From bff312560518582c66ad3035c4c0aa3c813dd79e Mon Sep 17 00:00:00 2001
From: Will Manning <will@willmanning.io>
Date: Thu, 29 Oct 2026 08:28:01 +0100
Subject: [PATCH] Drop the cooldown exemptions now that their versions are 14
 days old

next 16.4.1, its @next/* packages, react and react-dom 19.3.1, and undici
7.30.1 and 8.12.2 are all past the 14-day window as of 2026-10-29 15:06
UTC. Each exemption covered every future version of its package, so it
goes now.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Will Manning <will@willmanning.io>
---
 CLAUDE.md   |  5 +----
 bunfig.toml | 33 ---------------------------------
 2 files changed, 1 insertion(+), 37 deletions(-)

diff --git a/CLAUDE.md b/CLAUDE.md
index 0fc243e..c86a061 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -104,7 +104,7 @@ Keep them in lockstep when bumping. Raising `.nvmrc` alone makes CI validate aga
 
 ### bench/ (Bun workspace member)
 
-`bench/web` is a member of the root Bun workspace, so the layers above cover it: the cooldown and its exemptions in `bunfig.toml`, `trustedDependencies` and `overrides` in the root `package.json`, `bun audit`, and the `bun.lock (bench/web)` manifest of the dependency snapshot. What is particular to bench:
+`bench/web` is a member of the root Bun workspace, so the layers above cover it: the cooldown in `bunfig.toml`, `trustedDependencies` and `overrides` in the root `package.json`, `bun audit`, and the `bun.lock (bench/web)` manifest of the dependency snapshot. What is particular to bench:
 
 - **Install at the root.** `bun install --frozen-lockfile` at the root installs both apps, and `bun run --cwd bench/web <script>` runs bench's scripts; CI and `bench-deploy.yml` do the same, and `bench/web/vercel.json` gives `vercel build` the same install command. A `bun install` in `bench/web` also finds the root's `bunfig.toml`.
 - **Linker.** `bunfig.toml` sets `linker = "isolated"`, so every package gets the dependencies it resolved, as pnpm gave bench. That layout keeps one app's tools from loading the other's copy of a package; both apps now resolve the same TypeScript, so that no longer matters for it.
@@ -136,8 +136,6 @@ Keep them in lockstep when bumping. Raising `.nvmrc` alone makes CI validate aga
 - **tmp `<0.2.6`** (GHSA-ph9p-34f9-6g65, high path traversal via unsanitized prefix/postfix) and **tmp `<=0.2.3`** (GHSA-52f5-9888-hmc6, low symlink write via the `dir` param). `@lhci/cli` pulls `tmp@0.1.0` and `tmp@0.0.33`. Overriding to `^0.2.6` crosses tmp's 0.1 → 0.2 API break (the sync/callback surface changed) inside a tool we cannot test beyond running it, so the override is not worth the risk for a CI-only dev dep. Neither traversal scenario applies: nothing passes user input to `tmp`'s prefix, postfix, or `dir`. Drop this entry when `@lhci/cli` ships a release with patched transitives.
 - **uuid `<11.1.1`** (GHSA-w5hq-g745-h8pq, moderate missing buffer bounds in v3/v5/v6 when `buf` is provided). Single path, `@lhci/cli > uuid@8.3.2`. The vulnerable code (v3/v5/v6 called with an explicit `buf`) is not reached. Drop this entry when `@lhci/cli` bumps uuid.
 
-**Cooldown exemptions.** `bunfig.toml` → `install.minimumReleaseAgeExcludes` lists `next`, its `@next/*` platform packages, `react`, `react-dom` and `undici`. Next 16.4.1 fixes two critical RCEs (GHSA-2464-fhr4-w9xw, GHSA-673q-mjm6-r5xr) and a high DoS (GHSA-p3m5-59mp-jv5r), but was 13 days old when adopted. React 19.3.1 hardens the Server Components transport. undici 7.30.1 and 8.12.2 (2026-10-15, 14:18 and 15:05 UTC) fix the dev-only advisories that reach bench through testcontainers (7.x) and jsdom (8.x; 8.12.1, the newest version past the window, has eight advisories, four of them high). The lockfile holds undici 8.12.2, not the newer 8.12.3 the exemption would also admit. An exemption covers every future version of the package, not only the one adopted, so remove the whole list after 2026-10-29 15:06 UTC, when all of them are past the window.
-
 **Held back on purpose:** `@types/node` stays on `^24` to match the deployable runtime (see "Node version"); `renovate.json` caps it with `allowedVersions: "<25"` so Renovate stops opening 25.x / 26.x PRs.
 
 The `audit` job in `.github/workflows/ci.yml` runs a bare `bun audit` and never fails CI; the advisories above show in its job summary until their removal triggers land. Merge blocking on advisories is `dependency-review`'s job.
@@ -149,5 +147,4 @@ The `audit` job in `.github/workflows/ci.yml` runs a bare `bun audit` and never
 - **Accepted, dev-only — protobufjs 7.6.2** (GHSA-f38q-mgvj-vph7, fixed in 7.6.3, and GHSA-j3f2-48v5-ccww, fixed in 7.6.5; both moderate; via testcontainers > dockerode > @grpc/proto-loader). The move to Bun kept pnpm's version. It runs only in bench's tests. Drop this entry when a lockfile refresh reaches protobufjs 7.6.5.
 - **Resolved by `overrides` in the root `package.json`:** zod (see "Audit advisories"). sharp needs no override for bench: next 16.4.1 asks for `^0.35.5` itself.
 - **Resolved in the lockfile:** @grpc/grpc-js, brace-expansion, js-yaml and source-map-js, by refreshing within their parents' ranges. vite is a direct dev dependency of bench (`^8.3.4`), because it is vitest's peer: as a direct dependency its range sets the version the lockfile holds, so the vulnerable 8.0.16 cannot come back. (Under pnpm, an override alone left 8.0.16 locked.)
-- **Cooldown exemptions:** `undici` in `bunfig.toml`, until 2026-10-29 15:06 UTC (see "Cooldown exemptions" above). next 16.4.1, its `@next/*` packages and react 19.3.1 were already past the window when bench moved to them, at 2026-10-28 22:31 UTC: npm published next and its `@next/*` packages on 2026-10-14 between 17:28 and 17:43 UTC, and react and react-dom at 16:47 and 16:49 UTC. The "13 days old" in "Cooldown exemptions" above was their age when the site adopted them.
 - **Accepted, the Vercel CLI (64.0.2) in `bench-deploy.yml`:** tar (one critical), undici, path-to-regexp, minimatch, js-yaml, smol-toml, zod and @fastify/busboy. The CLI and its framework builders pin these exactly; fixing undici alone means a 5 → 6 major inside the CLI's HTTP client. It runs only in CI, on our own build output. It is installed without a lockfile, so dependency review never sees it, and these advisories live only here. Re-audit when Renovate bumps `VERCEL_CLI_VERSION`: install it with `npm install --package-lock-only vercel@<version>` in a scratch directory and run `npm audit`.
diff --git a/bunfig.toml b/bunfig.toml
index aa8dee9..3e13daa 100644
--- a/bunfig.toml
+++ b/bunfig.toml
@@ -21,36 +21,3 @@ linker = "isolated"
 #
 # Units: seconds. 14 * 86400 = 1209600.
 minimumReleaseAge = 1209600
-
-# Security fixes newer than the 14-day window. Each entry exempts the whole
-# package, so remove it once its pinned version is older than 14 days.
-#
-# - next 16.4.1 (2026-10-15) fixes GHSA-2464-fhr4-w9xw and GHSA-673q-mjm6-r5xr
-#   (critical RCE) and GHSA-p3m5-59mp-jv5r (high DoS). Next pins its @next/*
-#   packages to the same version, so they need the same exemption.
-# - react / react-dom 19.3.1 (2026-10-14) harden the Server Components transport.
-#   React shipped the change on every supported line at once (19.0.9, 19.1.10,
-#   19.2.9).
-# - undici 7.30.1 and 8.12.2 (2026-10-15 14:18 and 15:05 UTC) fix the dev-only
-#   advisories that reach bench through testcontainers (7.x) and jsdom (8.x).
-#   8.12.1, the newest 8.x past the window, has four high advisories
-#   (GHSA-4w7w-5xrc-9h26, GHSA-2m5v-pch6-74hx, GHSA-qrxm-fqhp-jwvm,
-#   GHSA-xjj6-f33q-929c). The lockfile pins 8.12.2, not the newer 8.12.3 this
-#   exemption would also allow. Only bench uses undici.
-#
-# Remove all entries after 2026-10-29 15:06 UTC.
-minimumReleaseAgeExcludes = [
-  "next",
-  "@next/env",
-  "@next/swc-darwin-arm64",
-  "@next/swc-darwin-x64",
-  "@next/swc-linux-arm64-gnu",
-  "@next/swc-linux-arm64-musl",
-  "@next/swc-linux-x64-gnu",
-  "@next/swc-linux-x64-musl",
-  "@next/swc-win32-arm64-msvc",
-  "@next/swc-win32-x64-msvc",
-  "react",
-  "react-dom",
-  "undici",
-]