4.next-auth@4.24.14(locked to uuid v8). The vulnerable path (v3/v5/v6 bufferbounds) is unreachable through next-auth, so it is ignored via
pnpm.auditConfig.ignoreGhsas+allow-ghsasin dependency-review, with anote to revisit on the next-auth v5 upgrade.
Bonus fix: pnpm v10 no longer reads
pnpm.overrides/onlyBuiltDependenciesfrom
package.jsonand was silently ignoring them — migrated topnpm-workspace.yamlwhere they now actually apply.Merging this unblocks all pending Dependabot PRs (then
@dependabot rebaseon each).Type of change
How Has This Been Tested?
pnpm audit --audit-level=moderateexits 0 locally(was: 1 critical + 1 moderate); lockfile diff is exactly
shell-quote 1.8.3 → 1.8.4;pnpm run format:checkpasses.Checklist:
about
pnpm.auditConfigin package.json; the ignore still works (auditreads it from there), documented in the commit