fix(deps): clear the five high advisories failing the Security workflow - #144
Merged
Conversation
`npm audit --audit-level=high` has been failing on main and on every PR, so the Security workflow mailed a failure on each push while gating nothing. Five high advisories, all transitive, all in the build toolchain: brace-expansion (2 DoS), fast-uri (2 host-confusion), js-yaml (quadratic CPU on merge-key chains), postcss (path traversal via sourceMappingURL), svgo (removeScripts leaves some scripts intact). `npm audit fix` resolved all five within existing semver ranges — the diff is package-lock.json only, no package.json change and no --force. Now reports 0 vulnerabilities. Verified after the bump: lint, format:check, check (0 errors), test:websub, build, check:skill (166 pages) all pass. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Deploying specification-website with
|
| Latest commit: |
77d7515
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://6bf74c10.specification-website.pages.dev |
| Branch Preview URL: | https://fix-npm-audit-high-2026-07-3.specification-website.pages.dev |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
npm audit --audit-level=highhas been failing onmainand on every PR, so the Security workflow has been mailing a failure on each push while gating nothing — a check that is always red stops carrying information.What was failing
Five high advisories, all transitive, all in the build toolchain:
brace-expansionfast-urijs-yamlpostcsssourceMappingURLsvgoremoveScriptsleaves some scripts intactThe fix
npm audit fix— no--force. All five resolved within existing semver ranges, so the diff ispackage-lock.jsononly: nopackage.jsonchange, no version pins moved, nothing for anyone to re-review. Now reportsfound 0 vulnerabilities.Resolved to
brace-expansion@5.0.9,fast-uri@3.1.5,js-yaml@4.3.0,postcss@8.5.25,svgo@4.0.2.Verified after the bump
npm run lint✓ ·npm run format:check✓ ·npm run check✓ (0 errors, 0 warnings) ·npm run test:websub✓ ·npm run build✓ ·npm run check:skill✓ (166 pages, MCP 2026-07-28)postcssandsvgosit in the Tailwind and image-generation paths respectively, so the build passing is the meaningful signal here, not a formality.Worth knowing
These are all dev dependencies. The site is static, so none of this ever reached a visitor — the exposure was to the build, not to production. That is why the gate at
--audit-level=highwas the right severity and why clearing it is cheap; I have deliberately not touched the threshold. The four remaining moderate advisories still surface without blocking, exactly as the comment insecurity.ymlintends.🤖 Generated with Claude Code