From b4b0491dd23a25558815d9e02780bc959627b421 Mon Sep 17 00:00:00 2001 From: Hweinstock Date: Tue, 6 Oct 2026 20:47:15 +0000 Subject: [PATCH 1/3] fix(ci): time-box braces audit exception --- .github/workflows/verify.yml | 3 ++- bun.lock | 4 ++-- src/techDebt.test.ts | 6 ++++++ src/testing/techDebt.ts | 13 +++++++++++++ 4 files changed, 23 insertions(+), 3 deletions(-) create mode 100644 src/techDebt.test.ts create mode 100644 src/testing/techDebt.ts diff --git a/.github/workflows/verify.yml b/.github/workflows/verify.yml index 1f9a68717c..5caa329012 100644 --- a/.github/workflows/verify.yml +++ b/.github/workflows/verify.yml @@ -54,7 +54,8 @@ jobs: if: runner.os == 'Linux' && !cancelled() - run: bun run typecheck if: runner.os == 'Linux' && !cancelled() - - run: bun audit + # Temporary exception for GHSA-vfj7-8cjw-p6xm; remove when a patched braces release is available. + - run: bun audit --ignore GHSA-vfj7-8cjw-p6xm if: runner.os == 'Linux' && !cancelled() - run: bun run secrets:check if: runner.os == 'Linux' && !cancelled() diff --git a/bun.lock b/bun.lock index c0a6157ed2..e8390f443e 100644 --- a/bun.lock +++ b/bun.lock @@ -1407,7 +1407,7 @@ "shebang-regex": ["shebang-regex@3.0.0", "", {}, "sha512-7++dFhtcx3353uBaq8DDR4NuxBetBzC7ZQOhmTQInHEd6bSrXdiEyzCvG07Z44UYdLShWUyXt5M/yhz8ekcb1A=="], - "shell-quote": ["shell-quote@1.10.0", "", {}, "sha512-w1aiOKwKuRgtwAReIIj89puqg+I7GvX4IbLrvmhXbzQsj1+Zwi4VO3+fa6ZF91TWSjIxoEkKnMeHcLEODK5ZXA=="], + "shell-quote": ["shell-quote@1.11.0", "", {}, "sha512-JdxDPD0DBTyu08pq0kPC0xSNet/qsU07qT6IsX1AS8oO2ICNRY4ldNa8OAI6PuwAH8tG3lxEhbqmyp4Dw4036g=="], "side-channel": ["side-channel@1.1.1", "", { "dependencies": { "es-errors": "^1.3.0", "object-inspect": "^1.13.4", "side-channel-list": "^1.0.1", "side-channel-map": "^1.0.1", "side-channel-weakmap": "^1.0.2" } }, "sha512-6x6dK6zJdpTzF4sQeNYxwtvBzf6Eg4GtlesS94HOvTudUeyK2WXAaIfmDgsyslYrRBeFIlsi54AYsFGUuhmvrQ=="], @@ -1429,7 +1429,7 @@ "source-map": ["source-map@0.6.1", "", {}, "sha512-UjgapumWlbMhkBgzT7Ykc5YXUT46F0iKu8SGXq0bcwP5dz/h0Plj6enJqjz1Zbq2l5WaqYnrVbwWOWMyF3F47g=="], - "source-map-js": ["source-map-js@1.2.1", "", {}, "sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA=="], + "source-map-js": ["source-map-js@1.2.2", "", {}, "sha512-KGj/8Y43x35aZVDtt+J4mK1hoLGHULMYfSkODJNQjNDC3oW1PqPoxMwo0pLUsWM/UEGzON/NxeHywEfNXNP3Vw=="], "space-separated-tokens": ["space-separated-tokens@2.0.2", "", {}, "sha512-PEGlAwrG8yXGXRjW32fGbg66JAlOAwbObuqVoJpv/mRgoWDQfgH1wDPvtzWyUSNAXBGSk8h755YDbbcEy3SH2Q=="], diff --git a/src/techDebt.test.ts b/src/techDebt.test.ts new file mode 100644 index 0000000000..98582b10e7 --- /dev/null +++ b/src/techDebt.test.ts @@ -0,0 +1,6 @@ +import { techDebtTest } from "./testing/techDebt.ts"; + +techDebtTest( + new Date("2026-10-13T20:37:51.000Z"), + "The braces audit exception expired. Check https://github.com/advisories/GHSA-vfj7-8cjw-p6xm for a patched release, update bun.lock, and remove the audit ignore.", +); diff --git a/src/testing/techDebt.ts b/src/testing/techDebt.ts new file mode 100644 index 0000000000..3d4765265c --- /dev/null +++ b/src/testing/techDebt.ts @@ -0,0 +1,13 @@ +import { expect, test } from "bun:test"; + +export function techDebtTest(expiresAt: Date, message: string): void { + test(`tech debt review deadline: ${expiresAt.toISOString()}`, () => { + const now = Date.now(); + + if (now >= expiresAt.getTime()) { + console.error(message); + } + + expect(now).toBeLessThan(expiresAt.getTime()); + }); +} From dd05e1274ca2a29ce4d31b296960c8c5fca28ff6 Mon Sep 17 00:00:00 2001 From: Hweinstock Date: Tue, 6 Oct 2026 21:24:35 +0000 Subject: [PATCH 2/3] chore(security): centralize audit exception --- .github/workflows/verify.yml | 4 ++-- package.json | 1 + 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/.github/workflows/verify.yml b/.github/workflows/verify.yml index 5caa329012..46a3c5d6fe 100644 --- a/.github/workflows/verify.yml +++ b/.github/workflows/verify.yml @@ -54,8 +54,8 @@ jobs: if: runner.os == 'Linux' && !cancelled() - run: bun run typecheck if: runner.os == 'Linux' && !cancelled() - # Temporary exception for GHSA-vfj7-8cjw-p6xm; remove when a patched braces release is available. - - run: bun audit --ignore GHSA-vfj7-8cjw-p6xm + # The temporary GHSA exception lives in package.json's audit script; remove when braces is patched. + - run: bun run audit if: runner.os == 'Linux' && !cancelled() - run: bun run secrets:check if: runner.os == 'Linux' && !cancelled() diff --git a/package.json b/package.json index 3ab4e1e9ec..60d2ba7c99 100644 --- a/package.json +++ b/package.json @@ -20,6 +20,7 @@ "!dist/bin" ], "scripts": { + "audit": "bun audit --ignore GHSA-vfj7-8cjw-p6xm", "build": "bun scripts/build.ts bundle", "compile": "bun run compile:darwin-x64 && bun run compile:darwin-arm64 && bun run compile:linux-x64 && bun run compile:linux-arm64 && bun run compile:windows-x64 && bun run compile:windows-arm64", "compile:darwin-x64": "bun scripts/build.ts compile bun-darwin-x64", From b195eab7f66e2af7f60c6e6cfc4c0cecc7f77783 Mon Sep 17 00:00:00 2001 From: Hweinstock Date: Tue, 6 Oct 2026 21:26:03 +0000 Subject: [PATCH 3/3] chore(ci): remove audit comment --- .github/workflows/verify.yml | 1 - 1 file changed, 1 deletion(-) diff --git a/.github/workflows/verify.yml b/.github/workflows/verify.yml index 46a3c5d6fe..9f47ca9bd4 100644 --- a/.github/workflows/verify.yml +++ b/.github/workflows/verify.yml @@ -54,7 +54,6 @@ jobs: if: runner.os == 'Linux' && !cancelled() - run: bun run typecheck if: runner.os == 'Linux' && !cancelled() - # The temporary GHSA exception lives in package.json's audit script; remove when braces is patched. - run: bun run audit if: runner.os == 'Linux' && !cancelled() - run: bun run secrets:check