fix(ci): honor osv-scanner ignores in bun audit

CI failed because bun audit does not read osv-scanner.toml. Add a
small wrapper that applies those GHSA ignores, align docs sharp
override with the direct 0.35.3 pin, and refresh the ioredis rationale.

Author: agjs

.github/workflows/apps-api-security-deps.yml

@@ -93,4 +93,4 @@ jobs:
 
       - name: bun audit
         if: steps.filter.outputs.code == 'true'
-        run: bun audit --audit-level=high
+        run: bash scripts/ci/bun-audit.sh

.github/workflows/apps-docs-security-deps.yml

@@ -98,8 +98,7 @@ jobs:
           fi
 
       # No bun audit step here: osv-scanner above with osv-scanner.toml is
-      # the canonical "what we accept" allowlist for this docs repo. bun
-      # audit can't reference the same allowlist (CVE IDs only, no GHSA
-      # support), so it would always reintroduce noise. The docs site is a
-      # static-site build with no runtime auth or user input. osv is
-      # sufficient coverage.
+      # the canonical "what we accept" allowlist for this docs repo. The
+      # docs site is a static-site build with no runtime auth or user input;
+      # osv is sufficient coverage. (api/ui run bun audit via
+      # scripts/ci/bun-audit.sh which applies the same GHSA ignores.)

.github/workflows/apps-ui-security-deps.yml

@@ -91,4 +91,4 @@ jobs:
 
       - name: bun audit
         if: steps.filter.outputs.code == 'true'
-        run: bun audit --audit-level high
+        run: bash scripts/ci/bun-audit.sh

.github/workflows/apps-ui-validate.yml

@@ -56,7 +56,7 @@ jobs:
 
       - name: Dependency audit
         if: steps.filter.outputs.code == 'true'
-        run: bun audit --audit-level high
+        run: bash scripts/ci/bun-audit.sh
 
       - name: Lint + format + typecheck
         if: steps.filter.outputs.code == 'true'

apps/api/package.json

@@ -129,7 +129,7 @@
     "@typescript-eslint/utils": "Single @typescript-eslint/utils resolution across the workspace so the shared @boring-stack-pkg ESLint plugins all load the same utils version. The UI and docs apps mirror this exact pin; a mismatch makes the custom plugins resolve divergent utils copies and fail to load.",
     "axios": "Pin patched axios (GHSA-gcfj-64vw-6mp9 and related SSRF/credential-leak advisories). 1.16.0 is vulnerable; 1.18.0 patches it. Pulled in transitively via @sendgrid/mail -> @sendgrid/client.",
     "form-data": "Pin patched form-data (GHSA-hmw2-7cc7-3qxx CRLF injection via unescaped multipart field names); 4.0.5 is vulnerable, 4.0.6 patches it. Pulled in transitively via @sendgrid/mail -> @sendgrid/client -> axios. Excluded from the install quarantine while <7 days old.",
-    "ioredis": "Force a single ioredis resolution across the tree. bullmq 5.78.0 exact-pins ioredis@5.10.1, so bumping the top-level dep to 5.11.1 otherwise leaves bullmq on its own nested 5.10.1 copy — two ioredis instances whose RedisOptions types are structurally incompatible (tsc fails on new Redis(options) calls). This override collapses bullmq's nested copy onto 5.11.1 too; 5.10.1 -> 5.11.1 is a semver patch and the Redis/BullMQ integration tests verify runtime compatibility. Drop this once bullmq advances its own ioredis pin.",
+    "ioredis": "Force a single ioredis resolution across the tree. bullmq 5.80.2 exact-pins ioredis@5.10.1, so bumping the top-level dep to 5.11.1 otherwise leaves bullmq on its own nested 5.10.1 copy — two ioredis instances whose RedisOptions types are structurally incompatible (tsc fails on new Redis(options) calls). This override collapses bullmq's nested copy onto 5.11.1 too; 5.10.1 -> 5.11.1 is a semver patch and the Redis/BullMQ integration tests verify runtime compatibility. Drop this once bullmq advances its own ioredis pin.",
     "protobufjs": "Pin patched protobufjs (GHSA-j3f2-48v5-ccww). 7.6.1 is vulnerable; 7.6.5 patches it. Transitive via the OpenTelemetry OTLP exporter (build/telemetry path)."
   },
   "overrides": {

apps/api/scripts/ci/bun-audit.sh

@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+# Run `bun audit` honoring osv-scanner.toml IgnoredVulns (GHSA ids).
+# osv-scanner and bun audit otherwise diverge: osv reads the toml allowlist,
+# bun audit does not — so CI would fail on accepted-risk findings.
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
+CONFIG="$ROOT/osv-scanner.toml"
+
+ignores=()
+if [[ -f "$CONFIG" ]]; then
+  while IFS= read -r id; do
+    [[ -n "$id" ]] || continue
+    ignores+=(--ignore="$id")
+  done < <(grep -E '^id = "' "$CONFIG" | sed -E 's/^id = "([^"]+)".*/\1/')
+fi
+
+if ((${#ignores[@]})); then
+  echo "bun audit: applying ${#ignores[@]} ignore(s) from osv-scanner.toml"
+fi
+
+exec bun audit --audit-level=high "${ignores[@]}"

apps/docs/bun.lock

@@ -61,7 +61,7 @@
     "dompurify": "Pin patched DOMPurify (GHSA-c2j3-45gr-mqc4). 3.4.7 is vulnerable; 3.4.12 patches it. Pulled via mermaid diagram rendering; diagram source is author-controlled.",
     "js-yaml": "Pin patched js-yaml (GHSA-52cp-r559-cp3m). 4.2.0 is vulnerable; 4.3.0 patches it. Build-time config loading only.",
     "postcss": "Pin patched postcss (GHSA-r28c-9q8g-f849). 8.5.16 is vulnerable; 8.5.18 patches it. Build-time CSS tooling via vite/tailwind.",
-    "sharp": "Pin patched sharp (GHSA-f88m-g3jw-g9cj). 0.34.5 is vulnerable; 0.35.0 patches it. Image processing at build time only.",
+    "sharp": "Collapse transitive sharp@0.34.5 (GHSA-f88m-g3jw-g9cj) onto the direct sharp@0.35.3 pin. Image processing at build time only.",
     "svgo": "Pin patched svgo (GHSA-2p49-hgcm-8545). 4.0.1 is vulnerable; 4.0.2 patches it. SVG optimization at build time only.",
     "ws": "Pin patched ws (GHSA-58qx-3vcg-4xpx) pulled via miniflare/wrangler dev tooling.",
     "devalue": "Pin patched devalue build-time serialization XSS (GHSA-77vg-94rm-hx3p).",
@@ -83,7 +83,7 @@
     "js-yaml": "4.3.0",
     "postcss": "8.5.18",
     "qs": "6.15.2",
-    "sharp": "0.35.0",
+    "sharp": "0.35.3",
     "svgo": "4.0.2",
     "tmp": "0.2.7",
     "undici": "7.28.0",

apps/docs/package.json

@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+# Run `bun audit` honoring osv-scanner.toml IgnoredVulns (GHSA ids).
+# osv-scanner and bun audit otherwise diverge: osv reads the toml allowlist,
+# bun audit does not — so CI would fail on accepted-risk findings.
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
+CONFIG="$ROOT/osv-scanner.toml"
+
+ignores=()
+if [[ -f "$CONFIG" ]]; then
+  while IFS= read -r id; do
+    [[ -n "$id" ]] || continue
+    ignores+=(--ignore="$id")
+  done < <(grep -E '^id = "' "$CONFIG" | sed -E 's/^id = "([^"]+)".*/\1/')
+fi
+
+if ((${#ignores[@]})); then
+  echo "bun audit: applying ${#ignores[@]} ignore(s) from osv-scanner.toml"
+fi
+
+exec bun audit --audit-level=high "${ignores[@]}"