From a90f624f83446589f697bb9324774db42f8acafe Mon Sep 17 00:00:00 2001 From: DemolaCodes Date: Sun, 18 Oct 2026 22:03:39 +0100 Subject: [PATCH 01/10] ci(deps): schedule grouped Bun and GitHub Actions updates (#838) --- .github/dependabot.yml | 35 +++++++++++++++++++++++++++++++++++ 1 file changed, 35 insertions(+) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 00000000..ddb0f21a --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,35 @@ +version: 2 +updates: + # Bun owns the text bun.lock. The npm ecosystem would update the wrong lockfile. + - package-ecosystem: "bun" + directory: "/" + schedule: + interval: "weekly" + day: "monday" + time: "06:00" + timezone: "Etc/UTC" + open-pull-requests-limit: 8 + groups: + runtime-minor-patch: + dependency-type: "production" + update-types: + - "minor" + - "patch" + developer-tooling-minor-patch: + dependency-type: "development" + update-types: + - "minor" + - "patch" + + - package-ecosystem: "github-actions" + directory: "/" + schedule: + interval: "weekly" + day: "monday" + time: "06:30" + timezone: "Etc/UTC" + open-pull-requests-limit: 4 + groups: + actions: + patterns: + - "*" From d8c4f07ca28b4463093beefc4ab1c87944a3bbfe Mon Sep 17 00:00:00 2001 From: DemolaCodes Date: Sun, 18 Oct 2026 22:03:46 +0100 Subject: [PATCH 02/10] ci(security): fail pull requests on high or critical Bun advisories (#838) Audit the committed lockfile without resolving or modifying dependencies; do not ignore unfixed vulnerabilities silently. --- .github/workflows/ci.yml | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 84273646..98e53d60 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -12,6 +12,23 @@ concurrency: cancel-in-progress: true jobs: + dependency-audit: + name: Dependency audit (high and critical) + runs-on: ubuntu-latest + permissions: + contents: read + steps: + - name: Checkout + uses: actions/checkout@v4 + + - name: Setup Bun + uses: oven-sh/setup-bun@v2 + with: + bun-version-file: package.json + + - name: Audit locked dependencies + run: bun audit --audit-level=high + ci: name: Lint · Typecheck · Build runs-on: ubuntu-latest From 52650ad80b1fc5ab80b2b42239f938cd5acc5b67 Mon Sep 17 00:00:00 2001 From: DemolaCodes Date: Sun, 18 Oct 2026 22:04:00 +0100 Subject: [PATCH 03/10] docs(security): document advisory remediation and quarterly exception reviews (#838) --- .github/DEPENDENCY_SECURITY.md | 51 ++++++++++++++++++++++++++++++++++ 1 file changed, 51 insertions(+) create mode 100644 .github/DEPENDENCY_SECURITY.md diff --git a/.github/DEPENDENCY_SECURITY.md b/.github/DEPENDENCY_SECURITY.md new file mode 100644 index 00000000..3e87b2bb --- /dev/null +++ b/.github/DEPENDENCY_SECURITY.md @@ -0,0 +1,51 @@ +# Dependency update and vulnerability audit policy + +The root `bun.lock` is the source of truth for resolved dependencies. GitHub +Dependabot checks Bun workspaces weekly and groups compatible production +and development updates separately. GitHub Actions updates are tracked +in a separate weekly group. + +The **Dependency audit (high and critical)** CI job runs +`bun audit --audit-level=high` on the committed Bun lockfile. A high- or +critical-severity finding fails the job; an unavailable or malformed npm +advisory response also fails closed. This deliberately does not use +`--prod`, since development and build tools can expose contributors +and CI systems to attack. + +## When an advisory is reported + +1. Open the advisory (GHSA ID) and identify the installed package, dependency + path, affected versions, available patched release, and reachable impact. +2. Prefer a compatible direct dependency update; otherwise propose an + appropriate transitive upgrade or reviewed override. Update `bun.lock` + with Bun and validate `bun install --frozen-lockfile` in a clean checkout. +3. Run the repository's full commit gate, plus the relevant web/indexer + integration checks described in `AGENTS.md`. Do not disable tests or lower + audit thresholds to make the change appear successful. +4. If no published fix exists, document the risk in a tracked issue and + propose a mitigation or replacement. A temporary ignore requires explicit + maintainer security review. + +## Narrowly-scoped exceptions + +A temporary exception must identify: + +- **GHSA ID** (use GHSA or numeric npm advisory IDs, not CVE IDs for Bun's + `--ignore` flag) +- affected package and exact installed version +- whether the vulnerable code can be reached in production, development or CI +- why an update, override, isolation or replacement is not currently possible +- compensating controls and the issue tracking a permanent fix +- maintainer approval, approval date and a removal/review deadline + +Only after approval may the CI command add the specific +`--ignore GHSA-xxxx-yyyy-zzzz` option. Never ignore a whole severity class +or an unaudited vulnerability just to turn CI green. Keep each approved +exception documented beside the audit command and in the tracking issue. + +**Review every exception at least quarterly**, and immediately when a fix +is released, the affected dependency changes or an incident changes its +impact. Remove ignores as soon as they are no longer justified. + +No exceptions are pre-approved by this document. Current audit failures +must be investigated, not automatically bypassed. From 3d50b71a92d6dbc89e28e83c3bf5b47ae2d2b4e3 Mon Sep 17 00:00:00 2001 From: DemolaCodes Date: Sun, 18 Oct 2026 22:06:25 +0100 Subject: [PATCH 04/10] ci(test): run full contribution gate for issue branch --- .../workflows/contribution-verification.yml | 54 +++++++++++++++++++ 1 file changed, 54 insertions(+) create mode 100644 .github/workflows/contribution-verification.yml diff --git a/.github/workflows/contribution-verification.yml b/.github/workflows/contribution-verification.yml new file mode 100644 index 00000000..03344d11 --- /dev/null +++ b/.github/workflows/contribution-verification.yml @@ -0,0 +1,54 @@ +name: Contribution verification +on: + push: + branches: + - fix/issue-837-pin-dependency-ranges + - ci/issue-838-dependency-security + - fix/issue-846-canonical-brand + - fix/issue-848-referral-chart-labels +jobs: + full-gate: + runs-on: ubuntu-latest + timeout-minutes: 40 + steps: + - uses: actions/checkout@v4 + with: + fetch-depth: 0 + - uses: oven-sh/setup-bun@v2 + with: + bun-version: 1.3.13 + - name: Install exact locked dependencies + run: bun install --frozen-lockfile + - name: Lint + run: bun lint + - name: Typecheck + run: bun typecheck + - name: Design tokens + run: bun run check:tokens + - name: Docs content + run: bun run check:content + - name: Tests + run: bun run test + - name: Coverage + run: bun run test:coverage + - name: Production build + run: bun run build + - name: Indexer generation and build + run: bun run --cwd apps/s03-indexer codegen && bun run --cwd apps/s03-indexer build + - name: Indexer test + run: bun run --cwd apps/s03-indexer test + - name: Indexer local manifest sync + run: SO4_CONTRACTS_REPO="$PWD/apps/s03-indexer/tests/fixtures/contracts-repo" bun run --cwd apps/s03-indexer sync:contracts:local && bash scripts/validate-manifest.sh apps/s03-indexer/config/contracts.local.json + - name: Web typecheck + run: bun run --cwd apps/web typecheck + - name: Web build + run: bun run --cwd apps/web build + audit: + runs-on: ubuntu-latest + timeout-minutes: 15 + steps: + - uses: actions/checkout@v4 + - uses: oven-sh/setup-bun@v2 + with: + bun-version: 1.3.13 + - run: bun audit --audit-level=high From 25fb84b210e7ca0ecc082de002505a953d160388 Mon Sep 17 00:00:00 2001 From: DemolaCodes Date: Sun, 18 Oct 2026 22:08:49 +0100 Subject: [PATCH 05/10] ci(test): collect independent gate results without masking any failure --- .github/workflows/contribution-verification.yml | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/.github/workflows/contribution-verification.yml b/.github/workflows/contribution-verification.yml index 03344d11..66847423 100644 --- a/.github/workflows/contribution-verification.yml +++ b/.github/workflows/contribution-verification.yml @@ -20,28 +20,40 @@ jobs: - name: Install exact locked dependencies run: bun install --frozen-lockfile - name: Lint + if: ${{ success() || failure() }} run: bun lint - name: Typecheck + if: ${{ success() || failure() }} run: bun typecheck - name: Design tokens + if: ${{ success() || failure() }} run: bun run check:tokens - name: Docs content + if: ${{ success() || failure() }} run: bun run check:content - name: Tests + if: ${{ success() || failure() }} run: bun run test - name: Coverage + if: ${{ success() || failure() }} run: bun run test:coverage - name: Production build + if: ${{ success() || failure() }} run: bun run build - name: Indexer generation and build + if: ${{ success() || failure() }} run: bun run --cwd apps/s03-indexer codegen && bun run --cwd apps/s03-indexer build - name: Indexer test + if: ${{ success() || failure() }} run: bun run --cwd apps/s03-indexer test - name: Indexer local manifest sync + if: ${{ success() || failure() }} run: SO4_CONTRACTS_REPO="$PWD/apps/s03-indexer/tests/fixtures/contracts-repo" bun run --cwd apps/s03-indexer sync:contracts:local && bash scripts/validate-manifest.sh apps/s03-indexer/config/contracts.local.json - name: Web typecheck + if: ${{ success() || failure() }} run: bun run --cwd apps/web typecheck - name: Web build + if: ${{ success() || failure() }} run: bun run --cwd apps/web build audit: runs-on: ubuntu-latest From ad3c6843aa7b92f8b4eaf74fcd18cd3c9ea0ca8d Mon Sep 17 00:00:00 2001 From: DemolaCodes Date: Sun, 18 Oct 2026 22:09:43 +0100 Subject: [PATCH 06/10] ci(security): enforce immutable Bun installs in build and browser CI (#838) --- .github/workflows/ci.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 98e53d60..3e2dbeb2 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -56,7 +56,7 @@ jobs: ${{ runner.os }}-bun- - name: Install dependencies - run: bun install + run: bun install --frozen-lockfile - name: Lint run: bun lint @@ -118,7 +118,7 @@ jobs: ${{ runner.os }}-bun- - name: Install dependencies - run: bun install + run: bun install --frozen-lockfile - name: Install Playwright browsers run: bunx playwright install --with-deps chromium From e2e7df7147c55307bb5030c2d752c63e6c3f3f40 Mon Sep 17 00:00:00 2001 From: DemolaCodes Date: Sun, 18 Oct 2026 22:10:45 +0100 Subject: [PATCH 07/10] ci(audit): resolve Bun from root packageManager with setup-bun automatic detection (#838) --- .github/workflows/ci.yml | 2 -- 1 file changed, 2 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 3e2dbeb2..7413b0d3 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -23,8 +23,6 @@ jobs: - name: Setup Bun uses: oven-sh/setup-bun@v2 - with: - bun-version-file: package.json - name: Audit locked dependencies run: bun audit --audit-level=high From 4ba9789aedb59c918d0c03e594879a91bb7cc214 Mon Sep 17 00:00:00 2001 From: DemolaCodes Date: Sun, 18 Oct 2026 22:11:24 +0100 Subject: [PATCH 08/10] docs(security): record observed unpatched advisories and review checkpoint (#838) --- .github/DEPENDENCY_SECURITY.md | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/.github/DEPENDENCY_SECURITY.md b/.github/DEPENDENCY_SECURITY.md index 3e87b2bb..de5c53ad 100644 --- a/.github/DEPENDENCY_SECURITY.md +++ b/.github/DEPENDENCY_SECURITY.md @@ -49,3 +49,23 @@ impact. Remove ignores as soon as they are no longer justified. No exceptions are pre-approved by this document. Current audit failures must be investigated, not automatically bypassed. + +## Observed baseline: October 18, 2026 + +The first implementation run of `bun audit --audit-level=high` reported +three **high** advisories in the unmodified upstream lockfile: + +| Advisory | Resolved dependency path | Status on review date | +| --- | --- | --- | +| [GHSA-vfj7-8cjw-p6xm](https://github.com/advisories/GHSA-vfj7-8cjw-p6xm) | `@workspace/ui` → `shadcn` → `braces` | No patched published version | +| [GHSA-jmr9-qjv8-65gv](https://github.com/advisories/GHSA-jmr9-qjv8-65gv) | `docs` → `@lhci/cli` → `extract-zip` | No patched published version | +| [GHSA-7pqw-9j4j-h8q3](https://github.com/advisories/GHSA-7pqw-9j4j-h8q3) | `docs` → `@lhci/cli` → `extract-zip` | No patched published version | + +These are **unresolved**; the audit job intentionally fails until an +effective dependency replacement/remediation ships or maintainers approve +time-bound, reachability-reviewed exceptions using the process above. +A detected vulnerability is not evidence that this product's code path is +exploitable. Before an exception, assess whether untrusted brace patterns +or untrusted ZIP files can reach the cited tools in production or CI. +The next quarterly checkpoint is **January 18, 2027**, or sooner when +patches become available. From 921edf081440af4fccbee25aef0c60a07fb58c16 Mon Sep 17 00:00:00 2001 From: DemolaCodes Date: Sun, 18 Oct 2026 22:14:01 +0100 Subject: [PATCH 09/10] ci(deps): use packageManager-pinned Bun for build and e2e installs (#838) --- .github/workflows/ci.yml | 4 ---- 1 file changed, 4 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 7413b0d3..33ae8fb0 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -42,8 +42,6 @@ jobs: - name: Setup Bun uses: oven-sh/setup-bun@v2 - with: - bun-version: latest - name: Cache Bun dependencies uses: actions/cache@v4 @@ -104,8 +102,6 @@ jobs: - name: Setup Bun uses: oven-sh/setup-bun@v2 - with: - bun-version: latest - name: Cache Bun dependencies uses: actions/cache@v4 From 2e7e4463d4dd447e24acb6b1cf3917ff0eeaad2a Mon Sep 17 00:00:00 2001 From: DemolaCodes Date: Sun, 18 Oct 2026 22:15:04 +0100 Subject: [PATCH 10/10] chore: remove temporary CI verification workflow before upstream contribution --- .../workflows/contribution-verification.yml | 66 ------------------- 1 file changed, 66 deletions(-) delete mode 100644 .github/workflows/contribution-verification.yml diff --git a/.github/workflows/contribution-verification.yml b/.github/workflows/contribution-verification.yml deleted file mode 100644 index 66847423..00000000 --- a/.github/workflows/contribution-verification.yml +++ /dev/null @@ -1,66 +0,0 @@ -name: Contribution verification -on: - push: - branches: - - fix/issue-837-pin-dependency-ranges - - ci/issue-838-dependency-security - - fix/issue-846-canonical-brand - - fix/issue-848-referral-chart-labels -jobs: - full-gate: - runs-on: ubuntu-latest - timeout-minutes: 40 - steps: - - uses: actions/checkout@v4 - with: - fetch-depth: 0 - - uses: oven-sh/setup-bun@v2 - with: - bun-version: 1.3.13 - - name: Install exact locked dependencies - run: bun install --frozen-lockfile - - name: Lint - if: ${{ success() || failure() }} - run: bun lint - - name: Typecheck - if: ${{ success() || failure() }} - run: bun typecheck - - name: Design tokens - if: ${{ success() || failure() }} - run: bun run check:tokens - - name: Docs content - if: ${{ success() || failure() }} - run: bun run check:content - - name: Tests - if: ${{ success() || failure() }} - run: bun run test - - name: Coverage - if: ${{ success() || failure() }} - run: bun run test:coverage - - name: Production build - if: ${{ success() || failure() }} - run: bun run build - - name: Indexer generation and build - if: ${{ success() || failure() }} - run: bun run --cwd apps/s03-indexer codegen && bun run --cwd apps/s03-indexer build - - name: Indexer test - if: ${{ success() || failure() }} - run: bun run --cwd apps/s03-indexer test - - name: Indexer local manifest sync - if: ${{ success() || failure() }} - run: SO4_CONTRACTS_REPO="$PWD/apps/s03-indexer/tests/fixtures/contracts-repo" bun run --cwd apps/s03-indexer sync:contracts:local && bash scripts/validate-manifest.sh apps/s03-indexer/config/contracts.local.json - - name: Web typecheck - if: ${{ success() || failure() }} - run: bun run --cwd apps/web typecheck - - name: Web build - if: ${{ success() || failure() }} - run: bun run --cwd apps/web build - audit: - runs-on: ubuntu-latest - timeout-minutes: 15 - steps: - - uses: actions/checkout@v4 - - uses: oven-sh/setup-bun@v2 - with: - bun-version: 1.3.13 - - run: bun audit --audit-level=high