Repository navigation
fix(deps): clear the October osv advisories - #974
Merged
Merged
Conversation
New advisories published after the last lockfile refresh fail security:deps on main and every open PR. - Raise root resolutions floors: fast-uri ^3.1.9, undici ^7.30.1, ip-address ^10.7.4; add vite ^8.1.6 and zod ^4.6.6. Mirror fast-uri and undici into jira-forge-app overrides and re-lock it. - docs: astro 7.2.8 -> 7.3.3. - cli, docs: retire ^5.4.3 -> ^6.1.0, the first release on zod 4 (zod 3.x has no fixed release). - agent: certifi 2026.6.17 -> 2026.10.23. - Add time-boxed (2026-11-28) osv-scanner ignores for the three advisories with no available fix: deepmerge (no fixed release, test-only via jest-config) and two OpenTelemetry advisories pinned exactly by aws-opentelemetry-distro (latest 0.21.0 still pins 1.44.0). Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
ayushtr-aws
enabled auto-merge
October 29, 2026 15:45
isadeks
approved these changes
Oct 29, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Clears the OSV findings that now fail
security:depsonmainand on open PRs such as #973. The advisory database changed under unchanged lockfiles, so this isn't a regression. 35 of the 38 findings are fixed by upgrades. The other 3 have no available fix and are ignored with a time limit (see below).Area
tooling— rootmise.toml, scripts, CI workflowsRelated
agent/uv.lockuv lock --upgrade-packageyarn.lock, forge-appresolutions+ forgeoverridesyarn.lock, forge-appresolutions+ forgeoverridesyarn.lockresolutionsfloor^8.1.6yarn.lockresolutions^4.6.6+ retire 6.1.0yarn.lockdocs/package.jsonyarn.lockresolutionsfloorChanges
package.jsonresolutions: raised the floors for fast-uri, undici and ip-address, and added vite and zod. fast-uri and undici are mirrored intointegrations/jira-forge-appoverridesand re-locked, socheck-transitive-pin-syncstays green.retire@5, soclianddocsmove toretire ^6.1.0, the first release that uses zod 4. The flags used bysecurity:retireare unchanged and the task passes.yarn.lockchurn comes only from these bumps: vite brings rolldown/lightningcss, plus astro's and retire's own dependencies.ignoreUntil = 2026-11-28, so the scan fails again after that date and the finding gets reviewed again):osv-scanner.toml: GHSA-gcqx-w48m-w2h4, deepmerge 4.3.1. No fixed release exists. It's only reached throughjest-config(test tooling) and is never deployed.agent/osv-scanner.toml: GHSA-xcq7-p3pf-p88h (opentelemetry-api) and GHSA-f5m9-jfrj-jjj7 (opentelemetry-propagator-jaeger). Both pinned exactly byaws-opentelemetry-distro; even the latest 0.21.0 pins 1.44.0, below the fix. The repo never enables the Jaeger propagator.Testing
mise run security:deps→ No issues foundmise run security:retirepasses on retire 6.1.0mise run drift-preventionpassesmise run build: agent (1800), cli (1079) and jira-forge-app tests, lint and docs all pass. CDK had 4 failures innetwork.test.tsandagent.test.ts: the container asset hash changed between two synths in the same test while agent tasks ran in parallel. Both files pass when run alone (32 passed). No CDK dependency changed.Acknowledgment
By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of the project license.