Repository navigation
fix(*): align beta workflows and update vulnerable dependencies - #31
Merged
Merged
Conversation
omermorad
marked this pull request as ready for review
October 8, 2026 05:49
omermorad
added a commit
that referenced
this pull request
Oct 8, 2026
## Summary Mitigate the reachable glob-parsing stack-exhaustion path identified in the separate risk review for [GHSA-vfj7-8cjw-p6xm](GHSA-vfj7-8cjw-p6xm). - Check the exact resolved pattern before calling `fast-glob`: maximum length 1,024 JavaScript string code units and maximum brace/parenthesis nesting 32. - Use a bounded, non-recursive scan that respects escapes, quotes, character classes, and matching delimiters. - Reject excessive patterns with a clear `ConfigError` without logging the supplied pattern. Literal paths and ordinary glob matching retain their existing behavior. - Add 19 regression cases to the existing configuration E2E suite, covering the reproduced input, boundary limits, quoted/escaped/class closers, mixed nesting, normal matches, and literal paths. No new test files or test infrastructure. - Include the dependency overrides and lockfile updates from #31. The live audit now reports only the two reviewed advisories below, instead of the 23 findings on the original branch. - Keep audit handling inline in the existing GitHub Actions workflow. No scripts folder, custom action, or additional workflow is introduced. ## Verification - `pnpm build`: passed. - `pnpm lint`: passed. - `pnpm test`: 8 passed. - `pnpm test:e2e`: 358 passed, 1 existing skip. - `git diff --check`: passed. - Workflow linting: passed. Existing Node 22/24/26 matrix unchanged. - Live audit gate: passed with the two explicitly accepted risks, not a clean vulnerability report. - Clean-worktree audit: passed after a frozen, scripts-disabled install. This install is required because pnpm returns empty dependency paths without `node_modules`; the gate deliberately rejects incomplete paths. - 17 ephemeral gate probes passed: expiry boundaries, clean reports after expiry, additional low-severity findings, registry/malformed-report errors, unexpected statuses, muted findings, changed advisory IDs/packages/versions, unreviewed cache paths, and inconsistent metadata. No repository test files were added for these probes. ## Scope and remaining risk - Targets `next`. Security changes are also integrated into #31 without rewriting either branch's existing commits. Review this security PR first; #31 retains the separate beta-workflow changes. - Changes the CLI config loader, its existing E2E suite, dependency overrides/lockfile, and existing dependency-audit workflow. No package release versions, CI matrix, rulesets, or release workflows change here. - This addresses the reported recursive glob-input path, not every possible glob-complexity denial of service or every transitive `braces` consumer. - Omer approved two temporary CI risk exceptions on 2026-10-08. They expire at **2026-10-22 05:37:00 UTC**, with no automatic extension: - [braces / GHSA-vfj7-8cjw-p6xm](GHSA-vfj7-8cjw-p6xm), only version 3.0.3. CLI glob guards mitigate the reviewed input path; other tooling consumers remain affected. - [http-cache-semantics / GHSA-ch52-4w7c-c8xp](GHSA-ch52-4w7c-c8xp), only version 4.2.0 through the reviewed root Lerna 9.0.7 paths. Reviewed callers use private caches on fresh runners; this is not approval for shared-cache usage. - Every other advisory remains blocking, regardless of severity. Registry/schema errors fail closed. At expiry, either remaining advisory blocks again; a clean audit still passes. Warnings and the job summary make accepted risk visible. Remove these exceptions when patched; no security alert is dismissed. - The Action still bundles the published CLI. It receives this mitigation only after a separately approved Contractual publication followed by an Action dependency/bundle update. No SHA substitution or release is performed here. - These exceptions apply to CI only. The publishing audit in #31 remains strict; any publishing-gate exception needs separate approval. No approval to merge, create/move tags, publish packages, or create GitHub Releases is implied or exercised.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Scope
release-preview.yml,release-packages.yml,publish-packages.yml, andtag-global.yml; no replacement workflows or new test files.next.releaseenvironment approval, and reviewed commit verification for release operations.betadist-tag. Validate immutable tags and registry commit metadata; never move exact-version tags.Validation
git diff --checkpass.Remaining blockers
This is a draft, not approval to merge or release. The underlying audit still reports two high-severity advisories with no patched versions listed. Omer approved temporary CI-only risk exceptions on 2026-10-08, expiring at 2026-10-22 05:37:00 UTC:
The existing dependency-audit workflow enforces this fixed expiry and reports warnings/job summaries. All other findings remain blocking, including low severity; registry and malformed-report errors fail closed. At expiry, either remaining advisory blocks again. Exceptions should be removed when patched, and no security alert is dismissed.
Publishing remains blocked:
publish-packages.ymlkeeps its strictpnpm audit --audit-level lowgate. Applying these exceptions to publishing was blocked by the approval safeguard and requires separate explicit approval. The manual release/environment approvals remain intact regardless. The Action still needs a separately approved Contractual publication and dependency/bundle update to receive the CLI mitigation.No workflows have been dispatched, and no tags, packages, or releases have been published. Existing history and version tags are unchanged. Omer must explicitly approve any future tagging or publishing operation.