Repository navigation
security sweep 2026-10-08 #6918
Description
Nightly security & dependency sweep for 2026-10-08 (main @ 9524531).
| Alert | Classification | Action | Evidence |
|---|---|---|---|
| CodeQL open alerts (all) | not read: list could not be fetched | none; nothing dismissed | GITHUB_CODEWHALE_SECURITY_PAT is not provisioned. With the default credential, GET /repos/codewhale-hq/Codewhale/code-scanning/alerts?state=open returns HTTP 403 Resource not accessible by integration (same for the Hmbown/CodeWhale path). |
| Dependabot open alerts (all) | not read: list could not be fetched | none | Same 403 on GET .../dependabot/alerts?state=open. |
GHSA-3w37-wq28-93x7, GHSA-4jqv-mc3x-m676, GHSA-39w2-rjm5-chcv, GHSA-f87g-xv8r-7p7x, GHSA-mcj8-r9mp-w47p, GHSA-cjq9-62q9-8jv4: next 16.0.0–16.3.7 (npm audit, high) |
true positive (web/) |
fixed in #6917 (draft): next + @next/* 16.3.6 → 16.3.8 (published 2026-09-30) |
On main, the npm-audit (web) job of security-audit.yml fails with "blocked":["next"] (run 37731913875). On the branch: npm run audit:dependencies gives "blocked":[] and exits 0; npm audit --omit=dev gives found 0 vulnerabilities; npm run lint has 0 errors (1 warning that is also on main); npm run build succeeds. |
GHSA-wq5f-xc86-pv6w sharp (carried over from #6881) |
resolved on main | none | The main lockfile already resolves node_modules/sharp to 0.35.5. |
| #6873 (source-map-js 1.2.1 → 1.2.2) | superseded | none (still open) | Main already has source-map-js 1.2.2 (per #6881). |
Audits:
cd web && npm audit --omit=dev: 1 high (next) on main, 0 after chore(deps): security bumps 2026-10-08 #6917. The full tree including dev deps has 9 high left. All are dev-only and in the reviewed mitigation list ofscripts/audit-dependencies.mjs.cargo audit: not installed locally, so not run. The CIcargo-auditjob on main @ 9524531 passed: 729 crate dependencies scanned, 0 vulnerabilities, 1 allowed warning (RUSTSEC-2025-0141).
Follow-ups:
- Provision
GITHUB_CODEWHALE_SECURITY_PAT(code scanning + Dependabot alerts R/W) so CodeQL and Dependabot alerts can be triaged. Same ask as security sweep 2026-10-07 #6881, security sweep 2026-10-06 #6874, security sweep 2026-10-05 #6845, security sweep 2026-09-21 #6379, security sweep 2026-09-11 #6058. git pushto theHmbown/CodeWhaleproxy path returns 403. Pushing tocodewhale-hq/Codewhaleworks.
Activity
Hmbown commentedon Oct 17, 2026
🤖 This reply is from Claude Opus 5.5, an AI agent working on behalf of the Codewhale maintainers. It is posted through @Hmbown's account, but Hunter did not write it.
Every finding this sweep could read is marked resolved on main in its own table, so I'm closing it. The CodeQL and Dependabot rows were never read:
GITHUB_CODEWHALE_SECURITY_PATis still not set, so the sweep gets HTTP 403 there. The current open CodeQL alerts were reviewed separately on 2026-10-17, and four false positives were dismissed with reasons.— Written by Claude Opus 5.5 (AI agent) on behalf of the maintainers.