chore(ci): prune dead audit accept-list entries (drizzle 39356, path-to-regexp 4867)#130
chore(ci): prune dead audit accept-list entries (drizzle 39356, path-to-regexp 4867)#130chitcommit wants to merge 4 commits into
Conversation
Calls chittyfoundation/.github reusable workflow to arm auto-merge --squash --delete-branch on every non-draft PR. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Patches GHSA-gpj5-g38j-94v9 (SQL injection via improperly escaped sql.identifier() / sql.as()). First patched version: 0.45.2. Also bumps drizzle-kit 0.31.9 -> 0.31.10 (kept on 0.31.x for orm 0.45 compatibility). No chittyfinance code changes required: - decimal/numeric API unchanged (0.41 added opt-in modes only) - DrizzleQueryError wrapping (0.44) does not affect our error middleware -- no driver error code inspection in server/lib or server/middleware - query builder, $inferSelect/$inferInsert signatures stable Verification: - npm run check: clean - npm test: 23 failed / 293 passed (identical to pre-bump baseline; pre-existing failures unrelated to this bump) - pnpm audit --prod: drizzle-orm no longer in high/critical advisories Follow-up: CVE-2026-39356 can be removed from the accept-list in .github/workflows/security-gates.yml in a separate PR -- the gated audit step will continue to pass because the CVE is no longer present in the dep graph. Refs #126 Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
…to-regexp 4867) drizzle-orm bumped to 0.45.2 on main (f4b4d84) patches CVE-2026-39356. path-to-regexp CVE-2026-4867 no longer fires in pnpm audit --prod. Local audit shows 0 high/critical advisories after removal. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
|
@coderabbitai review Please evaluate:
|
📝 WalkthroughWalkthroughThis PR bumps the drizzle-orm dependency from 0.39.1 to 0.45.2 and drizzle-kit from 0.31.9 to 0.31.10, updates the security audit ignored advisories to reflect compatibility with the new versions, and adds a new auto-arm-merge GitHub Actions workflow for pull request automation. ChangesDependency Updates and CI Configuration
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Possibly related issues
Possibly related PRs
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Code Review — PR #130: Prune dead audit accept-list entriesOverviewThis PR does three things bundled together:
The security pruning goal is exactly right — no longer allowing CVEs that are actually patched is the correct hygiene. A few issues worth addressing before merge. Issues🔴 drizzle-orm 0.39 → 0.45 with no accompanying code changesThis is a 6-minor-version jump in a pre-1.0 library with a history of breaking changes between minors. The diff shows zero source file changes alongside this upgrade — no route updates, no storage changes, nothing in Required: confirm 🔴
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/auto-arm-merge.yml:
- Line 7: Replace the reusable workflow reference that currently uses the branch
tag "uses: chittyfoundation/.github/.github/workflows/auto-arm-merge.yml@main"
with a pinned commit SHA (e.g., "uses:
chittyfoundation/.github/.github/workflows/auto-arm-merge.yml@<commit-sha>");
obtain the current HEAD commit SHA from the chittyfoundation/.github repo and
substitute it for <commit-sha>, and consider periodically updating that SHA via
Dependabot/Renovate to keep the reference secure and reviewable.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: ea4f4a91-73d8-4937-8875-dcc66f41eed6
⛔ Files ignored due to path filters (1)
pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (3)
.github/workflows/auto-arm-merge.yml.github/workflows/security-gates.ymlpackage.json
💤 Files with no reviewable changes (1)
- .github/workflows/security-gates.yml
| types: [opened, ready_for_review, reopened] | ||
| jobs: | ||
| arm: | ||
| uses: chittyfoundation/.github/.github/workflows/auto-arm-merge.yml@main |
There was a problem hiding this comment.
Pin the reusable workflow to a specific commit hash.
Using @main for the reusable workflow reference means this workflow will automatically use the latest version from the chittyfoundation repository. If that workflow is modified (maliciously or accidentally), this repository will be affected without explicit review.
🔒 Recommended fix to pin the workflow reference
- uses: chittyfoundation/.github/.github/workflows/auto-arm-merge.yml@main
+ uses: chittyfoundation/.github/.github/workflows/auto-arm-merge.yml@<commit-sha>Replace <commit-sha> with the current HEAD commit SHA of the main branch in the chittyfoundation/.github repository. You can update this periodically via Dependabot or Renovate.
🧰 Tools
🪛 zizmor (1.25.2)
[error] 7-7: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/auto-arm-merge.yml at line 7, Replace the reusable
workflow reference that currently uses the branch tag "uses:
chittyfoundation/.github/.github/workflows/auto-arm-merge.yml@main" with a
pinned commit SHA (e.g., "uses:
chittyfoundation/.github/.github/workflows/auto-arm-merge.yml@<commit-sha>");
obtain the current HEAD commit SHA from the chittyfoundation/.github repo and
substitute it for <commit-sha>, and consider periodically updating that SHA via
Dependabot/Renovate to keep the reference secure and reviewable.
|
@coderabbitai review Please evaluate:
|
|
LGTM — clean accept-list hygiene. Full review below. Overview: Prunes two stale CVE entries now resolved upstream. CVE-2026-39356 (drizzle-orm) was patched by the 0.39.1 to 0.45.2 upgrade in commit f4b4d84 on main. CVE-2026-4867 (path-to-regexp) is no longer surfaced by pnpm audit --prod. 1 file, 0 additions, 5 deletions — appropriately minimal. Code Quality: Both the comment-block entry and the JSON ignore-list entry are removed together for each CVE with no orphaned lines left behind. The surrounding accept-list is untouched. Correctness: Removing the drizzle-orm entry is correct assuming f4b4d84 is on main as stated. Removing path-to-regexp without a specific bump commit is fine given the CI gate will catch any regression. Security: Pruning resolved entries is good hygiene. An ever-growing accept-list creates noise and risks masking real future advisories. Minor suggestions (non-blocking): (1) Link f4b4d84 or the drizzle upgrade PR for traceability. (2) A brief note on why path-to-regexp is no longer surfaced would improve the audit trail. Verdict: No issues found. Approve once Security Gates / Dependency Audit (High+) goes green. |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
echo "=== .github/workflows/security-gates.yml ==="
cat .github/workflows/security-gates.yml
echo ""
echo "=== .github/workflows/auto-arm-merge.yml ==="
cat .github/workflows/auto-arm-merge.yml
echo ""
echo "=== package.json ==="
cat package.json
echo ""
echo "=== pnpm-lock.yaml (first 100 lines) ==="
head -100 pnpm-lock.yaml
echo ""
echo "=== Check for any drizzle schema files that may indicate breaking API impact ==="
fd -e ts -e js drizzle --exclude node_modules | head -20
echo ""
echo "=== Check drizzle config file ==="
fd drizzle.config -e ts -e js | head -5 | xargs -I{} cat {}
echo ""
echo "=== GH advisory lookup for CVE-2026-4800 (micromatch) ==="
gh api graphql -f query='
{
securityAdvisory(ghsaId: "GHSA-952p-6rrq-rcjv") {
summary
severity
cvss { score }
publishedAt
vulnerabilities(first: 5) {
nodes {
package { name }
vulnerableVersionRange
firstPatchedVersion { identifier }
}
}
}
}' 2>/dev/null || echo "GraphQL query failed, trying REST"
echo ""
echo "=== Check auto-arm-merge reusable workflow source ==="
gh api repos/chittyfoundation/.github/contents/.github/workflows/auto-arm-merge.yml 2>/dev/null | jq -r '.content' | base64 -d 2>/dev/null || echo "Could not fetch reusable workflow"Length of output: 20945
Security Review — PR
|
| Area | Status | Action Required |
|---|---|---|
| CVE-2026-39356 removal (drizzle-orm) | ✅ Correct | None |
| CVE-2026-4867 removal (path-to-regexp) | ✅ Correct | None |
| CVE-2026-4800 (micromatch) accept | Link to tracking issue #126, set deadline |
|
| Credential exposure | ✅ None found | None |
auto-arm-merge.yml unpinned @main |
Pin to commit SHA | |
| drizzle-orm major bump + drizzle-zod compat | Confirm drizzle-zod compatibility | |
| Local vs CI audit flags | Align --ignore-workspace usage |
|
| Breaking API changes | Confirm TypeScript types + db:push |
The core goal of this PR (pruning resolved CVEs from the accept-list) is sound. The two items that warrant attention before merging are the unpinned reusable workflow and drizzle-zod compatibility with the bumped drizzle-orm version.
🧠 Learnings used
Learnt from: CR
Repo: chittyapps/chittyfinance PR: 0
File: AGENTS.md:0-0
Timestamp: 2026-03-07T14:48:32.602Z
Learning: Keep PRs small and focused; include summary, rationale, and screenshots for UI changes; link related issues; document env/DB changes and run `npm run db:push` when schema updates
1 participant
Summary
pnpm audit --prodVerification
Local
pnpm audit --prod --json --ignore-workspace --ignore-registry-errorsreturns 0 high/critical advisories after the prune — the gate continues to pass.Test plan
🤖 Generated with Claude Code
Summary by CodeRabbit