[sasjs-dev]

The Audit the release toolchain step fails on #1503 and on main at 62fd077 - three undici advisories published since the last green run. Not related to any diff in flight; every PR opened now hits it.

All three are the copy release/audit.mjs already documents twice: undici 6.29.0 bundled inside npm 11.21.1, reached through @semantic-release/npm's npm ^11.6.2 range. Re-measured today rather than assumed:

• patched version is 6.29.1;
• a bundled dependency is not a resolvable node, so an overrides entry leaves node_modules/npm/node_modules/undici at 6.29.0;
• npm 12.2.1, the newest release, also ships 6.29.0 inside its own tarball.

So no bump available to this repo clears them, and each entry carries its own argument rather than deferring to the first: the Agent one applies to npm's HTTP client during publish, where the peer is the registry and api.github.com and cannot pick the agent options; the renegotiation one needs a peer that renegotiates mid-connection, which Node disables by default; the WebSocket one is never instantiated, because the toolchain opens no WebSocket.

before: 3 advisory(s) in the release toolchain outside the documented exemptions
after:  no advisory in the release toolchain outside the documented exemptions (6 exempt)

Every entry clears when npm ships undici >= 6.29.1 bundled, and then fails the gate until it is deleted.

The same three will hit adapter, sas-language, utils and vscode-extension, which carry the same script with their own lists - I can roll this out to them once this lands.

[github-actions]

Coverage report

Total coverage

Status	Category	Percentage	Covered / Total
🟡	Statements	79.06%	4648/5879
🟡	Branches	67.88%	2029/2989
🟡	Functions	78.28%	908/1160
🟢	Lines	86.37%	11071/12818

Status of coverage: 🟢 - ok, 🟡 - slightly more than threshold, 🔴 - under the threshold

Report generated by 🧪jest coverage report action from 53fd93e

[sasjs-dev]

Reviewed the full base...head diff - three new entries in the release toolchain's audit EXEMPT map (release/audit.mjs). The justifications are specific, name the bundled copy, and state why overrides cannot move it; the self-clearing behaviour (the gate fails once the advisory disappears) is the right shape for an exemption list.

• release/audit.mjs (GHSA-2m5v-pch6-74hx): the justification rests on "no part of that exchange lets a peer choose the agent options", but the affected path is npm's own HTTP client, whose Agent and its TLS options come from operator configuration - the same npm_config_proxy / HTTPS_PROXY surface the ip-address entry below treats as reachable input for this repo. A proxy-configured publish therefore can supply the agent options this advisory concerns. Either classify this one as RISK ACCEPTANCE on the publish path the way GHSA-qrxm-fqhp-jwvm is, or spell out why a configured proxy cannot reach it.
• CI reports no check contexts yet at this head (pending).

1 finding above for review.

[sasjs-dev]

Closing rather than merging: exemptions are for advisories that cannot be fixed and are being lived with, and the operator's direction is to wait for the upstream fix rather than add three more entries ahead of one.

For the record, so the next reader does not re-derive it: undici is patched at 6.29.1, a bundled dependency is not a resolvable node so overrides cannot reach npm's copy, and npm 12.2.1 - the newest release - still publishes undici 6.29.0 inside its own tarball. Nothing available to this repo clears the three advisories; they clear when npm ships 6.29.1 bundled, at which point the existing entries for the older undici advisories in the same file should be deleted with them.

The Audit the release toolchain step stays red on every PR until then. It reproduces on main at 62fd077 in a clean worktree, so it is not a signal about any diff under review.

[sasjs-dev]

Reopened - the operator's point is that this is the blocker for a merge in flight (#1503), not a proactive exemption. The distinction that held: an exemption is worth adding where a merge is waiting on it, and not worth adding in repos with nothing to push until the upstream fix lands.

Nothing else changed: the branch is the same commit, and node release/audit.mjs in this tree reports six exempt and nothing outside.