Repository navigation
fix: clear critical vitest advisory and add security audit gate - #264
Merged
truthixify merged 1 commit intoOct 19, 2026
Conversation
Bump vitest from ^3.1.0/^3.0.0 to ^3.2.6 across the workspace, resolving the critical arbitrary-file-read and prototype-pollution RCE advisories in vitest. Add a pnpm audit:ci script (scripts/security-audit.mjs) that fails on any unapproved critical advisory, plus a security-audit CI job using pnpm 10. Remaining critical advisories are confined to private example workspaces (Next.js, Solid, React Native) and dev tooling coupled to vitest 3.x; they are tracked in security-audit.allowlist.json with remediation paths and kept out of the published SDK report. Closes wraith-protocol#239
|
@beulah7717108-eng Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits. You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀 |
truthixify
approved these changes
Oct 19, 2026
truthixify
left a comment
truthixify
left a comment
Contributor
There was a problem hiding this comment.
Reviewed exact head 6cbe251. The build and complete test suite pass, the audit parser correctly fails on unlisted critical advisories, and the tracked critical entries are limited to documented development tooling or private example workspaces with remediation paths.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Resolves #239 ([Wave 10] Clear critical runtime advisories from SDK examples and workspaces).
Changes
scripts/security-audit.mjs): runspnpm audit --jsonand fails on any critical advisory not listed insecurity-audit.allowlist.json. Moderate/high/low findings are reported but never fail.security-auditCI job in.github/workflows/ci.ymlusing pnpm 10 withinstall --frozen-lockfileandpnpm audit:ci.security-audit.allowlist.jsonwith remediation paths and kept out of the published SDK report.Verification
pnpm buildpassespnpm testpasses (1599 passed, 5 skipped)pnpm format:checkpassespnpm audit:cipasses (exit 0)Closes #239