fix(deps): resolve all npm audit findings and cover npm with Dependabot - #48
Merged
Conversation
npm audit failed on main with 6 findings, blocking every pull request. The critical one is GHSA-hpcx-pg6g-x697, "Malicious code in astro", which applies to exactly the version pinned in the lockfile (7.1.0) — a compromised release, not a latent bug. The others are a postcss path traversal and a yaml stack overflow reached through @astrojs/language-server. npm audit fix resolves all six. The change is lockfile-only: astro moves 7.1.0 -> 7.1.4 inside the existing ^7.1.0 range, so package.json and the declared dependencies are untouched and the site still builds. Add npm to Dependabot, which so far only watched github-actions. That gap is why a compromised package version could sit in the lockfile unnoticed: the audit workflow reports the problem but nothing was proposing the upgrade that fixes it. The existing github-actions block is left exactly as it was. Signed-off-by: Sebastian Mendel <info@sebastianmendel.de>
Contributor
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.OpenSSF ScorecardScorecard details
Scanned Files
|
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
npm auditfails onmain, which blocks every pull request in this repo — that is how it surfaced (it blocked #47, an unrelated one-line change).Findings
sourceMappingURLauto-loadingThe critical one is worth calling out: it applies to exactly
=7.1.0, the version pinned in the lockfile. That is a compromised release rather than a latent bug, so it warrants attention beyond the usual audit noise.The fix
npm audit fixclears all six. The change is lockfile-only — astro moves 7.1.0 → 7.1.4 within the existing^7.1.0range, sopackage.jsonand the declared dependency set are untouched.Verified after the change:
Why it could happen, and what stops a repeat
Dependabot watched only
github-actionshere — npm was never covered. The audit workflow reported the problem, but nothing was proposing the upgrade that fixes it, so a compromised package version could sit in the lockfile indefinitely.This adds an
npmecosystem entry alongside the existing one. The existinggithub-actionsblock is left byte-for-byte as it was; the diff removes zero lines.Note on #47
#47 (removing the sunset Go Report Card badge from the classifier) is blocked solely by this audit failure and needs no change of its own — it should go green once this lands.