[luv-legion-650] Clear the undici advisories and land Dependabot #641-#649 by NiveditJain · Pull Request #650 · FailproofAI/failproofai

NiveditJain · 2026-08-04T06:03:58Z

Every open PR in the repo was red on the Supply Chain (OSV-Scanner) gate —
including all nine open Dependabot bumps, none of which touch the package that
was failing. This clears the shared blocker and folds those nine bumps in.

Based on failproofaid and targeted at it, since #632 is the branch currently
carrying release work and needs the gate green.

The blocker: five `undici` advisories

undici@7.28.0 picked up five advisories that published after main's last
green scan, so every branch went red at once with no dependency change of its
own:

Advisory	CVSS	Summary
GHSA-4cwx-7wf7-3272	7.4 high	Cross-user information disclosure + parse-time crash via degenerate private cache directives
GHSA-jr45-8vmc-qm54	5.9	Same disclosure via whitespace around `=` in `Cache-Control`
GHSA-8xcm-r25x-g524	4.8	Downstream response desynchronization via the retry interceptor
GHSA-v3r7-h72x-cjcm	4.8	Cookie attribute injection via unsanitized domain / unparsed `setCookie`
GHSA-m8rv-5g2x-5cg5	4.2	CRLF injection via a blob-like body `type`

All five are fixed in 7.29.0. undici is not a direct dependency — it
arrives transitively under the jsdom test environment — and the 7.28.0 pin was
itself the previous round of this same fix (#446), so the repair is a one-line
bump of that existing overrides entry rather than a lockfile update. Fixing
rather than allow-listing, per osv-scanner.toml's stated preference.

Same shape as the brace-expansion fix on #632 and the next/sharp incident
before it (#591).

Folding in Dependabot #641–#649

With the shared blocker gone, each of these was red on that finding and nothing
of its own, so they land here rather than as nine separate merges:

PR	Bump
#641	`actions/download-artifact` 4 → 8
#642	`docker/login-action` 4.5.1 → 4.6.0
#643	`actions/upload-artifact` 4 → 7
#644	`posthog-node` 5.46.1 → 5.47.7
#645	`jsdom` 30.0.0 → 30.0.1
#646	`@tanstack/react-virtual` 3.14.8 → 3.14.9
#647	`lucide-react` 1.27.0 → 1.28.0
#648	`@types/node` 26.1.1 → 26.1.2
#649	`@vitejs/plugin-react` 6.0.3 → 6.0.5

The npm bumps move their declared floors too, so the tree cannot resolve back.
Those six packages plus their transitive companions (@posthog/core,
@posthog/types, @tanstack/virtual-core) are the only entries the
lockfile moves — verified against the diff, no incidental drift.

The two artifact actions have to land together

build-daemon.yml uploads the failproofaid-* binaries that publish.yml
downloads, so bumping one major without the other would split the release path
across two versions. Rather than assume the majors are drop-in, every input in
use was checked against each target's action.yml:

upload v7 — name, path, if-no-files-found all survive; the new
archive input defaults to true, so the artifact is still zipped.
download v8 — pattern, path, merge-multiple all survive; skip-decompress
defaults to false, so the zip round trip is unchanged.

Both carry a node24 runtime. translate-docs.yml was already on v7/v8, so
this leaves the repo on one major instead of straddling two.
docker/login-action stays SHA-pinned (dbcb8138…, verified against the v4.6.0
tag), as that workflow pins all of its actions.

Verification

CI's own scanner image (ghcr.io/google/osv-scanner-action:v2.3.8) run
against the updated lockfile: No issues found, exit 0 — with
osv-scanner.toml still holding zero ignored vulnerabilities. The same
image against the pre-fix lockfile reproduces the CI failure exactly
(2 packages, 6 vulnerabilities).
All four CI jobs reproduced locally before pushing: bun run lint (0 errors,
the same 5 pre-existing warnings), tsc --noEmit clean, bun run test:run,
bun run build, bun run test:e2e — all green.
This exact commit was also pushed to failproofaid and ran a full green CI
sweep there (all 17 checks, including OSV-Scanner, all four
cross-compile legs, and test-e2e) before being moved onto this branch.

#641–#649 are closed in favour of this PR.

🤖 Generated with Claude Code

https://claude.ai/code/session_013zdtoUrNwGKm7ZYpQTdBZy

The Supply Chain (OSV-Scanner) gate was red on every open PR, including all nine Dependabot bumps, on a finding none of them introduced: five undici advisories published after main's last green scan. undici is transitive under the jsdom test environment and already pinned via `overrides` from the previous round of this same fix (#446), so the repair is a one-line bump of that pin to 7.29.0. With the shared blocker gone, the nine bumps are folded in here rather than merged one at a time: #641 actions/download-artifact 4 -> 8 #642 docker/login-action 4.5.1 -> 4.6.0 #643 actions/upload-artifact 4 -> 7 #644 posthog-node 5.46.1 -> 5.47.7 #645 jsdom 30.0.0 -> 30.0.1 #646 @tanstack/react-virtual 3.14.8 -> 3.14.9 #647 lucide-react 1.27.0 -> 1.28.0 #648 @types/node 26.1.1 -> 26.1.2 #649 @vitejs/plugin-react 6.0.3 -> 6.0.5 The two artifact actions are major bumps and have to land together, because build-daemon.yml uploads the failproofaid-* binaries that publish.yml downloads. Every input in use was checked against each target's action.yml rather than assumed: name/path/if-no-files-found and pattern/path/merge-multiple all survive, and the new `archive` input defaults to true so the zip round trip is unchanged. translate-docs.yml was already on v7/v8, so this leaves the repo on one major instead of straddling two. Verified with CI's own scanner image (osv-scanner-action:v2.3.8) against the updated lockfile: No issues found, exit 0, with osv-scanner.toml still holding zero ignored vulnerabilities. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013zdtoUrNwGKm7ZYpQTdBZy

coderabbitai · 2026-08-04T06:04:06Z

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 1510a033-dbc6-47bb-811a-b8dd2ed6109d

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

socket-security · 2026-08-04T06:04:10Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Quality	Maintenance
npm/@tanstack/react-virtual@3.14.8 ⏵ 3.14.9			⁺¹
npm/posthog-node@5.46.1 ⏵ 5.47.7	⁺¹	⁺¹	⁺¹
npm/lucide-react@1.27.0 ⏵ 1.28.0
npm/@types/node@26.1.1 ⏵ 26.1.2			⁺²
npm/jsdom@30.0.0 ⏵ 30.0.1	⁺⁵	⁺¹	⁺⁷
npm/@vitejs/plugin-react@6.0.3 ⏵ 6.0.5	⁺¹	⁺¹

View full report

socket-security · 2026-08-04T06:04:12Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		Obfuscated code: npm `jsdom` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package.json → `npm/jsdom@30.0.1` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/jsdom@30.0.1`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

The entries were written while the fix sat on the failproofaid branch; it now ships as its own PR. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013zdtoUrNwGKm7ZYpQTdBZy

docs(changelog): point the dependency entries at #650

45d0236

The entries were written while the fix sat on the failproofaid branch; it now ships as its own PR. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013zdtoUrNwGKm7ZYpQTdBZy

NiveditJain merged commit 00216d8 into failproofaid Aug 4, 2026
10 checks passed

Navigation Menu

Uh oh!

[luv-legion-650] Clear the undici advisories and land Dependabot #641-#649 - #650

[luv-legion-650] Clear the undici advisories and land Dependabot #641-#649#650
NiveditJain merged 2 commits into
failproofaidfrom
luv-legion-650

NiveditJain commented Aug 4, 2026

Uh oh!

coderabbitai Bot commented Aug 4, 2026 •

edited

Loading

Review skipped

Uh oh!

socket-security Bot commented Aug 4, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Aug 4, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

NiveditJain commented Aug 4, 2026

The blocker: five undici advisories

Folding in Dependabot #641–#649

The two artifact actions have to land together

Verification

Uh oh!

coderabbitai Bot commented Aug 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

socket-security Bot commented Aug 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security Bot commented Aug 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

The blocker: five `undici` advisories

coderabbitai Bot commented Aug 4, 2026 •

edited

Loading

socket-security Bot commented Aug 4, 2026 •

edited

Loading

socket-security Bot commented Aug 4, 2026 •

edited

Loading