From 0b9730452a87e6e8f606c92a9c2be9affb692449 Mon Sep 17 00:00:00 2001 From: Robert Allen Date: Thu, 8 Oct 2026 15:27:24 -0400 Subject: [PATCH 1/2] ci: fix semgrep crash and accept 3 unfixable OSV advisories - quality-gates.yml: re-pin reusable-semgrep.yml from 5c856f8 to .github main 63155e1, which defaults to Semgrep 1.180.0 (.github PR #90). Semgrep 1.139.0 crashes on pydantic 2.14 (ImportError: eval_type_backport), failing `semgrep / sast-code` on every run. Inputs/outputs/permissions are unchanged between the two SHAs. - osv-scanner.toml: add justified [[IgnoredVulns]] for braces 3.0.3 (GHSA-vfj7-8cjw-p6xm, no fixed release), katex 0.16.47 (GHSA-238p-pmpm-9mq7, fix outside mermaid's ^0.16 range) and postcss-selector-parser 6.1.4 (GHSA-rj75-hqrm-r3gf, fix outside postcss-nested 6.x's range), modelled on MIF's osv-scanner.toml. - package.json: drop the stale `sharp@0.35.3` allowScripts entry; the lock resolves sharp 0.35.5, which has no install script. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/quality-gates.yml | 2 +- osv-scanner.toml | 39 +++++++++++++++++++++++++++++ package.json | 3 +-- 3 files changed, 41 insertions(+), 3 deletions(-) create mode 100644 osv-scanner.toml diff --git a/.github/workflows/quality-gates.yml b/.github/workflows/quality-gates.yml index 6374792..e0ec619 100644 --- a/.github/workflows/quality-gates.yml +++ b/.github/workflows/quality-gates.yml @@ -96,7 +96,7 @@ jobs: security-events: write actions: read uses: >- - modeled-information-format/.github/.github/workflows/reusable-semgrep.yml@5c856f8118976bfd3bb64a8911f69dc9b00b4cad + modeled-information-format/.github/.github/workflows/reusable-semgrep.yml@63155e10b6f837069f71442f2e49186dd91d6509 with: directory: . diff --git a/osv-scanner.toml b/osv-scanner.toml new file mode 100644 index 0000000..3a193e1 --- /dev/null +++ b/osv-scanner.toml @@ -0,0 +1,39 @@ +# OSV-Scanner configuration. +# +# Accepted, justified vulnerability exceptions for the Astro/Starlight catalog +# site's package-lock.json (the only lockfile in this repo). Each entry is a +# deliberate risk decision, not a silent suppression: no fix reachable within +# the upstream dependency ranges, and no untrusted input reaching the affected +# code. Revisit on each release and on every dependency bump; remove an entry +# as soon as the fix becomes resolvable. + +[[IgnoredVulns]] +id = "GHSA-vfj7-8cjw-p6xm" +# braces 3.0.3: stack-exhaustion DoS on deeply nested brace patterns. No fixed +# release exists (3.0.3 is the last affected and latest version). Build-time +# only, via starlight-llms-txt -> micromatch (^3.0.3), where the patterns come +# from this repo's own build config, never from user input; not part of the +# deployed static site. Remove this entry once a fixed braces release ships. +reason = "No fixed braces release exists; build-time-only transitive (starlight-llms-txt -> micromatch) matching repo-authored patterns, never untrusted input; no production exposure. Revisit when braces ships a fix." + +[[IgnoredVulns]] +id = "GHSA-238p-pmpm-9mq7" +# katex 0.16.47, CVSS 2.1 (low). Pulled in only by mermaid 11 (via +# astro-mermaid), which pins katex ^0.16; the fix is 0.18.2, outside that +# range. KaTeX is only a read-side gadget: exploiting it requires prototype +# pollution that already exists in the page. Mermaid only invokes KaTeX for +# math in diagram labels; this site's diagrams are repo-authored (one diagram, +# in docs/index.md) and contain no math, and no untrusted input reaches them. +# Remove this entry once mermaid accepts katex >= 0.18.2. +reason = "Low-severity katex advisory requiring pre-existing prototype pollution; only reachable through mermaid, which pins katex ^0.16 (fix is 0.18.2). Diagrams are repo-authored with no math; no untrusted input reaches KaTeX. Revisit when mermaid bumps katex." + +[[IgnoredVulns]] +id = "GHSA-rj75-hqrm-r3gf" +# postcss-selector-parser 6.1.4: quadratic-time parsing of very long flat +# selectors (CPU exhaustion). Fixed only in 7.1.6, but the sole consumer is +# postcss-nested 6.2.0 (requires ^6.1.1), pinned via @astrojs/starlight -> +# expressive-code -> @expressive-code/core (postcss-nested ^6.0.1). Build-time +# only: it parses the repo's own code-block theme CSS while `astro build` +# runs, never untrusted input, and is not shipped in the deployed static site. +# Remove this entry once expressive-code moves to postcss-nested >= 7. +reason = "Fix (7.1.6) is outside postcss-nested 6.x's ^6.1.1 range, pinned by Starlight's expressive-code; build-time-only parsing of repo-authored CSS, never untrusted input; no production exposure. Revisit when expressive-code bumps postcss-nested." diff --git a/package.json b/package.json index b0dfd8f..a0eb8b1 100644 --- a/package.json +++ b/package.json @@ -17,8 +17,7 @@ "esbuild": "0.28.1" }, "allowScripts": { - "esbuild@0.28.1": true, - "sharp@0.35.3": true + "esbuild@0.28.1": true }, "devDependencies": { "starlight-llms-txt": "0.12.0" From acee38fa7690797ec22b25307f3da8550cfd57c2 Mon Sep 17 00:00:00 2001 From: Robert Allen Date: Thu, 8 Oct 2026 15:30:10 -0400 Subject: [PATCH 2/2] ci: re-pin release.yml semgrep gate and correct pin comment Apply the same reusable-semgrep.yml re-pin (63155e1, Semgrep 1.180.0) to release.yml's gate-semgrep so the release attestation does not crash on the same pydantic ImportError and runs the same engine as the merge gate. Outputs consumed by attest-semgrep are unchanged between the SHAs. Correct the quality-gates.yml header that claimed one shared pin SHA. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/quality-gates.yml | 3 ++- .github/workflows/release.yml | 2 +- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/.github/workflows/quality-gates.yml b/.github/workflows/quality-gates.yml index e0ec619..6199e6a 100644 --- a/.github/workflows/quality-gates.yml +++ b/.github/workflows/quality-gates.yml @@ -13,7 +13,8 @@ name: quality-gates # job runs the canonical `claude plugin validate`. # # The five plugin-gate reusables are merged into modeled-information-format/.github -# (#12, cosign-signer fix #13) and pinned to that merged main SHA. +# (#12, cosign-signer fix #13) and pinned by full main SHA per gate — not one +# shared SHA: semgrep is on a later main SHA carrying Semgrep 1.180.0 (#90). "on": push: diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 2052800..2769368 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -160,7 +160,7 @@ jobs: needs: [meta] permissions: { contents: read, security-events: write, actions: read } uses: >- - modeled-information-format/.github/.github/workflows/reusable-semgrep.yml@5c856f8118976bfd3bb64a8911f69dc9b00b4cad + modeled-information-format/.github/.github/workflows/reusable-semgrep.yml@63155e10b6f837069f71442f2e49186dd91d6509 gate-secrets: needs: [meta] permissions: { contents: read, security-events: write, actions: read }