Repository navigation
Fix open security alerts and automate the ones Dependabot can't - #59
Merged
Merged
Conversation
Dependabot reported "No update possible" for follow-redirects, blocked by our exact override, and for glob and minimatch, held back by their parents' ranges. Override all three, and add a daily workflow that does the same for future advisories. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
GitHub holds CI on github-actions[bot] PRs for approval, so the required checks never ran. A token-authored PR triggers CI normally, which also makes the manual CI dispatch unnecessary. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Four Dependabot alerts stayed open because its security update run logged "No update possible":
1.16.1override.minimatch ^10, rimraf 5 needsglob ^10).Dependabot doesn't edit
overrides, so these never resolve on their own.Changes
follow-redirects ^1.16.2,minimatch ^11.0.3(both packages),glob ^14.0.3(back end).npm audit fixalso movedzodin the front end.npm auditnow reports 0 vulnerabilities in both.security-auto-fix.ymlruns daily and calls.github/scripts/fix-advisories.js, which runsnpm audit fix, overrides any transitive package still flagged, and opens a PR. It auto-merges after CI unless a package changes major version, matching the policy independabot-auto-merge.yml.SECURITY_AUTOFIX_TOKEN. PRs fromgithub-actions[bot]have their CI held for approval, so the required checks would never run.Risk
minimatch11 andglob14 are outside what their parents declare. Lint, build, 61 browser tests and 64 API tests pass locally. In productionglobis only reachable through rimraf in google-gax.Before the workflow can work
Add the
SECURITY_AUTOFIX_TOKENrepo secret: a fine-grained token limited to this repo with Contents and Pull requests write access. The token path has not been run on GitHub yet.🤖 Generated with Claude Code