steward: repo health findings #159

Activity

1. Jeff-Kazzee commented on Jul 26, 2026

   

   Jeff-Kazzee

   on Jul 26, 2026

   Last edited by Jeff-Kazzee

   Collaborator

   More actions

   Receipt — site/ supply-chain findings

   PR #231 (branch fix/207-site-audit, commit 7a43117) clears all three open
   dependabot alerts on site/package-lock.json. Every fix was reachable inside the
   existing semver ranges — no overrides, no resolution forcing.

   Alert	Package	Vulnerable range	First patched	#231 ships
   #5 (high)	postcss	<= 8.5.17	8.5.18	8.5.23
   #4 (high)	svgo	>= 4.0.0, < 4.0.2	4.0.2	4.0.2
   #3 (moderate)	astro	>= 2.9.0, <= 7.0.9	7.1.0	7.1.3

   The astro floor in site/package.json moves to ^7.1.3 so a fresh resolve
   cannot regress.

   Stale-PR findings dispositioned

   This issue listed #182 and #177 as stale dependabot PRs. Both are now
   dispositioned in-thread, and the premise that they covered these advisories was
   wrong:

   • chore(deps): bump astro from 7.0.6 to 7.1.3 in /site in the npm_and_yarn group across 1 directory #182 — resolves astro 7.1.3 but still pins postcss 8.5.16 and svgo 4.0.1.
     Closes 1 of 3; leaves both HIGH alerts open. Superseded by fix(site): clear all three npm advisories (astro, postcss, svgo) #231.
   • chore(deps): bump astro from 7.0.6 to 7.1.1 in /site #177 — astro 7.1.1, strictly below the ^7.1.3 floor. Superseded by fix(site): clear all three npm advisories (astro, postcss, svgo) #231.

   Both left open pending #231's merge.

   Verification

   • npm audit → 0 vulnerabilities after a clean npm ci.
   • Site suite green: sync-docs; build 23 pages; test:site 8/8; test:links
     1618 references + 994 anchors.
   • Repo guards green: scripts/check_line_endings.py, git diff --check.
   • CI green on fix(site): clear all three npm advisories (astro, postcss, svgo) #231 — all 5 checks, including site build on Linux, which
     proves the non-Windows @astrojs/compiler-binding-* install path.

   New finding: CI has no audit gate

   .github/workflows/ci.yml runs npm ci in site/ (line 143) and then
   test:site, build, test:links — but never npm audit. Vulnerable
   dependencies pass CI green, which is why these three advisories sat unreported
   in every check. Filed as #232; not fixed in #231, to keep that slice's scope
   to the dependency bumps it was planned and verified for.

   Residual risk

   svgo@4.0.2 is exactly the first patched version — zero margin, so any future
   svgo advisory reopens immediately. Advisories are live data; this receipt is
   true as of 2026-07-26.