Repository navigation
security sweep 2026-10-10 #6951
Description
Nightly security & dependency sweep for 2026-10-10 (main @ 64bb073).
| Alert | Classification | Action | Evidence |
|---|---|---|---|
| CodeQL open alerts (all) | not read: list could not be fetched | none; nothing dismissed | GITHUB_CODEWHALE_SECURITY_PAT is not provisioned. With the default credential, GET /repos/codewhale-hq/Codewhale/code-scanning/alerts?state=open returns HTTP 403 Resource not accessible by integration (same on the Hmbown/CodeWhale path). The token reports all repo permissions false. |
| Dependabot open alerts (all) | not read: list could not be fetched | none | Same 403 on GET .../dependabot/alerts?state=open. |
next advisories (GHSA-3w37-wq28-93x7 and others, carried over from #6918) |
resolved on main | none | The main lockfile resolves node_modules/next to 16.4.0 (above the 16.3.8 fix). #6917 (draft, 16.3.6 → 16.3.8) is superseded by main and is still open. |
Audits (local, main @ 64bb073, after npm ci in web/):
cd web && npm audit --omit=dev:found 0 vulnerabilities.cd web && npm run audit:dependencies:"upstreamFindings":9,"blocked":[]. All 9 are dev-only (braces → micromatch/fast-glob/chokidar viagt,tailwindcss,eslint-config-next) and covered by the reviewed braces 3.0.3 mitigation.cargo audit: not installed locally, so not run. The CIcargo-auditjob ofsecurity-audit.ymlon main @ 64bb073 passed (run 38032858514): 727 crate dependencies scanned, 0 vulnerabilities, 1 allowed warning (RUSTSEC-2025-0141, unmaintained). All 10npm-audit (*)jobs in the same run passed.
No dependency changes were needed, so no PR was opened.
Follow-ups:
- Provision
GITHUB_CODEWHALE_SECURITY_PAT(code scanning + Dependabot alerts R/W) so CodeQL and Dependabot alerts can be triaged. Same ask as security sweep 2026-10-08 #6918, security sweep 2026-10-07 #6881, security sweep 2026-10-06 #6874, security sweep 2026-10-05 #6845, security sweep 2026-09-21 #6379, security sweep 2026-09-11 #6058. - chore(deps): security bumps 2026-10-08 #6917 can be closed as superseded (main is on
next16.4.0).
Activity
Hmbown commentedon Oct 17, 2026
🤖 This reply is from Claude Opus 5.5, an AI agent working on behalf of the Codewhale maintainers. It is posted through @Hmbown's account, but Hunter did not write it.
Every finding this sweep could read is marked resolved on main in its own table, so I'm closing it. The CodeQL and Dependabot rows were never read:
GITHUB_CODEWHALE_SECURITY_PATis still not set, so the sweep gets HTTP 403 there. The current open CodeQL alerts were reviewed separately on 2026-10-17, and four false positives were dismissed with reasons.— Written by Claude Opus 5.5 (AI agent) on behalf of the maintainers.