fix(gh-aw-node): patch bundled tar/brace-expansion CVEs, bump npm to 11.19.0 - #49314
Conversation
…aw-node image Resolves container image vulnerabilities found in ghcr.io/github/gh-aw-node: - Bump NPM_VERSION from 11.18.0 to 11.19.0 - Add explicit patch of npm bundled tar to >=7.5.22 and brace-expansion to >=5.0.8 - Alpine CVEs (CVE-2026-58055, CVE-2025-60876) addressed by apk upgrade on rebuild Closes #49295 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
|
✅ Design Decision Gate 🏗️ completed the design decision gate check. No ADR enforcement needed: PR does not have the 'implementation' label and has 0 new lines of code in business logic directories (threshold: 100). |
|
✅ PR Code Quality Reviewer completed the code quality review. Warning threat detection engine error DetailsThe threat detection engine failed to produce results. Review the workflow run logs for details. |
|
🧠 Matt Pocock Skills Reviewer has completed the skills-based review. ✅ Warning threat detection engine error DetailsThe threat detection engine failed to produce results. Review the workflow run logs for details. |
|
✅ Test Quality Sentinel completed test quality analysis. Warning threat detection engine error DetailsThe threat detection engine failed to produce results. Review the workflow run logs for details. No test files were added or modified in this PR. Test Quality Sentinel skipped. PR #49314 modifies only changeset metadata and Docker configuration (CVE patches and npm bump); no behavioral or infrastructure tests were changed. |
There was a problem hiding this comment.
Pull request overview
Updates the gh-aw-node image to remediate reported Alpine and npm dependency vulnerabilities.
Changes:
- Bumps npm to 11.19.0.
- Overrides vulnerable bundled
tarandbrace-expansionversions. - Documents the security refresh.
Show a summary per file
| File | Description |
|---|---|
actions/setup/js/Dockerfile.safe-outputs-mcp |
Updates npm and bundled dependencies. |
.changeset/patch-refresh-gh-aw-node.md |
Records the security-related patch. |
Review details
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Suppressed comments (1)
actions/setup/js/Dockerfile.safe-outputs-mcp:19
- This runs
npm installwith npm's own installation directory as the project root.npm@11.19.0declares a substantial devDependency set, and local installs include devDependencies by default, so the runtime image can gain npm's test/build toolchain and additional scan findings. Omit development dependencies while applying these overrides.
&& npm install --prefix "$(npm root -g)/npm" --no-save "tar@^7.5.22" "brace-expansion@^5.0.8" \
- Files reviewed: 2/2 changed files
- Comments generated: 1
- Review effort level: Balanced
| # After upgrading npm, patch its bundled dependencies to meet minimum safe versions | ||
| # (tar >= 7.5.21 for CVE-2025-tar, brace-expansion >= 5.0.8 for CVE-2025-brace-expansion). |
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
Warning
threat detection engine error
The threat detection engine encountered an error and could not complete analysis. This is a tooling failure, not a security finding.
Details
The threat detection engine failed to produce results.
Review the workflow run logs for details.
Review: CVE patch for tar/brace-expansion in gh-aw-node
The changes are correct and well-scoped. Installing patched tar and brace-expansion directly into npm's own prefix after the global npm upgrade is the right workaround for npm 11.x not yet bundling the safe minimums.
One non-blocking note: the Dockerfile comment says tar >= 7.5.21 but the actual pinned range is ^7.5.22. The version pinned is safe, but the comment should be updated to match (see inline).
🧵 Reviewed using Impeccable skills by Impeccable Skills Reviewer · sonnet46 · 16.6 AIC · ⊞ 5.3K
| RUN apk upgrade --no-cache \ | ||
| && apk add --no-cache git \ | ||
| && apk info -v | sort \ | ||
| && npm install --global "npm@${NPM_VERSION}" \ |
There was a problem hiding this comment.
The inline comment says tar >= 7.5.21 but the install command pins tar@^7.5.22 (minimum 7.5.22). Update the comment to match: tar >= 7.5.22. Minor doc inconsistency only — the actual version pinned is safe.
@copilot please address this.
There was a problem hiding this comment.
Warning
threat detection engine error
The threat detection engine encountered an error and could not complete analysis. This is a tooling failure, not a security finding.
Details
The threat detection engine failed to produce results.
Review the workflow run logs for details.
Verdict: non-blocking, but tighten up before merge
The core fix (bumping npm and overriding its bundled tar/brace-expansion) is a reasonable approach and the override does correctly target npm's actual node_modules/tar and node_modules/brace-expansion paths (verified: npm has no deeper nested duplicate copies of these packages, so the --prefix override is not a no-op). Flagging three non-blocking issues for cleanup.
Themes
- Fabricated CVE identifiers (
CVE-2025-tar,CVE-2025-brace-expansion) in the code comment are misleading — they don't exist and don't match the real CVEs cited in the changeset. - No build-time verification that the override actually landed the patched versions; a future change to npm's internal dependency layout could silently regress this fix without CI catching it.
- Caret ranges (
^7.5.22,^5.0.8) mean future rebuilds can silently pick up unvetted newer versions instead of the specific patched release that was reviewed here.
None of these block the immediate CVE remediation goal, but they weaken the fix's auditability and long-term reliability.
🔎 Code quality review by PR Code Quality Reviewer · auto · 34.1 AIC · ⊞ 7.8K
Comment /review to run again
|
|
||
| # Intentional: upgrade all packages to pick up security fixes; downstream digest pins the result. | ||
| # After upgrading npm, patch its bundled dependencies to meet minimum safe versions | ||
| # (tar >= 7.5.21 for CVE-2025-tar, brace-expansion >= 5.0.8 for CVE-2025-brace-expansion). |
There was a problem hiding this comment.
The comment cites fabricated CVE identifiers that don't exist.
💡 Fabricated CVE IDs in code comment
CVE-2025-tar and CVE-2025-brace-expansion are not real CVE identifiers — they look like placeholder names invented for this comment. The actual CVEs being addressed, per the changeset, are CVE-2026-58055 and CVE-2025-60876, and those apply to Alpine base packages, not to tar/brace-expansion (which appear to have no assigned CVE at all, likely just grype flagging outdated versions against known-vulnerable ranges).
Fix: Either drop the fake CVE references entirely or replace them with the actual grype/GHSA advisory IDs for the tar and brace-expansion findings (if any exist), e.g.:
# Patch npm's bundled tar/brace-expansion to versions above the vulnerable range
# flagged by grype (no CVE assigned; see PR #49314 description for details).
Leaving fabricated CVE IDs in source is actively misleading for anyone auditing security fixes later.
| && apk add --no-cache git \ | ||
| && apk info -v | sort \ | ||
| && npm install --global "npm@${NPM_VERSION}" \ | ||
| && npm install --prefix "$(npm root -g)/npm" --no-save "tar@^7.5.22" "brace-expansion@^5.0.8" \ |
There was a problem hiding this comment.
No verification step confirms the override actually replaced the vulnerable nested versions, so a future silent regression wouldn't be caught by CI.
💡 Missing post-install verification
The RUN step installs tar@^7.5.22 and brace-expansion@^5.0.8 into npm's global package directory, but nothing confirms the versions actually landed or that npm resolves to them at runtime. If a future base-image or npm-version bump changes npm's internal node_modules layout (e.g., nesting tar/brace-expansion under a transitive dependency instead of npm's own top-level node_modules), this override could become a silent no-op and CI would still pass.
Suggested fix: add a verification line after the install, e.g.:
&& npm install --prefix "$(npm root -g)/npm" --no-save "tar@^7.5.22" "brace-expansion@^5.0.8" \
&& node -e "console.log(require('$(npm root -g)/npm/node_modules/tar/package.json').version)" \or use npm ls --prefix "$(npm root -g)/npm" tar brace-expansion and fail the build if the resolved version doesn't satisfy the minimum. Without this, the fix's effectiveness is unverified and could silently regress.
| && apk add --no-cache git \ | ||
| && apk info -v | sort \ | ||
| && npm install --global "npm@${NPM_VERSION}" \ | ||
| && npm install --prefix "$(npm root -g)/npm" --no-save "tar@^7.5.22" "brace-expansion@^5.0.8" \ |
There was a problem hiding this comment.
Caret ranges let future rebuilds silently pull unvetted versions instead of the specific patched release that was actually verified.
💡 Unpinned caret ranges undermine the point of a security patch
tar@^7.5.22 and brace-expansion@^5.0.8 allow npm to resolve to any later 7.x/5.x release on each image rebuild. Since this Dockerfile is rebuilt periodically (per the apk upgrade --no-cache comment above it, implying repeat builds over time), a later minor/patch release of either package could introduce a regression or even a new vulnerability, and the build would pick it up automatically without any review — exactly what an intentional security patch should avoid.
Fix: Pin to the exact verified-safe versions instead of caret ranges, e.g. "tar@7.5.22" and "brace-expansion@5.0.8", and bump them deliberately (with a changeset) when a newer patched version is needed.
There was a problem hiding this comment.
Warning
threat detection engine error
The threat detection engine encountered an error and could not complete analysis. This is a tooling failure, not a security finding.
Details
The threat detection engine failed to produce results.
Review the workflow run logs for details.
Skills-Based Review 🧠
Applied /diagnosing-bugs — one minor documentation issue flagged; the fix itself is correct.
📋 Key Themes & Highlights
Positive Highlights
- ✅ Minimal, surgical change — only the Dockerfile and changeset are touched
- ✅
--no-savecorrectly prevents the patch from polluting the image'snode_modules-level lock files - ✅ Alpine CVEs covered by the existing
apk upgrade --no-cachepattern - ✅ Changeset entry clearly documents all three layers of the fix
One Issue
- Placeholder CVE IDs in comment: the inline comment on line 11 uses
CVE-2025-tarandCVE-2025-brace-expansion, which are not real CVE identifiers. Compliance tooling and future auditors may be misled. See inline comment.
🧠 Reviewed using Matt Pocock's skills by Matt Pocock Skills Reviewer · sonnet46 · 21 AIC · ⊞ 7K
Comment /matt to run again
| ARG DOCKERFILE_HASH="" | ||
| ARG NPM_VERSION=11.18.0 | ||
| ARG NPM_VERSION=11.19.0 | ||
|
|
There was a problem hiding this comment.
[/diagnosing-bugs] The CVE identifiers in this comment (CVE-2025-tar, CVE-2025-brace-expansion) appear to be placeholder names rather than real CVE IDs — they will not be useful for auditors tracing this fix back to a published advisory.
💡 Suggestion
If the npm-bundled tar / brace-expansion vulnerabilities do not yet have assigned CVE numbers, say so explicitly, or link to the grype finding / npm advisory instead. For example:
# (no CVE assigned yet for tar < 7.5.22 or brace-expansion < 5.0.8; tracked via grype finding in issue #49295)Using invented CVE IDs can cause confusion for security scanners and compliance audits that expect the format CVE-YYYY-NNNNN.
@copilot please address this.
|
🎉 This pull request is included in a new release. Release: |
The
gh-aw-nodeimage (ghcr.io/github/gh-aw-node) had 6 grype-reported vulnerabilities: Alpine base CVEs (CVE-2026-58055, CVE-2025-60876) and vulnerable npm-bundled packages (tar@7.5.19,brace-expansion@5.0.7).Changes
Dockerfile.safe-outputs-mcpNPM_VERSION11.18.0→11.19.0tarandbrace-expansionto patched versions:tar≥7.5.21,brace-expansion≥5.0.8), so the explicit override is necessary.apk upgrade --no-cacheon each rebuild..changeset/patch-refresh-gh-aw-node.md— updated to document the CVEs and remediation.