Repository navigation
security sweep 2026-10-06 #6874
Description
Nightly security & dependency sweep for 2026-10-06 (main @ ecbf286).
| Alert | Classification | Action | Evidence |
|---|---|---|---|
| CodeQL open alerts (all) | not read: the list could not be fetched | none, nothing dismissed | GITHUB_CODEWHALE_SECURITY_PAT is not provisioned. With the default credential, GET /repos/codewhale-hq/Codewhale/code-scanning/alerts?state=open returned HTTP 403 Resource not accessible by integration. |
| Dependabot open alerts (all) | not read: the list could not be fetched | none | Same 403 on GET /repos/codewhale-hq/Codewhale/dependabot/alerts?state=open. GraphQL vulnerabilityAlerts(states:OPEN) returned totalCount: 0, but that is not reliable with this token: npm audit found a high-severity advisory (row below) that Dependabot would normally also report. |
GHSA-68fv-2mgg-jv7q, source-map-js (npm audit, high) |
true positive (transitive through postcss@8.5.23, web/) |
fix in #6873: 1.2.1 → 1.2.2 | npm audit --omit=dev: before 1 high severity vulnerability, after found 0 vulnerabilities. 1.2.2 was published 2026-09-30, so it is 6 days old against the preferred 7. It is the only fixed version, and the tarball diff was reviewed (same maintainer, fix-only change). |
Audits:
cd web && npm audit --omit=dev: 1 high (source-map-js), fixed by chore(deps): security bumps 2026-10-06 #6873.cargo audit: not installed locally, so not run. The CIsecurity-audit.ymlcargo-audit job on mainecbf2869apassed: 728 crate deps scanned, 0 vulnerabilities, 1 allowed warning (RUSTSEC-2025-0141,bincodeunmaintained). https://github.com/codewhale-hq/Codewhale/actions/runs/37404609978
Follow-up (same as #6845, #6379, #6058): provision GITHUB_CODEWHALE_SECURITY_PAT (code scanning + Dependabot alerts R/W) for the sweep automation so both alert lists can be read and triaged.
Activity