Repository navigation
Ignore npm's bundled brace-expansion and undici findings until npm updates them - #24
Merged
Merged
Conversation
…dates them npm bundles brace-expansion 5.0.9 and undici 6.28.0, which have high-severity fixes upstream, and the latest npm releases still ship them, so the release scan fails for every image. The exceptions cover only npm's own copies under /usr/local/lib/node_modules/npm and are tracked in #23 for removal by 2026-11-15.
Match the other Wodby images: keep accepted findings visible in the report and limit each rule to npm packages.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The release scan fails for every Node image, so no new image revision can be published.
Cause
npm bundles its own copies of brace-expansion 5.0.9 and undici 6.28.0. Both have high-severity vulnerabilities with fixes upstream. npm has not picked up the fixes yet: the latest releases, 11.21.0 and 12.2.0, still bundle the same versions. Updating npm in the image doesn't help.
Solution
Ignore these three findings temporarily, only for npm's own copies. The same packages anywhere else in an image, and every other vulnerability, still fail the scan. Medium and low findings are still reported. #23 tracks removing the exceptions once npm ships the fixes, by 2026-11-15 at the latest.
Details
.grype.yamlignores:Each rule is limited to
/usr/local/lib/node_modules/npm/**.Validation
I built the Node 26.11.1 image locally (linux/arm64) and ran Grype v0.118.0 with the release gate's flags (
--fail-on high --only-fixed --by-cve, squashed scope):.grype.yaml, it fails on exactly these three findings..grype.yaml, it passes. The remaining medium and low findings are still listed.Refs #23