Conversation
Both were reached only through package.json overrides, and both had fallen behind a fixed release, so the weekly OSV scan went red on 2026-09-14: sharp 0.35.0 GHSA-rgj7-g3m4-5g8c bundled libheif RCE, CVSS 8.9 adm-zip 0.6.0 GHSA-vwc7-r8mq-g2x9 symlink-follow on extract, CVSS 6.8 The adm-zip advisory records last_affected rather than a fixed event, so the scanner table prints a blank fixed version. 0.6.1 is published and outside the affected range. OSV reports zero advisories against both new versions.
.osv-scanner.toml forces every suppressed advisory to carry an ignoreUntil. Nothing applied the same discipline to package.json overrides, and an exact pin is the one dependency shape that cannot drift forward on its own: Dependabot will not move it, and dependency-review.yml only inspects newly added dependencies at PR time. The result was a pin that aged invisibly until a weekly cron turned red days later. .override-pins.json records why each override exists and when it must be re-justified. test/override-freshness.test.ts runs in the free suite and fails once a reviewBy has passed, which moves the signal from an unwatched cron to a gate a human is already reading.
A weekly cron that only goes red is a signal nobody is subscribed to. On failure the workflow now opens (or comments on) an issue naming the run and the usual cause. Guarded on repository.has_issues so forks with issues disabled skip the job instead of erroring.
|
Merging to
After your PR is submitted to the merge queue, this comment will be automatically updated with its status. If the PR fails, failure details will also be posted here |
github-actions
Bot
changed the title
|
An error occurred while submitting your PR to the queue: |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #2866.
The weekly OSV Scanner run on
mainhas been failing since 2026-09-14. Two advisories, both in packages that reach the tree only throughpackage.jsonoverrides, both already fixed upstream.What changed
sharp0.35.0 to 0.35.4 clears GHSA-rgj7-g3m4-5g8c (bundled libheif RCE, CVSS 8.9).adm-zip0.6.0 to 0.6.1 clears GHSA-vwc7-r8mq-g2x9 / CVE-2026-76845 (symlink-follow on extract).POST https://api.osv.dev/v1/queryreturns zero vulns for both new versions.The
adm-zipadvisory recordslast_affectedrather than afixedevent, so the scanner table printsFIXED VERSION = --and reads as though the finding is unfixable. It is not; 0.6.1 is published and outside the affected range..override-pins.json+test/override-freshness.test.tsgive theoverridesblock the discipline.osv-scanner.tomlalready applies to suppressions. An exact pin is the one dependency shape that cannot drift forward on its own: Dependabot will not movesharp: "0.35.0", anddependency-review.ymlonly inspects newly added dependencies at PR time. So each override now carries a reason and areviewBydate, and the free suite fails when a pin has no rationale, when a rationale outlives its override, when areviewByhas passed, or when an exact pin no longer matches what the lockfile resolved. That moves the signal from an unwatched weekly cron to a gate a reviewer is already reading.osv-scanner.ymlopens an issue on a failed scheduled run, or comments on the open one, guarded onrepository.has_issuesso forks with issues disabled skip the job rather than erroring.Exposure
Low, and deliberately not the deciding factor. The only
sharpconsumer isbrowse/src/screenshot-size-guard.ts, which downscales full-page PNG screenshots and never decodes the AVIF or HEIF paths the libheif advisory covers. Nothing importsadm-zipdirectly; it arrives viaonnxruntime-nodeunder@huggingface/transformers. Both fixes are a one-line version change, so there was no reason to weigh exposure against cost.Verification
bun installrelocks cleanly, and the lockfile diff is scoped tosharp,adm-zip, and the@img/sharp-*platform packages.test/deps-smoke.test.ts(sharp import,metadata(), resize round-trip),test/override-freshness.test.ts, andtest/osv-config-wiring.test.tspass: 11 tests, 32 assertions.On the full free suite, honest reporting: it is not green in my container, and it is not green on the base commit either. Base
71f6048efails 52 tests, this branch fails 46, and diffing the two failure sets leaves exactly one branch-only entry, a PTY WebSocket test inbrowse/test/terminal-agent-integration.test.tsthat passes 3 of 3 in isolation on the branch and 2 of 2 on base. It is flake under shard load, not a regression. The shared baseline failures are environmental (nofilebinary for the compiled-binary check,~/.gstackhome state, TMPDIR-sensitive path-traversal tests), so CI should be the authority on suite health here rather than my numbers.VERSION is bumped to 1.84.2.0 with a CHANGELOG entry. Commits are bisected: the dependency bump, the freshness gate, the workflow change, and the release notes are each independently revertable.