bun audit went red on the console — three findings had fixes, the other two have no patched version anywhere #160
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: unom/punktfunk#160
Reference in New Issue
Block a user
The blocking
bun-auditleg of the audit workflow failed onwebwith five advisories.sdkandplugin-kitwere clean and stay clean.Three had published fixes
These go in through the
overridesblock web/package.json already maintains for exactly this purpose:!!omapresolutiondompurify and js-yaml were already-existing pins that the new advisory ranges had simply grown past. nanoid is a new entry: it arrives under postcss, which was already pinned, but a pin on postcss does not reach postcss's own dependencies.
Two are ignored rather than fixed
The remaining pair is the image-size infinite-loop DoS set — GHSA-w3rx-r6r6-pgpr (ICNS parser) and GHSA-5p2g-fcmc-qvqq (JXL/HEIF parsers). They are ignored at the workflow step, scoped to the web matrix leg, because they are both unfixable and unreachable.
Unfixable. The vulnerable range is
<= 2.0.2, and 2.0.2 is the latest published version — upstream has shipped no patched release at all, so no override can clear them. Both advisories carryfirst_patched_version: null.Unreachable. image-size rides in under
@unom/ui → @payloadcms/richtext-lexical → … → payload, and@payloadcms/richtext-lexicalis a peer of@unom/uithat only its./richtextexport needs. The console imports section, toast, button, card, dialog, form/*, material and tabs — never./richtext. payload is auto-installed peer weight that no bundle and no request path ever touches.The reasoning is recorded at the step itself so the ignores can be dropped the moment either condition changes: image-size ships a fix, or
@unom/uimarks that peer optional viapeerDependenciesMetaand the chain leaves web/bun.lock entirely. Either one makes a barebun auditgreen again.sdkandplugin-kitkeep the strict fail-on-any stance — these are the only ignores in a blocking tree.What I did not do
I tried the stronger fix of evicting that dead peer from the tree outright (
[install] peer = false), but bun will not prune entries already present in the lockfile — clearing it would take a full lockfile regeneration, which is not a change to make inside a release window. It is worth its own PR later: it would drop payload and several hundred transitive packages from the console's lockfile and its Nix closure.Verification
bun auditgreen on all three blocking trees (web with the two ignores, sdk and plugin-kit bare).scripts/ci/check-bun-nix.sh— both bun packages in sync. web/bun.nix is regenerated here by the bun2nix postinstall; that file has form on going stale (553 commits once), so calling it out explicitly.bun run build,bun run lint(typecheck clean),bun run test(9 pass).The CI image is
oven/bun:1, confirmed at bun 1.3.14, which supports--ignore.The audit workflow's blocking `bun audit` leg went red on web with five findings; sdk and plugin-kit stayed clean. Three had published fixes and are bumped through the existing overrides block: * dompurify 3.4.12 → 3.4.13 GHSA-55q2-fjhq-7xh7 (IN_PLACE hook removal leaves a detached subtree executable). The override was already pinned at ^3.4.12, which the new advisory range swallowed. * js-yaml 4.3.0 → 4.3.1 GHSA-5p4m-2wfm-xmqj (quadratic CPU in !!omap). * nanoid 3.3.16 → 3.3.18 GHSA-2v37-7h3g-55p8 (custom generators loop forever at size zero). New override — it arrives under postcss, which was already pinned, but the pin does not reach postcss's own dependency. The remaining two are the image-size infinite-loop DoS pair (GHSA-w3rx-r6r6-pgpr, GHSA-5p2g-fcmc-qvqq), and they are ignored in the workflow rather than fixed, because they are both unfixable and unreachable: the vulnerable range is `<= 2.0.2` and 2.0.2 is the latest published version, so no override can clear them; and image-size rides in under @unom/ui > @payloadcms/richtext-lexical > ... > payload, where @payloadcms/richtext-lexical is a peer that only @unom/ui's ./richtext export needs. The console imports section, toast, button, card, dialog, form/*, material and tabs — never ./richtext — so payload is auto-installed peer weight that no bundle and no request path touches. The ignores are scoped to the web matrix leg so sdk and plugin-kit stay strictly fail-on-any, and the reasoning is recorded at the step so they can be dropped once image-size ships a fix or @unom/ui marks that peer optional. bun.nix is regenerated by the bun2nix postinstall; scripts/ci/check-bun-nix.sh reports both bun packages in sync. web build, typecheck and server tests pass.