Summary
The Dependency Review workflow allows GHSA-fvhg-p4hf-79x3 and GHSA-2g4f-4pwh-qvx6 globally through allow-ghsas.
Required changes
Update .github/workflows/dependency-review.yml so that the exceptions cannot remain active without review after dependency updates. Preserve the current GHSA IDs.
Use one of these controls:
- Add an explicit owner and an expiry or review date that CI validates.
- Add CI validation for the documented vulnerable package versions and their dependency paths.
Rationale
allow-ghsas filters by GHSA ID. It does not restrict an exception to a package, version, or code path. A later dependency update could retain the exceptions without a review.
Affected area
.github/workflows/dependency-review.yml- Dependency validation CI, if added
Acceptance criteria
- The workflow preserves the current GHSA exception IDs.
- Each exception has an owner and an enforced expiry/review process, or CI validates the intended package versions and dependency paths.
- Dependency updates cannot silently retain an unreviewed exception.
- The validation documentation states the exception rationale and review process.
Backlinks
Summary
The Dependency Review workflow allows
GHSA-fvhg-p4hf-79x3andGHSA-2g4f-4pwh-qvx6globally throughallow-ghsas.Required changes
Update
.github/workflows/dependency-review.ymlso that the exceptions cannot remain active without review after dependency updates. Preserve the current GHSA IDs.Use one of these controls:
Rationale
allow-ghsasfilters by GHSA ID. It does not restrict an exception to a package, version, or code path. A later dependency update could retain the exceptions without a review.Affected area
.github/workflows/dependency-review.ymlAcceptance criteria
Backlinks