From 414ce82d9dd6a06c114efc3c224436330f2363e2 Mon Sep 17 00:00:00 2001 From: Claude Date: Wed, 12 Aug 2026 20:43:11 +0000 Subject: [PATCH] SRE-945: Remove the GHSA-frvp-7c67-39w9 allowlist from the Dependencies preflight MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Reverts the supply-chain exception added in #9149. GitHub narrowed GHSA-frvp-7c67-39w9 on 2026-08-12 to two disjoint ranges — `>= 2.0.0, < 2.0.5` and `< 1.19.15` — so the `1.19.x` line the repo resolves is no longer flagged and the allowlist is obsolete. Hand-reverted rather than `git revert`-ed: the `dependencies` job has since moved from `preflight.yml` to `preflight-target.yml` and the reusable-workflow pin has been bumped twice, so only the `with:` block is removed and the current pin is preserved. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_01MjvYwHkmR1zabWsaZmPL42 --- .github/workflows/preflight-target.yml | 4 ---- 1 file changed, 4 deletions(-) diff --git a/.github/workflows/preflight-target.yml b/.github/workflows/preflight-target.yml index 83f329d2534..849c0683a18 100644 --- a/.github/workflows/preflight-target.yml +++ b/.github/workflows/preflight-target.yml @@ -17,10 +17,6 @@ jobs: contents: read pull-requests: write uses: hashintel/.github/.github/workflows/preflight-dependencies.yml@69449a772a55c55a101d4fefdceb4024b6bc3107 # main - with: - # GHSA-frvp-7c67-39w9: advisory has a wrong affected-version range; the fix was - # backported in @hono/node-server. Remove once github/advisory-database#8824 merges. - allow-ghsas: GHSA-frvp-7c67-39w9 labeler: name: Labeler