Repository navigation
fix(audit-gate): confirm in-range fixes before failing on them - #2027
Merged
mrbobbytables merged 1 commit intoOct 31, 2026
Merged
Conversation
npm 10 (the CI toolchain) reports deepmerge's GHSA-gcqx-w48m-w2h4 as fixAvailable: true although every published release of deepmerge sits inside the advisory's vulnerable range, so `npm audit fix --package-lock-only` leaves the lockfile where it is. Taken at face value that reds the Validate repository check on every full-path PR (cncf#2025, cncf#2026) with an instruction nobody can carry out; npm 11 reports the same advisory as unfixable. The gate now asks `npm audit fix` itself: when a moderate/low finding is reported as fixable in range, it runs the fix on a scratch copy of package.json and package-lock.json and compares the named package's locked versions (at every nesting depth) before and after. A finding whose versions did not move is logged as a warning and no longer fails the gate; one that did move fails it exactly as before. A scratch run that cannot be judged (spawn error, deadline, no JSON, npm error document, unreadable lockfile) fails closed by treating every finding as real, so a registry fault behaves as it did before this check. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Signed-off-by: mrbobbytables <mrbobbytables@users.noreply.github.com>
✅ Deploy Preview for endusers ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
mrbobbytables
added this pull request to the merge queue
Oct 31, 2026
This was referenced Oct 31, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Since about 00:25Z on 2026-10-31 the required "Validate repository" check fails on every full-path PR (#2025, #2026) at
npm run check:audit:Nothing in those PRs touches the lockfile; the merge-queue runs of #2022/#2024 at 00:06Z passed on the identical Node 22 / npm 10.9.9 toolchain. The registry advisory for deepmerge now carries a bounded vulnerable range (
>=4.2.0 <=4.3.1) with no patched release — 4.3.1 is the latest deepmerge, published in 2023 — and npm 10 turns that intofixAvailable: true. Runningnpm audit fix --package-lock-onlywith npm 10 leaves deepmerge at 4.3.1 and re-reports the same finding, so the gate's instruction cannot be carried out. npm 11 reports the same advisory asfixAvailable: false.Change
scripts/audit-gate.mjsno longer trustsfixAvailableon its own for the moderate/low in-range check. It runsnpm audit fix --package-lock-only --ignore-scripts --no-fund --jsonon a scratch copy ofpackage.json,package-lock.json(and.npmrcwhen present), then compares the named package's locked versions at every nesting depth before and after:The scratch run is judged by the same contract
runAudit()uses: a completednpm audit fix --jsoncarriesaudit.vulnerabilities, an outage prints an error document; the exit code is 1 either way while any advisory remains.Verified locally with
npx npm@10on PATH: the current lockfile now yields the warning andaudit-gate: ok, and the working tree is untouched.SECURITY.mdgains a sentence describing the confirmation step.Tests: the stubbed-npm harness in
tests/audit-gate.test.mjsgains a lockfile sandbox and per-step lockfile writes; 11 new/updated CLI cases cover the confirmed, phantom, mixed, nested, removed, v1-lockfile and each fail-closed arm, and that the scratch copy is a temp dir (removed afterwards) rather than the project tree.npm run test:unit:coverage:check,check:lint,check:format,check:unused,check:duplicationandcheck:markdownpass.Remit: required CI check ("Validate repository") failing on every full-path PR on
main.