Skip to content

fix(deps): bump astro to 7.1.3 + re-resolve brace-expansion to clear osv-scanner (#636) - #637

Merged
isadeks merged 1 commit into
mainfrom
fix/636-osv-deps-bump
Jul 21, 2026
Merged

fix(deps): bump astro to 7.1.3 + re-resolve brace-expansion to clear osv-scanner (#636)#637
isadeks merged 1 commit into
mainfrom
fix/636-osv-deps-bump

Conversation

@scottschreckengaust

@scottschreckengaust scottschreckengaust commented Jul 21, 2026

Copy link
Copy Markdown
Contributor

What & why

The osv-scanner required check (Secrets, deps, and workflow scan → Dependency scan (osv-scanner))
fails on main's yarn.lock, which ejects every PR from the merge queue — the merge_group
re-scan runs against the latest main and fails any queued PR. Observed on #623, which is otherwise
approved + CLEAN but kept getting removed from the queue by github-merge-queue[bot].

These advisories were published after the affected PRs' PR-open scans, so PR-level checks are
green while the merge_group re-scan is red.

Closes #636.

Changes (lockfile-only + one version string)

  • astro 7.0.5 → 7.1.3 (docs/package.json). Fixes GHSA-4g3v-8h47-v7g6 (reflected XSS),
    GHSA-8mv7-9c27-98vc, GHSA-f48w-9m4c-m7f5.
  • brace-expansion re-resolved within the existing ^1.1.7 / ^2.0.2 ranges:
    1.1.15 → 1.1.16 and 2.1.1 → 2.1.2 (GHSA-3jxr-9vmj-r5cp, CVSS 7.7). Transitive-only, so no
    resolutions pin was needed — the caret ranges already permit the patched versions.

Verification

  • mise run security:deps (osv-scanner, exact CI command) → No issues found (exit 0).
  • mise //docs:build → 68 pages built clean under astro 7.1.3.
  • mise run security:retire → clean.
  • Range-scoped gitleaks (origin/main..HEAD) → no leaks (the pre-push full-history hit is
    pre-existing history on other branches, unrelated to this diff).

Supersedes

Dependabot #631 and #630 (both bump astro to the malicious 7.1.0) — close as superseded
once this lands.

bgagent @claude
fix(deps): bump astro to 7.1.3 + re-resolve brace-expansion to clear …
922070c 
…osv-scanner (#636)

The osv-scanner required check (`Secrets, deps, and workflow scan`) fails on main's
yarn.lock, ejecting every PR from the merge queue (observed on #623). Advisories were
published after PR-open scans, so PR-level checks are green while the merge_group
re-scan is red.

- astro 7.0.5 -> 7.1.3 (docs/package.json). Fixes GHSA-4g3v-8h47-v7g6 (XSS),
  GHSA-8mv7-9c27-98vc, GHSA-f48w-9m4c-m7f5. NOTE: intentionally 7.1.3, NOT 7.1.0 —
  7.1.0 (the version Dependabot #631/#630 target, and the "fixed" version GHSA-4g3v
  cites) is flagged malicious by MAL-2026-10726. 7.1.3 is the current `latest` and is
  past the single poisoned release.
- brace-expansion re-resolved within existing ^1.1.7/^2.0.2 ranges: 1.1.15 -> 1.1.16
  and 2.1.1 -> 2.1.2 (GHSA-3jxr-9vmj-r5cp). Transitive-only; no resolutions pin needed.

Lockfile-only (+ one version string). Verified: `mise run security:deps` exits 0,
`mise //docs:build` builds 68 pages clean, `mise run security:retire` clean.
Supersedes Dependabot #631/#630 (which bump to the malicious 7.1.0).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
@scottschreckengaust
scottschreckengaust requested review from a team as code owners July 21, 2026 16:29
isadeks
isadeks approved these changes Jul 21, 2026
View reviewed changes

@isadeks isadeks left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Approving — verified independently.

Correct fix, correctly scoped. Diff is lockfile-only + one version string (docs/package.json + yarn.lock), no code touched:

  • astro 7.0.5 → 7.1.3 — clears the three XSS advisories (GHSA-4g3v-8h47-v7g6 / -8mv7-9c27-98vc / -f48w-9m4c-m7f5), and deliberately 7.1.3, not the 7.1.0 Dependabot #631/#630 targeted — 7.1.0 is flagged malicious by MAL-2026-10726 (confirmed: 7.1.0 returns that advisory in OSV, 7.1.3 is clean).
  • brace-expansion 1.1.15 → 1.1.16 + 2.1.1 → 2.1.2 (GHSA-3jxr-9vmj-r5cp) — re-resolved within the existing caret ranges, no resolutions pin needed. Both patched versions confirmed clean in OSV.

All 8 checks green, incl. the previously-failing Secrets, deps, and workflow scan — osv-scanner logs "No issues found" (exit 0). This clears the merge_group re-scan that was ejecting approved PRs from the queue, and the same red check on #616 and other open PRs.

Superseding #631/#630 is the right call — both bump into the poisoned 7.1.0.

@isadeks isadeks mentioned this pull request Jul 21, 2026
Closed
@isadeks
isadeks added this pull request to the merge queue Jul 21, 2026
@isadeks isadeks mentioned this pull request Jul 21, 2026
Closed
Merged via the queue into main with commit 5ec6e14 Jul 21, 2026
8 checks passed
@isadeks
isadeks deleted the fix/636-osv-deps-bump branch July 21, 2026 16:43
This was referenced Jul 21, 2026
Merged
Merged
Merged
isadeks pushed a commit to isadeks/sample-autonomous-cloud-coding-agents that referenced this pull request Jul 28, 2026
@scottschreckengaust bgagent @claude
fix(deps): bump astro to 7.1.3 + re-resolve brace-expansion to clear …
6765a55 
…osv-scanner (aws-samples#636) (aws-samples#637)

The osv-scanner required check (`Secrets, deps, and workflow scan`) fails on main's
yarn.lock, ejecting every PR from the merge queue (observed on aws-samples#623). Advisories were
published after PR-open scans, so PR-level checks are green while the merge_group
re-scan is red.

- astro 7.0.5 -> 7.1.3 (docs/package.json). Fixes GHSA-4g3v-8h47-v7g6 (XSS),
  GHSA-8mv7-9c27-98vc, GHSA-f48w-9m4c-m7f5. NOTE: intentionally 7.1.3, NOT 7.1.0 —
  7.1.0 (the version Dependabot aws-samples#631/aws-samples#630 target, and the "fixed" version GHSA-4g3v
  cites) is flagged malicious by MAL-2026-10726. 7.1.3 is the current `latest` and is
  past the single poisoned release.
- brace-expansion re-resolved within existing ^1.1.7/^2.0.2 ranges: 1.1.15 -> 1.1.16
  and 2.1.1 -> 2.1.2 (GHSA-3jxr-9vmj-r5cp). Transitive-only; no resolutions pin needed.

Lockfile-only (+ one version string). Verified: `mise run security:deps` exits 0,
`mise //docs:build` builds 68 pages clean, `mise run security:retire` clean.
Supersedes Dependabot aws-samples#631/aws-samples#630 (which bump to the malicious 7.1.0).

Co-authored-by: bgagent <bgagent@noreply.github.com>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
@github-actions github-actions Bot mentioned this pull request Aug 1, 2026
Closed
This was referenced Sep 1, 2026
Merged
Closed
ClintEastman02 pushed a commit to ClintEastman02/sample-autonomous-cloud-coding-agents that referenced this pull request Sep 1, 2026
@isadeks
chore(deps): re-resolve browserslist to clear two HIGH OSV advisories (…
4da0a1f 
…aws-samples#844)

`security:deps` (osv-scanner) started failing on every PR in the repo today:

  GHSA-73wf-gq98-2v4g  7.5  npm  browserslist  4.28.5  fixed in 4.28.7
  GHSA-c83g-rgw3-j3cx  7.5  npm  browserslist  4.28.5  fixed in 4.28.7

Not specific to any branch — `main` carries 4.28.5, so the gate fails wherever
it runs. Reproduced locally against `main` before and after this change.

Lockfile-only, following the aws-samples#637 precedent. `browserslist` is transitive (no
direct entry in any `package.json`), so `yarn upgrade browserslist` is a no-op
under yarn v1; dropping the pinned stanza and re-installing lets it resolve
within the existing `^4.24.0` range, landing 4.28.8. No `package.json` change,
so no `resolutions` entry and nothing to mirror into
`integrations/jira-forge-app` — the advisory's only source is `yarn.lock`.

The 56-line delta is confined to browserslist and the five data packages it
pins: baseline-browser-mapping, caniuse-lite, electron-to-chromium,
node-releases, update-browserslist-db.

Verified: `osv-scanner` reports "No issues found", and `mise run build` is green
including the Astro docs build, which is what actually consumes browserslist.
@scottschreckengaust scottschreckengaust mentioned this pull request Sep 1, 2026
Closed
This was referenced Sep 2, 2026
Closed
Merged
Merged
vivibui pushed a commit to vivibui/sample-autonomous-cloud-coding-agents that referenced this pull request Sep 9, 2026
@isadeks
fix(deps): clear 7 osv advisories blocking the merge queue (aws-sampl…
e96dc21 
…es#870)

* fix(deps): clear 6 osv advisories in astro, sharp, svgo, js-yaml

osv-scanner fails on main's yarn.lock, which ejects every PR from the
merge queue: the merge_group re-scan runs against the latest main and
fails whatever is queued. Observed on aws-samples#867. These advisories were all
published after 2026-09-07 — osv-scanner reported "No issues found" in
the scheduled run recorded on aws-samples#861 — so PR-level scans that ran before
then are green while the re-scan is red.

- astro 7.1.3 -> 7.2.8 (docs/package.json, an exact pin).
  GHSA-26w7-cxv4-gfx2 (9.8), GHSA-376h-93r7-7g6f (6.3).
- js-yaml 4.3.1 -> 4.3.2 (GHSA-2883-xcg3-v3hh, 7.5). Root
  `resolutions` already reads ^4.3.1, so the caret admits the patch and
  no manifest changes.
- sharp 0.35.3 -> 0.35.4 (GHSA-rgj7-g3m4-5g8c, 8.9) and svgo
  4.0.2 -> 4.1.0 (GHSA-4vpr-x523-8j87, GHSA-w27v-7q3p-w38r).
  Transitive-only under caret ranges, so lockfile-only.

Re-resolved surgically rather than via `mise run upgrade`, which does
`rm -f yarn.lock && yarn install` and moved 328 packages here —
including aws-cdk-lib, constructs, jest, eslint and major jumps in
glob, commander, chalk and yargs. Burying six CVE fixes in a wholesale
upgrade makes the diff unreviewable and any regression unbisectable, so
only the four advisory entries (plus the @img/sharp-* platform
binaries) were dropped from the lockfile before `yarn install`. The
resulting delta is 50 changed / 1 added / 1 removed, all inside astro's
own closure and the four targets; no cdk or cli dependency moves.

MAL-2026-10726 — the malicious-release advisory that made aws-samples#637 pin
astro 7.1.3 rather than 7.1.0 — was withdrawn on 2026-07-17 and no
longer constrains the choice. No active malicious advisory affects any
of the four packages.

Verified: `mise run security:deps` (exact CI command) reports no
issues; `mise run security:retire` clean; `mise run drift-prevention`
exit 0; `mise //docs:build` builds 77 pages and `//docs:check` reports
0 errors under astro 7.2.8; `mise run build` clean with cdk 211 suites
/ 4471 tests and cli 60 suites / 903 tests passing. The bootstrap
golden-baseline snapshot passes unchanged, confirming js-yaml 4.3.2
does not alter template serialisation (relevant to aws-samples#867, which tunes
that dump's flowLevel).

* fix(deps): clear GHSA-7w5x-hrqm-74c2 in smol-toml

A seventh advisory landed while this PR was in flight, and it is the
same race the PR describes happening to the PR itself:
GHSA-7w5x-hrqm-74c2 (8.2, denial of service via malformed TOML) was
published 2026-09-09T18:07:11Z and the PR's first CI run started at
18:27:21Z, so the local scan twenty minutes earlier could not have
seen it.

smol-toml 1.7.0 is present on main unchanged, so this is not fallout
from the astro bump. Requesters are @astrojs/internal-helpers, astro
and knip, all under ^1.6.0 / ^1.6.1, so the caret admits the fix and
this is lockfile-only: 1.7.0 -> 1.8.0, the highest in range and past
the 1.7.1 first-patched version.

Verified: `mise run security:deps` reports no issues; `mise run build`
exits 0 with cdk 211 suites / 4471 tests and cli 60 suites / 903 tests;
`//docs:check` 0 errors and `//docs:build` 77 pages; security:retire
and drift-prevention exit 0. Delta against the previous commit is one
package and three lines.

Unrelated and pre-existing: `mise run check:deadcode-ratchet` reports
111 findings against an 85 baseline. Confirmed by restoring main's
docs/package.json and yarn.lock and re-running, which reports the
identical 111 — so it is not caused by this branch. CI's dead-code job
is advisory and passes.
@scottschreckengaust scottschreckengaust added the v1 Version 1 label Sep 14, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@isadeks isadeks isadeks approved these changes

Assignees

No one assigned

Labels

v1 Version 1

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

fix(deps): bump astro (7.1.0) + brace-expansion to clear osv-scanner failures blocking the merge queue

2 participants

@scottschreckengaust @isadeks