You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
fix(deps): clear pnpm audit on main (unfixable deepmerge advisory) - #636
Clears the pnpm audit failure in dependency-audit on main (run 41763096687), ahead of the org ruleset requiring dependency-audit / Audit gate (combsmith/.github#1470, #1406).
4.3.1 via @expo/config (SDK 55) and jest-config 29
Ignored in pnpm-workspace.yamlaudit.ignore with a re-evaluation trigger. No patched deepmerge exists on npm (4.3.1 is latest; GitHub lists no patched version), so no upgrade or override can fix it. Only @expo/config 58 drops it, which is an Expo SDK major upgrade.
None. The advisory range is now >=7.0.0 <11.0.1; the lockfile resolves only minimatch 3.1.5 and 11.0.4 (the existing minimatch@>=9.0.0 <11.0.1 override covers 9.x/10.x). Local pnpm audit no longer reports it.
deepmerge here merges developer-controlled app/jest config at build and test time, not runtime input.
govulncheck (not fixed here)
The govulncheck job on main is a tool crash, not a finding: panic: unexpected expr: *ast.KeyValueExpr in golang.org/x/tools@v0.29.0/go/ssa while building SSA for ./apps/api. The shared reusable pins govulncheck@v1.1.4 and installs Go stable (now 1.27.3) with GOTOOLCHAIN=local. Reproduced locally with v1.1.4 + Go 1.27.3 targeting linux/amd64; govulncheck v1.9.0 on the same toolchain reports No vulnerabilities found. for apps/api. The fix belongs in combsmith/.githubdependency-audit-reusable.yml, so Audit gate on this PR will stay red until that lands.
Local checks
pnpm install --frozen-lockfile, pnpm run lint, pnpm run typecheck, pnpm run test: pass
pnpm audit on main fails on GHSA-gcqx-w48m-w2h4 (deepmerge 4.2.0-4.3.1,
low). No patched deepmerge is published (4.3.1 is latest), so no upgrade
or override can clear it. It reaches the lockfile only via @expo/config
(SDK 55) and jest-config 29, which merge developer-controlled config at
build/test time. Ignore it with a re-evaluation trigger, matching the
existing image-size/braces/zod entries.
The minimatch advisory (GHSA-g3hv-75wg-m249) in the same run no longer
matches: its range is now >=7.0.0 <11.0.1, and the lockfile resolves
only minimatch 3.1.5 and 11.0.4.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The CodeRabbit configuration file in this repository has a parsing error and default settings were used instead. Please fix the error(s) in the configuration file. You can initialize chat with CodeRabbit to get help with the configuration file.
Parsing errors: 1
Validation error: Invalid input: expected string, received object at "reviews.path_filters[3]"
If your editor has YAML language server enabled, you can add the path at the top of this file to enable auto-completion and validation: # yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json
No actionable comments were generated in the recent review.
Summary
Summary by CodeRabbit
Documentation
Added details about the deepmerge security advisory, including affected dependency paths and suppression conditions.
Chores
Updated the dependency audit ignore list to include the advisory.
The workspace configuration documents the deepmerge advisory, its dependency paths, and conditions for reevaluating the suppression. It adds GHSA-gcqx-w48m-w2h4 to the audit ignore list.
Changes: Deepmerge audit suppression
Layer / File(s)
Summary
Document and suppress the advisory pnpm-workspace.yaml
Comments describe the advisory, affected versions, dependency paths, and conditions for reevaluating the suppression. The audit ignore list now includes GHSA-gcqx-w48m-w2h4.
combsmith/broodly#634: This PR also changes the audit ignore list in pnpm-workspace.yaml and discusses the same deepmerge advisory.
Merge Risk: Minimal · up to 7d5e9
The change only suppresses the documented unfixable advisory; it does not alter runtime dependencies or application behavior.
Pre-merge checks: 5
Check name
Status
Explanation
Title check
The title clearly identifies the main change: clearing the pnpm audit failure by handling an unfixable deepmerge advisory.
Description check
The description directly explains the audit advisory, the ignore configuration, affected dependencies, validation results, and the separate govulncheck workflow issue.
Docstring Coverage
No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…
Linked Issues check
Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check
Check skipped because no linked issues were found for this pull request.
Full details: Docstring Coverage
Explanation
No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)
Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
File: No configuration file from this repository applied
Commit: Unavailable
Layers: Organization UI
Review profile: ASSERTIVE
Plan: Advanced
Run ID: 1fb54048-060a-4d01-8df9-edc86f3b9355
Commits
Reviewing files that changed from the base of the PR and between e1aa5da and 7d5e967.
Files selected for processing: 1
pnpm-workspace.yaml
Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.
Superseded — dev-lead is now withholding action under the `needs-human-review` label. Click to expand the prior `dev-lead:hands-off` hold notice.
dev-lead is withholding action on this item.
It is labeled dev-lead:hands-off (deliberately kept off-limits to dev-lead (e.g. changes to the dev-lead automation itself)), so dev-lead will not pick it up while that label is present. This notice is posted once so the withhold is visible rather than looking like a stalled run.
To re-enable automated pickup: remove the dev-lead:hands-off label.
The automated review cascade escalated this PR to a human reviewer at review cycle 0/3 (risk: HIGH, reviewed commit 7d5e9678e1421347addd93588d2946224b2b41a8).
Why: the cascade could neither approve the PR nor auto-request fixes, so it requested human review via CODEOWNERS and set the needs-human-review label. A human should review the PR, or remove the needs-human-review label to re-engage the automated cascade.
Reviewer summary: This PR adds GHSA-gcqx-w48m-w2h4 (deepmerge 4.2.0-4.3.1, low severity) to audit.ignore in pnpm-workspace.yaml, with a clear comment and a trigger for re-checking it. The change adds no code, secrets, workflows or new dependencies, and the stated reason (deepmerge only merges developer-controlled config at build and test time) is believable. The org rubric still rates any suppression of a security-scanner finding as HIGH, and gate 2 fails: dependency-audit / govulncheck and dependency-audit / Audit gate are failing at head and CodeRabbit was still running. A human should own the decision to accept this advisory. The main claims could not be checked here because the lockfile, npm registry and advisory data were not available.
This note is updated in place on re-escalation; it is not re-posted.
It is labeled needs-human-review (flagged for human review — this label is applied by automation as well as by people, so an item can become held without anyone noticing), so dev-lead will not pick it up while that label is present. This notice is posted once so the withhold is visible rather than looking like a stalled run.
To re-enable automated pickup: remove the needs-human-review label.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Summary
Clears the
pnpm auditfailure in dependency-audit onmain(run 41763096687), ahead of the org ruleset requiringdependency-audit / Audit gate(combsmith/.github#1470, #1406).@expo/config(SDK 55) andjest-config29pnpm-workspace.yamlaudit.ignorewith a re-evaluation trigger. No patched deepmerge exists on npm (4.3.1 is latest; GitHub lists no patched version), so no upgrade or override can fix it. Only@expo/config58 drops it, which is an Expo SDK major upgrade.>=7.0.0 <11.0.1; the lockfile resolves only minimatch 3.1.5 and 11.0.4 (the existingminimatch@>=9.0.0 <11.0.1override covers 9.x/10.x). Localpnpm auditno longer reports it.deepmerge here merges developer-controlled app/jest config at build and test time, not runtime input.
govulncheck (not fixed here)
The
govulncheckjob on main is a tool crash, not a finding:panic: unexpected expr: *ast.KeyValueExpringolang.org/x/tools@v0.29.0/go/ssawhile building SSA for./apps/api. The shared reusable pinsgovulncheck@v1.1.4and installs Gostable(now 1.27.3) withGOTOOLCHAIN=local. Reproduced locally with v1.1.4 + Go 1.27.3 targeting linux/amd64; govulncheck v1.9.0 on the same toolchain reportsNo vulnerabilities found.forapps/api. The fix belongs incombsmith/.githubdependency-audit-reusable.yml, soAudit gateon this PR will stay red until that lands.Local checks
pnpm install --frozen-lockfile,pnpm run lint,pnpm run typecheck,pnpm run test: passpnpm audit --audit-level low: exit 0 (1 low (1 ignored) | 3 high (3 ignored))go vet,go build,go test ./...inapps/api: pass🤖 Generated with Claude Code