Revert the brace-expansion CVE suppressions from #463 - #484
Merged
Conversation
Removes the two [[IgnoredVulns]] entries added in #463, restoring osv-scanner.toml to having no suppressions. The real dependency bumps from that PR are deliberately kept: brace-expansion 1.1.16 / 2.1.3 and ip-address 10.3.1 (the latter a production dependency via socks) all stay in package-lock.json. Why revert: [[IgnoredVulns]] entries are CVE-id global in OSV-Scanner v2.3.8 -- they silence the advisory across every package it is reported against, not just brace-expansion. That is broader than the problem being solved, and the entries landed inside a security PR without a security reviewer explicitly signing off on them. Backing them out so the decision can be made on its own merits. Consequence, intentional: the Security Scan gate fails again on three dev-only brace-expansion findings (GHSA-mh99-v99m-4gvg, GHSA-rgw5-rvv9-x895). There is no published fix -- the advisories name 1.1.17/1.1.18/2.1.4 but npm's latest releases are 1.1.16 and 2.1.3. These are dev-only: brace-expansion reaches us solely via the eslint/glob/test-exclude toolchains through minimatch, `npm ls brace-expansion --omit=dev` is empty, and both lockfile entries are marked "dev": true, so they are not reachable from the published dist/. Impact is DoS on adversarial brace patterns, which would require untrusted input to our own lint/test globs. Note the gate was already failing on main before #463 for these same dependencies, so this restores the prior state rather than causing a new regression. Signed-off-by: Madhavendra Rathore <madhavendra.rathore@databricks.com>
![peco-review-bot[bot]](https://avatars.githubusercontent.com/in/3801177?s=60&v=4){kind=small}
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Reverts the two
[[IgnoredVulns]]entries I added in #463, restoringosv-scanner.tomlto having no suppressions.The real dependency bumps from #463 are deliberately kept — this PR touches only
osv-scanner.toml:brace-expansionip-addresssocks)[[IgnoredVulns]]× 2Why
[[IgnoredVulns]]entries are CVE-id global in OSV-Scanner v2.3.8 — they silence the advisory across every package it is reported against, not justbrace-expansion. That is broader than the problem being solved, and (a limitation the config file itself documents) there is no way to scope a suppression to one package without blanket-ignoring all of that package's vulnerabilities.More importantly, those entries landed inside a security-focused PR without a security reviewer explicitly signing off on the suppression decision. Backing them out so it can be judged on its own merits rather than riding along with the TLS fix.
Consequence — intentional
The
Security Scangate will fail on this PR. Three dev-only findings resurface:GHSA-mh99-v99m-4gvg— brace-expansion 1.1.16 (fixed in 1.1.17)GHSA-rgw5-rvv9-x895— brace-expansion 1.1.16 (fixed in 1.1.18) and 2.1.3 (fixed in 2.1.4)There is no published fix: the advisories name 1.1.17/1.1.18/2.1.4, but npm's latest releases are 1.1.16 and 2.1.3. The bumps in #463 already went as far as the registry allows.
These are dev-only:
brace-expansionreaches us solely through the eslint / glob / test-exclude toolchains viaminimatch.npm ls brace-expansion --omit=devis empty and both lockfile entries are marked"dev": true, so it is not reachable from the publisheddist/. Impact is DoS (ReDoS / OOM) on adversarial brace patterns, which would require untrusted input to our own lint/test globs.Note the gate was already failing on
mainbefore #463 for these same dependencies, so this restores the prior state rather than introducing a new regression.Decision needed from reviewers
Pick one:
Security Scanuntil 1.1.18 / 2.1.4 publish upstream.[[IgnoredVulns]].Testing
osv-scannerv2.3.8 (the version CI pins) run locally: confirms exactly the three expected findings return, no others.This pull request and its description were written by Isaac.