From 287aef4dfb7c5a52067932e29b79eabf1e6ebc54 Mon Sep 17 00:00:00 2001 From: Umputun Date: Tue, 11 Aug 2026 10:54:15 -0500 Subject: [PATCH] docs: add backlog items for site PR validation and frontend js-yaml overrides site/** pull requests get no build validation: ci-site.yml declares a pull_request trigger but gates its only build job to master and tags, so a bad site lockfile first fails on the post-merge run that deploys. frontend pnpm override floors still admit js-yaml 3.15.0 and 5.2.0, leaving three open advisories including the one PR 2141 closed for site/. --- .../frontend-js-yaml-overrides-stale.md | 37 +++++++++++++++++++ docs/backlog/site-pr-build-never-runs.md | 35 ++++++++++++++++++ 2 files changed, 72 insertions(+) create mode 100644 docs/backlog/frontend-js-yaml-overrides-stale.md create mode 100644 docs/backlog/site-pr-build-never-runs.md diff --git a/docs/backlog/frontend-js-yaml-overrides-stale.md b/docs/backlog/frontend-js-yaml-overrides-stale.md new file mode 100644 index 00000000..28019752 --- /dev/null +++ b/docs/backlog/frontend-js-yaml-overrides-stale.md @@ -0,0 +1,37 @@ +--- +worth: yes +where: frontend/pnpm-lock.yaml:61 +added: 2026-08-11 +--- +# frontend pnpm overrides still admit vulnerable js-yaml + +Three open Dependabot alerts against `frontend/pnpm-lock.yaml` survive because the pnpm override +floors in that file are set below the patched versions. + +| override (line) | current floor | resolved version | advisory | patched in | +|---|---|---|---|---| +| `js-yaml@>=3.0.0 <4.0.0` (:61) | `>=3.14.2` | 3.15.0 (:4798, :12669) | GHSA-5p4m-2wfm-xmqj (high) | 3.15.1 | +| `js-yaml@>=4.0.0 <5.0.0` (:62) | `>=5.0.0` | 5.2.0 (:4802, :12674) | GHSA-pm4m-ph32-ghv5 (high) | 5.2.2 | +| | | | GHSA-724g-mxrg-4qvm (medium) | 5.2.1 | + +GHSA-5p4m-2wfm-xmqj is the same advisory PR #2141 closed for `site/`, patched there by moving to +js-yaml 3.15.1. It remains open against the frontend lockfile, which is still on 3.15.0. Verified +against the repository's Dependabot alerts, not inferred from version numbers. + +`.github/dependabot.yml` sets `open-pull-requests-limit: 0` on every npm directory, so no version +update PR will ever reach these. Security updates bypass that limit, which is why #2141 existed at +all, but the override floors pin the resolution regardless of what the bot proposes. + +Fix: raise both floors and re-lock. + +```yaml +js-yaml@>=3.0.0 <4.0.0: '>=3.15.1 <4.0.0' +js-yaml@>=4.0.0 <5.0.0: '>=5.2.2 <6.0.0' +``` + +Both js-yaml lines are build and test time only in the frontend (3.x arrives via +`@istanbuljs/load-nyc-config`), so this is alert hygiene rather than a shipped vulnerability. + +Separately, and not covered here: `frontend/pnpm-lock.yaml` carries a wider queue of open alerts +(brace-expansion, undici, fast-uri, postcss, svgo, webpack-dev-server, body-parser). Those were not +audited and may or may not be reachable. diff --git a/docs/backlog/site-pr-build-never-runs.md b/docs/backlog/site-pr-build-never-runs.md new file mode 100644 index 00000000..02cbd89b --- /dev/null +++ b/docs/backlog/site-pr-build-never-runs.md @@ -0,0 +1,35 @@ +--- +worth: yes +where: .github/workflows/ci-site.yml:24 +added: 2026-08-11 +--- +# site/** pull requests get no build validation + +`ci-site.yml` declares a `pull_request` trigger on `site/**` (lines 12-15), but the only job that +installs and builds is gated: + +```yaml +if: github.ref == 'refs/heads/master' || startsWith(github.ref, 'refs/tags/') +``` + +On a pull request `github.ref` is `refs/pull/N/merge`, so `build` skips, and `merge` (`needs: build`) +and `deploy` skip with it. The trigger is dead: it produces a run in which every job is skipped, which +renders in the checks list the same way a pass does. No required status checks are configured on +master either, so nothing else catches it. + +Consequence: a `site/yarn.lock` that fails `yarn --frozen-lockfile` first fails on the master run +after merge, which is the same run that rebuilds and deploys remark42.com. `site/Dockerfile:5-6` is +the only place the lockfile is exercised, and it runs post-merge. + +Fix: add a PR-only job mirroring `.github/workflows/ci-build.yml`'s existing pattern, using +`docker/build-push-action` with `context: ./site`, `load: true`, no `outputs:`, and no +`docker/login-action`. + +Constraint any fix must preserve: the current gate exists because `build` pushes to ghcr using +`secrets.PKG_TOKEN`, which must not run for pull requests, since fork PRs receive no secrets. +Relaxing the `if` on its own is not sufficient and would break fork PRs. + +Surfaced while reviewing PR #2141 (a dependabot js-yaml lockfile bump), where all three site jobs +reported as skipped and nothing verified the lockfile before merge. `site/**` PRs are mostly +generated lockfile bumps, which is exactly the class a frozen-lockfile install catches and a human +reviewer cannot.