fix(ci): restore a runnable required gate - #35
Merged
Conversation
…sory GHSA-r28c-9q8g-f849 (high, CVSS 7.5) covers postcss <= 8.5.17: a `sourceMappingURL` comment in parsed CSS is resolved with `path.join` and read from disk, so `../` segments escape the stylesheet's directory and any reachable `.map` file can be disclosed through `result.map`. The advisory reached the database on 2026-07-24 and has been failing `audit:js` on every branch since, blocking all pull requests. postcss is transitive here and only ever parses our own stylesheets, so the practical exposure is low — but the audit is fail-closed by policy and the fix costs nothing. An override rather than a direct dependency: nothing in this repository imports postcss, and declaring it would misrepresent the dependency graph.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
chh-ay
changed the title
chh-ay
force-pushed
the
fix/postcss-path-traversal-advisory
branch
from
July 26, 2026 10:11
20cf1fa to
ad36cdd
Compare
Required CI waited unconditionally for a runner label backed by zero registered runners, so every pull request remained queued forever. A single non-ephemeral workstation is not a reliable merge prerequisite. Keep deterministic benchmark smoke and safety ceilings in ordinary CI. Keep the ten-round matched protocol as a documented, fail-closed local command for deliberate performance work, but remove it from the required workflow and its contract assertions.
chh-ay
force-pushed
the
fix/postcss-path-traversal-advisory
branch
from
July 26, 2026 10:23
ad36cdd to
e6e4a6e
Compare
Owner
Author
|
CI follow-up on the corrected workflow run: |
This was referenced Jul 26, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Required CI had two independent permanent blockers:
postcss@8.5.16is covered by GHSA-r28c-9q8g-f849, so Preflight failed on every branch, including unchangeddevelop.Matched Zero-Regression Performanceunconditionally targetedsheetwrite-perf-i9-12900h-cachyos, while the repository runner API reportstotal_count: 0. GitHub therefore queued the job forever, andRequired CIcould never start because it requiredPERFORMANCE=success.Neither fix can merge independently: the dependency-only PR hangs on the absent runner, while the workflow-only PR fails the dependency audit. This bootstrap PR contains both unblockers.
Change
8.5.23through a root override. PostCSS remains transitive; no allowlist exception.Required CIdependency.bench:verifyin ordinary CI.A single non-ephemeral workstation is not a reliable merge prerequisite. Timing evidence remains available when performance-sensitive work needs it, without letting missing runner registration deadlock every unrelated pull request.
Verification
bun run audit:js— 0 findingsbun run test:tooling— 134 pass, 0 failbun run docs:check— passedbun run changeset:ci— passed; the empty changeset records no package bumpbun run lint— no errors; one pre-existing warning for the 2 MiB conformance corpusThe fail-closed comparator then refused to issue a timing verdict, as designed, because this PR changes
bun.lockfor the patched PostCSS resolution. Runner identity, OS, CPU, Bun, Node, Chromium, power mode, and concurrency all match the baseline; the reported mismatch is limited toharness.sources.bun.lockand its aggregate digest. No baseline was rewritten or weakened to make this pass. This is dependency/harness staleness, not a measured regression result.The workflow now has no job referencing
sheetwrite-perf-i9-12900h-cachyos; branch protection requires only the aggregateRequired CI, which can settle using GitHub-hosted jobs.