Repository navigation
ci: patch fast-uri and qs, waive unfixable Prism faker advisory - #10
Merged
Merged
Conversation
npm audit --audit-level=moderate failed Regenerate SDK and CI with 9 findings: - fast-uri 4.1.2 (GHSA-5jgf/f65p/fph4/jqff, high): the override pinned a vulnerable version. Pin 4.1.4. - qs <= 6.15.3 (GHSA-x5fp/4mjr, moderate): not overridden. Pin 6.16.0. - @faker-js/faker 5.5.3 (GHSA-qxc2-j82w-r537, high) via Prism -> @stoplight/http-spec -> postman-collection, which hard-pins faker in every release. Not fixable by upgrading. Replace the bare npm audit step with scripts/audit-js-tooling.mjs, ported from archastro-python. It still fails at moderate and above, but waives GHSA-qxc2-j82w-r537 until 2026-12-31 and fails once the waiver goes stale. Prism here runs as a static mock of our generated spec with no --dynamic flag, so no Postman collection is parsed and faker generates nothing. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Review on ArchCode
Problem
Regenerate SDK(and CI on the regen PR) fails atAudit JS tooling dependencies:npm audit --audit-level=moderatereports 9 findings in the dev-only JS tooling, so the SDK is not regenerated from the latest spec.fast-uri4.1.2 — 4 high advisories; ouroverridespinned a vulnerable version (patched in 4.1.3).qs≤ 6.15.3 — 2 moderate advisories; no override.@faker-js/faker5.5.3 — GHSA-qxc2-j82w-r537 (high), reached via Prism →@stoplight/http-spec→postman-collection. Everypostman-collectionrelease (latest 5.3.1) hard-pins faker 5.5.3, and overriding it breaks Prism. The other 5 findings are this chain.What changed
overrides:fast-uri→ 4.1.4,qs→ 6.16.0 (same as archastro-python / archastro-rust).scripts/audit-js-tooling.mjs: ported from archastro-python. Fails on any advisory at moderate+, except a dated waiver for GHSA-qxc2-j82w-r537 (expires 2026-12-31). Fails if the waiver expires or stops matching.ci.yml,regenerate-sdk.yml:npm audit --audit-level=moderate→node scripts/audit-js-tooling.mjs.Why the waiver is safe here:
contracttests/support_test.goprismArgs()(guarded byTestPrismUsesDeterministicStaticResponses) startsprism mock <openapi.json>against our generated spec with no--dynamic, so no Postman collection is parsed and faker generates nothing. Prism is a devDependency and never ships.Scope / risk
CI + dev tooling only. No SDK code or published package changes. Low risk.
Testing
node scripts/audit-js-tooling.mjslocally →JS tooling audit clean at moderate and above (waived: GHSA-qxc2-j82w-r537), exit 0.npm auditafter the pins shows only the 6 faker-chain entries.Regenerate SDKrun is the real proof.Follow-up
Remove the waiver once
postman-collectionships a patched faker; the script fails when the waiver expires (2026-12-31).🤖 Generated with Claude Code