fix(ci): unblock docs-only PRs + remediate JS dep CVEs - #94
Merged
Conversation
Branch protection requires `ci / Lint`, `ci / Test (ubuntu-latest)`, `ci / Build` and `ci / Security (nox)`, but the pull_request trigger had paths-ignore for **.md, docs/** and LICENSE. A docs-only PR therefore skipped the whole workflow, the required checks never reported, and the PR was BLOCKED forever — mergeable only via an admin override (this is what blocked #93). Drop paths-ignore from the pull_request trigger so the workflow always runs and reports its required contexts. Running CI on a docs PR is cheap (no Go code changed, so the build/test caches hit). The push-to-main trigger keeps its paths-ignore, so merges of docs changes still skip CI. Mirrors the same fix already applied in warden and nox. Claude-Session: https://claude.ai/code/session_01Cr6YdzphmFF3NJqm7kSJom
Force-patched transitive npm dependencies via package.json overrides to eliminate net-new high-severity CVEs flagged by nox 1.16.1. - fast-uri 3.1.2 -> 3.1.4 (GHSA-4c8g-83qw-93j6 / CVE-2026-13676, host confusion via failed IDN canonicalization; GHSA-v2hh-gcrm-f6hx / CVE-2026-16221, host confusion via literal backslash authority delimiter) - postcss 8.5.16 -> 8.5.18+ (GHSA-r28c-9q8g-f849, path traversal in source map auto-loading) - svgo 4.0.1 -> 4.0.2 (GHSA-2p49-hgcm-8545, removeScripts plugin leaves some executable scripts intact) Verified: build (astro build) and tests (vitest, 29/29) pass; nox scan reports 0 net-new critical/high findings. Claude-Session: https://claude.ai/code/session_01Cr6YdzphmFF3NJqm7kSJom
felixgeelhaar
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Supersedes #93 — carries both fixes on one branch, because they were circularly blocked.
The deadlock
ci / Lint,ci / Test (ubuntu-latest),ci / Build,ci / Security (nox).ci.ymlhadpaths-ignore: ["**.md", "docs/**", "LICENSE"]on thepull_requesttrigger — so adocs/-only PR skipped the workflow entirely, never reported the required checks, and sat atBLOCKEDforever (only landable with--admin). That blocked fix(security): remediate known CVEs in JS deps #93.ci / Security (nox)fails onmain's 4 pre-existing high-severity JS CVEs — which is exactly what fix(security): remediate known CVEs in JS deps #93 fixes.→ #94 couldn't go green without #93; #93 couldn't merge without #94. Hence one branch.
Commit 1 —
fix(ci)Drop
paths-ignorefrom thepull_requesttrigger so the workflow always runs and reports its required contexts. Thepush-to-maintrigger keeps itspaths-ignore, so merging docs changes still skips CI. Running CI on a docs PR is cheap (no Go code changed → cache hits). Mirrors the identical fix already in warden and nox.Commit 2 —
fix(security)(cherry-picked from #93)Remediate the 4 net-new high CVEs flagged by nox 1.16.1, forcing patched transitive versions via npm
overridesindocs/package.json:fast-uripostcsssvgoVersions were OSV-cross-checked: nox's
fixed_inreports the fix for a different affected range on multi-range advisories (fast-uri4.0.1/2.4.3,svgo2.8.3). The correct in-major fixes are the ones above — no cross-major downgrade.Verification
nox scan .on this branch: 0 net-new critical/high (was 4).Part of the fleet-wide nox 1.10 → 1.16.1 upgrade (klarlabs-studio/.github#41).
https://claude.ai/code/session_01Cr6YdzphmFF3NJqm7kSJom