Skip to content

Remove the cooldown exemptions from bunfig.toml #131

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
lwwmanning merged 1 commit into from
Oct 29, 2026
Merged

Remove the cooldown exemptions from bunfig.toml #131

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 1 addition & 4 deletions CLAUDE.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -104,7 +104,7 @@ Keep them in lockstep when bumping. Raising `.nvmrc` alone makes CI validate aga

### bench/ (Bun workspace member)

`bench/web` is a member of the root Bun workspace, so the layers above cover it: the cooldown and its exemptions in `bunfig.toml`, `trustedDependencies` and `overrides` in the root `package.json`, `bun audit`, and the `bun.lock (bench/web)` manifest of the dependency snapshot. What is particular to bench:
`bench/web` is a member of the root Bun workspace, so the layers above cover it: the cooldown in `bunfig.toml`, `trustedDependencies` and `overrides` in the root `package.json`, `bun audit`, and the `bun.lock (bench/web)` manifest of the dependency snapshot. What is particular to bench:

- **Install at the root.** `bun install --frozen-lockfile` at the root installs both apps, and `bun run --cwd bench/web <script>` runs bench's scripts; CI and `bench-deploy.yml` do the same, and `bench/web/vercel.json` gives `vercel build` the same install command. A `bun install` in `bench/web` also finds the root's `bunfig.toml`.
- **Linker.** `bunfig.toml` sets `linker = "isolated"`, so every package gets the dependencies it resolved, as pnpm gave bench. That layout keeps one app's tools from loading the other's copy of a package; both apps now resolve the same TypeScript, so that no longer matters for it.
Expand Down Expand Up @@ -136,8 +136,6 @@ Keep them in lockstep when bumping. Raising `.nvmrc` alone makes CI validate aga
- **tmp `<0.2.6`** (GHSA-ph9p-34f9-6g65, high path traversal via unsanitized prefix/postfix) and **tmp `<=0.2.3`** (GHSA-52f5-9888-hmc6, low symlink write via the `dir` param). `@lhci/cli` pulls `tmp@0.1.0` and `tmp@0.0.33`. Overriding to `^0.2.6` crosses tmp's 0.1 → 0.2 API break (the sync/callback surface changed) inside a tool we cannot test beyond running it, so the override is not worth the risk for a CI-only dev dep. Neither traversal scenario applies: nothing passes user input to `tmp`'s prefix, postfix, or `dir`. Drop this entry when `@lhci/cli` ships a release with patched transitives.
- **uuid `<11.1.1`** (GHSA-w5hq-g745-h8pq, moderate missing buffer bounds in v3/v5/v6 when `buf` is provided). Single path, `@lhci/cli > uuid@8.3.2`. The vulnerable code (v3/v5/v6 called with an explicit `buf`) is not reached. Drop this entry when `@lhci/cli` bumps uuid.

**Cooldown exemptions.** `bunfig.toml` → `install.minimumReleaseAgeExcludes` lists `next`, its `@next/*` platform packages, `react`, `react-dom` and `undici`. Next 16.4.1 fixes two critical RCEs (GHSA-2464-fhr4-w9xw, GHSA-673q-mjm6-r5xr) and a high DoS (GHSA-p3m5-59mp-jv5r), but was 13 days old when adopted. React 19.3.1 hardens the Server Components transport. undici 7.30.1 and 8.12.2 (2026-10-15, 14:18 and 15:05 UTC) fix the dev-only advisories that reach bench through testcontainers (7.x) and jsdom (8.x; 8.12.1, the newest version past the window, has eight advisories, four of them high). The lockfile holds undici 8.12.2, not the newer 8.12.3 the exemption would also admit. An exemption covers every future version of the package, not only the one adopted, so remove the whole list after 2026-10-29 15:06 UTC, when all of them are past the window.

**Held back on purpose:** `@types/node` stays on `^24` to match the deployable runtime (see "Node version"); `renovate.json` caps it with `allowedVersions: "<25"` so Renovate stops opening 25.x / 26.x PRs.

The `audit` job in `.github/workflows/ci.yml` runs a bare `bun audit` and never fails CI; the advisories above show in its job summary until their removal triggers land. Merge blocking on advisories is `dependency-review`'s job.
Expand All @@ -149,5 +147,4 @@ The `audit` job in `.github/workflows/ci.yml` runs a bare `bun audit` and never
- **Accepted, dev-only — protobufjs 7.6.2** (GHSA-f38q-mgvj-vph7, fixed in 7.6.3, and GHSA-j3f2-48v5-ccww, fixed in 7.6.5; both moderate; via testcontainers > dockerode > @grpc/proto-loader). The move to Bun kept pnpm's version. It runs only in bench's tests. Drop this entry when a lockfile refresh reaches protobufjs 7.6.5.
- **Resolved by `overrides` in the root `package.json`:** zod (see "Audit advisories"). sharp needs no override for bench: next 16.4.1 asks for `^0.35.5` itself.
- **Resolved in the lockfile:** @grpc/grpc-js, brace-expansion, js-yaml and source-map-js, by refreshing within their parents' ranges. vite is a direct dev dependency of bench (`^8.3.4`), because it is vitest's peer: as a direct dependency its range sets the version the lockfile holds, so the vulnerable 8.0.16 cannot come back. (Under pnpm, an override alone left 8.0.16 locked.)
- **Cooldown exemptions:** `undici` in `bunfig.toml`, until 2026-10-29 15:06 UTC (see "Cooldown exemptions" above). next 16.4.1, its `@next/*` packages and react 19.3.1 were already past the window when bench moved to them, at 2026-10-28 22:31 UTC: npm published next and its `@next/*` packages on 2026-10-14 between 17:28 and 17:43 UTC, and react and react-dom at 16:47 and 16:49 UTC. The "13 days old" in "Cooldown exemptions" above was their age when the site adopted them.
- **Accepted, the Vercel CLI (64.0.2) in `bench-deploy.yml`:** tar (one critical), undici, path-to-regexp, minimatch, js-yaml, smol-toml, zod and @fastify/busboy. The CLI and its framework builders pin these exactly; fixing undici alone means a 5 → 6 major inside the CLI's HTTP client. It runs only in CI, on our own build output. It is installed without a lockfile, so dependency review never sees it, and these advisories live only here. Re-audit when Renovate bumps `VERCEL_CLI_VERSION`: install it with `npm install --package-lock-only vercel@<version>` in a scratch directory and run `npm audit`.
33 changes: 0 additions & 33 deletions bunfig.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,36 +21,3 @@ linker = "isolated"
#
# Units: seconds. 14 * 86400 = 1209600.
minimumReleaseAge = 1209600

# Security fixes newer than the 14-day window. Each entry exempts the whole
# package, so remove it once its pinned version is older than 14 days.
#
# - next 16.4.1 (2026-10-15) fixes GHSA-2464-fhr4-w9xw and GHSA-673q-mjm6-r5xr
# (critical RCE) and GHSA-p3m5-59mp-jv5r (high DoS). Next pins its @next/*
# packages to the same version, so they need the same exemption.
# - react / react-dom 19.3.1 (2026-10-14) harden the Server Components transport.
# React shipped the change on every supported line at once (19.0.9, 19.1.10,
# 19.2.9).
# - undici 7.30.1 and 8.12.2 (2026-10-15 14:18 and 15:05 UTC) fix the dev-only
# advisories that reach bench through testcontainers (7.x) and jsdom (8.x).
# 8.12.1, the newest 8.x past the window, has four high advisories
# (GHSA-4w7w-5xrc-9h26, GHSA-2m5v-pch6-74hx, GHSA-qrxm-fqhp-jwvm,
# GHSA-xjj6-f33q-929c). The lockfile pins 8.12.2, not the newer 8.12.3 this
# exemption would also allow. Only bench uses undici.
#
# Remove all entries after 2026-10-29 15:06 UTC.
minimumReleaseAgeExcludes = [
"next",
"@next/env",
"@next/swc-darwin-arm64",
"@next/swc-darwin-x64",
"@next/swc-linux-arm64-gnu",
"@next/swc-linux-arm64-musl",
"@next/swc-linux-x64-gnu",
"@next/swc-linux-x64-musl",
"@next/swc-win32-arm64-msvc",
"@next/swc-win32-x64-msvc",
"react",
"react-dom",
"undici",
]
Loading