Clear the open dependency vulnerabilities - #11
Merged
Conversation
This repo has two lockfiles and both were flagged. Everything here is transitive and dev-scope — nothing reaches consumers of the package — but it is what Vanta is flagging. Root: brace-expansion 5.0.7 -> 5.0.9 GHSA-rgw5-rvv9-x895, GHSA-mh99-v99m-4gvg js-yaml 3.15.0 -> 3.15.1 GHSA-5p4m-2wfm-xmqj tar 7.5.20 -> 7.5.22 GHSA-r292-9mhp-454m undici 7.28.0 -> 7.29.0 GHSA-4cwx-7wf7-3272 and four medium demo/: nanoid 3.3.16 -> 3.3.18 postcss 8.5.20 -> 8.5.26 A lockfile refresh reaches all of them, so no manifest change and no overrides block. A fifth apparent root finding, cbor2 via ava, was a false positive: that advisory covers the PyPI package, and its range (<= 5.8.0) is above every version cbor2 has ever published on npm, where the latest is 2.3.0. No change made. Verified by resolving every package in both lockfiles against the GitHub advisory API, constrained to the npm ecosystem — that constraint is what surfaced the cbor2 mismatch — rather than trusting the audit summary. Both come back clean. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
simon--poole
approved these changes
Aug 14, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
One of five projects Vanta monitors, under SUP-3894. This repo has two lockfiles and both were flagged. Everything here is transitive and dev-scope — nothing reaches consumers of the package — but it is what Vanta is flagging.
Root
brace-expansionjs-yamltarundicidemo/
nanoid3.3.16 → 3.3.18 andpostcss8.5.20 → 8.5.26.demo/package-lock.jsonis easy to miss — Dependabot reports it as a separate manifest, and a root-only sweep says the repo is clean while it isn't.A lockfile refresh reaches all six, so there is no manifest change and no
overridesblock.One apparent finding that isn't real
cbor2@2.3.0, pulled in by ava, looked like a high. It is a false positive: that advisory covers the PyPI package, and its range (<= 5.8.0) sits above every versioncbor2has ever published on npm, where the latest is 2.3.0. It surfaced because my first sweep matched advisories by package name without constraining the ecosystem. No change made — andnpmrejecting the attempted override withnotargetis what prompted the second look.Verification
Every package in both lockfiles (353 and 68) resolved against OSV, rather than reading the audit summary. Both clean afterwards. Full suite passes: 95 tests, 99% statement coverage.
Worth recording why it was done that way: my first pass used per-package GitHub advisory API calls, which silently hit the 5,000/hr rate limit and returned nothing — which the script read as "clean". That is a false negative in the dangerous direction. The batched OSV query has no such failure mode and aborts rather than reporting clean.
🤖 Generated with Claude Code using Claude Opus 5 (1M context)