From 53fd93e69e6fd1296f00f6f7c34e8367ed711cf9 Mon Sep 17 00:00:00 2001 From: sasjs Date: Wed, 28 Oct 2026 12:23:58 +0000 Subject: [PATCH] fix(ci): exempt the three new undici advisories in the release toolchain The release-toolchain audit fails on three advisories published since the last green run - a TLS option drop in Agent, TLS 1.2 certificate-changing renegotiation, and WebSocket PONG buffering. All three are the copy this file already documents twice: undici 6.29.0 bundled inside npm 11.21.1, which @semantic-release/npm resolves from its npm ^11.6.2 range. Nothing here moves it, re-measured today: a bundled dependency is not a resolvable node, so an `overrides` entry leaves node_modules/npm/node_modules/ undici at 6.29.0, and npm 12.2.1 - the newest release - also publishes 6.29.0 inside its own tarball. The patched version is 6.29.1. Each entry carries its own argument rather than pointing at the first: the Agent one applies to npm's HTTP client during publish, where the peer is the registry and api.github.com and cannot choose the agent options; the renegotiation one needs a peer that renegotiates mid-connection, which Node disables by default; the WebSocket one is not instantiated at all, because the toolchain never opens a WebSocket. Measured after the change: `node release/audit.mjs` reports six exempt and nothing outside. Every one of them clears when npm ships undici >= 6.29.1 bundled, and the entries then fail the gate until they are deleted. --- release/audit.mjs | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/release/audit.mjs b/release/audit.mjs index 750f6f634..5bd757b85 100644 --- a/release/audit.mjs +++ b/release/audit.mjs @@ -53,6 +53,18 @@ const EXEMPT = new Map([ 'GHSA-4qv8-2p9j-2685', "Same bundled copy as GHSA-xjj6-f33q-929c above - undici 6.29.0 inside npm 11.21.1, not reachable by `overrides`, and not moved by npm 12.2.1 (measured: that tarball bundles 6.29.0). This one is the EventSource parser's memory growth; the release toolchain never constructs an EventSource, so the affected parser is not instantiated on this path at all. Clears with the same npm bump, and this entry fails the gate until it is deleted." ], + [ + 'GHSA-2m5v-pch6-74hx', + "Same bundled copy as GHSA-xjj6-f33q-929c above - undici 6.29.0 inside npm 11.21.1, patched in 6.29.1, not reachable by `overrides` because a bundled dependency is not a resolvable node, and not moved by npm 12.2.1 (measured: that tarball also bundles 6.29.0). This one drops TLS options in an Agent, so it applies to npm's own HTTP client during publish - which talks to the registry and to the GitHub API over TLS with the CA bundle this runner ships, and no part of that exchange lets a peer choose the agent options. Clears when npm ships undici >= 6.29.1 bundled; the entry then fails the gate until it is deleted." + ], + [ + 'GHSA-qrxm-fqhp-jwvm', + "Same bundled copy again - undici 6.29.0 inside npm 11.21.1, patched in 6.29.1, unreachable by `overrides` and unchanged by npm 12.2.1. The TLS 1.2 certificate-changing renegotiation path needs a peer that renegotiates mid-connection; Node disables renegotiation by default and the publish endpoints are the registry and api.github.com, so nothing in this repo supplies that peer. RISK ACCEPTANCE on the publish path, not unreachability - the transport can in principle be reached if those endpoints were hostile. Clears with the bundled undici bump." + ], + [ + 'GHSA-9fm3-97px-rjf6', + "Same bundled copy - undici 6.29.0 inside npm 11.21.1, patched in 6.29.1, unreachable by `overrides`, unchanged by npm 12.2.1. This one is WebSocket PONG buffering; the release toolchain never opens a WebSocket, so the affected code is not instantiated on the publish path at all. Clears with the same npm bump." + ], [ 'GHSA-rxp7-6hxx-x8q5', "ip-address 10.7.2, bundled inside npm 11.21.1, which @semantic-release/npm resolves from its npm ^11.6.2 range. 11.21.1 is the newest 11.x, and the version npm bundles cannot be overridden from here - adding `overrides` for ip-address to release/package.json leaves the lockfile at 10.7.2, which was measured. RISK ACCEPTANCE, not unreachability: the parse runs only on a proxy address that carries an Address6 zone identifier; the exposure is a stall during publish, and that string can arrive from standard npm proxy configuration (`npm_config_proxy`, `HTTPS_PROXY`), so the input path is reachable and the accepted risk is a publish-time stall rather than a package-supplied one. No bump in this repo moves it - forcing npm 12.2.1 inside the toolchain was measured too, and the lockfile still resolves ip-address 10.7.2 through socks 2.8.9. It clears only when npm ships ip-address >= 10.7.4 in its own bundled tree; the advisory then disappears and this entry fails the gate until it is deleted."