Skip to content

[Security] Dependency vulnerability triage: catch-all tracking issue for the open Mend alerts #357

Open
Open
[Security] Dependency vulnerability triage: catch-all tracking issue for the open Mend alerts#357
Assignees
kylehounslow

Description

@kylehounslow
kylehounslow
opened on Jul 27, 2026

Security dependency triage: catch-all tracking issue

Generated by Claude (Anthropic) on behalf of a maintainer. This consolidates the open Mend auto-cut dependency alerts and their existing auto-cut remediation PRs into one prioritized, agent-actionable plan. Every fix must be validated end to end with no breaking changes before its source alert is closed.

How to use this issue

Most alerts already have an open bot PR (Dependabot or Mend). The fastest safe path is to adopt the existing PR when it is a non-breaking bump, close duplicates, and only author a new change where no PR exists or the only bot PR is a major-version jump. Do not blind-merge a major-version bot PR to clear a CVE.

Before touching any alert, run a live search of the full open-PR list and dedup. The bot cuts a new PR on every scan, so the PR numbers in section 3 and 4 are a snapshot from 2026-07-27 and will drift. For each package you are about to fix, list every open PR that touches it, not just the one referenced here:

gh pr list --repo opensearch-project/observability-stack --state open --limit 200 \
  --json number,title,headRefName,labels
# then filter to the package/manifest you are working, e.g.
gh pr list --repo opensearch-project/observability-stack --state open --limit 200 \
  --search "astro in:title"

When several PRs target the same package, keep the one that touches both the manifest and the lockfile and covers the most alerts, and close the rest referencing the survivor. A single dependabot PR that bundles several packages (for example an esbuild + starlight + astro group) supersedes the narrower single-package PRs it contains; prefer the superset only when every bump in it is non-breaking, otherwise close the superset and adopt the narrow non-breaking PRs individually.

1. Scope

All open alerts labeled Mend: dependency security vulnerability as of 2026-07-27:

Alert Manifest(s) Root library Highest sev Direct/transitive Ships to users?
#214 aws/cli-installer, aws/cdk @aws-sdk/client-amp 6.1 transitive (fast-xml-parser) Yes (installer)
#215 aws/cdk, aws/cli-installer @aws-sdk/credential-provider-node 6.1 transitive (fast-xml-parser) Yes (installer)
#293 aws/cdk aws-cdk-lib 7.5 direct + transitive (fast-uri, brace-expansion) Yes (installer)
#258 docs/starlight-docs mermaid 9.3 transitive (dompurify) Docs site
#278 docs/starlight-docs @astrojs/starlight 7.5 transitive (js-yaml, postcss-selector-parser) Docs site
#296 docs astro 8.3 direct + transitive (js-yaml) Docs site
#294 docs vite (via astro) 8.3 transitive (vite) Docs build
#76 docs astro-icon 8.6 transitive (tar, undici, extract-zip) Docs build
#295 docs @astrojs/react 3.2 transitive (@babel/core) Docs build
#241 docker-compose/agent-eval-canary opensearch-genai-observability-sdk-py 5.3 transitive (idna) Internal canary

2. Blast-radius categorization

Category A: user-facing install path (aws/cli-installer, aws/cdk). Code users execute to install the stack on AWS. Highest blast radius. Not covered by Dependabot (see section 6). Alerts #214, #215, #293.

Category B: published documentation site (docs, docs/starlight-docs). Runtime XSS surface (mermaid/DOMPurify) plus build-time supply-chain surface (tar, undici, vite, babel). Content is maintainer-authored, so runtime XSS exploitability is low, but the critical DOMPurify CVE still warrants a prompt pin. Covered by Dependabot weekly. Alerts #258, #278, #296, #294, #76, #295.

Category C: internal canary (docker-compose/agent-eval-canary). Not shipped, not exposed. The idna DoS needs an attacker-controlled oversized domain string the canary never receives. Lowest blast radius. Not covered by Dependabot. Alert #241.

3. Alert-to-PR map and recommended action

PR numbers are a 2026-07-27 snapshot. Re-run the live search in "How to use" before acting; adopt whatever open PR currently satisfies the same criteria.

Alert Existing bot PR(s) Recommended action
#293 aws-cdk-lib #335 (Dependabot, manifest+lock to 2.260.0), #289 (Mend, lock only to 2.260.0) Adopt #335 (2.260.0 is a non-breaking minor, clears direct CVE-2026-13760). Close #289 as duplicate of #335. Confirm 2.260.0 also clears the fast-uri / brace-expansion transitives; if not, add overrides in the same PR.
#215 credential-provider-node #339 (Mend, lock only, aws/cli-installer to 3.972.30) #339 covers only aws/cli-installer; the alert also lists aws/cdk. Adopt #339 for the installer, then extend the fix to aws/cdk (bump floor or add fast-xml-parser override) so both manifests are clean.
#214 client-amp none No bot PR. Root cause is fast-xml-parser 5.5.8, shared with #215. Add "overrides": { "fast-xml-parser": "^5.7.0" } to both aws/cli-installer/package.json and aws/cdk/package.json, re-lock. Resolves #214 and the #215 residue together.
#258 mermaid/dompurify #334 (Dependabot, dompurify 3.4.5 to 3.4.12 in starlight-docs) Adopt #334 (patch within 3.x, clears critical CVE-2026-49978). Verify mermaid still renders after merge.
#278 starlight js-yaml/postcss #319 (js-yaml 4.3.0, starlight-docs); #336 / #356 (multi: astro v7 + starlight 0.41 + sharp/esbuild) Adopt #319 for js-yaml (non-breaking). #336 and #356 are major bumps (astro 7, starlight 0.41); do NOT adopt to clear this alert. Handle postcss-selector-parser (CVE-2026-9358, sev 4.3) with a targeted override if no minor bot PR exists.
#296 astro (docs) #267 (astro 6.3.8 patch), #327 / #340 (astro v7 major), #313 (js-yaml 4.3.0) The high CVE-2026-54299/54298 are fixed in astro 6.4.6 (within 6.x). Confirm whether #267 (6.3.8) clears them; if not, bump to ^6.4.6 in a new PR. Do NOT adopt #327/#340 (astro v7 major) in this pass. Adopt #313 for js-yaml. Leave CVE-2026-59727/59729 (astro 7-only) open with a note; track astro-7 separately.
#294 vite (docs) #355 (Dependabot, vite 7.3.3 to 7.3.6 in docs) Adopt #355 (7.3.6 >= 7.3.5, clears the CVE; non-breaking patch). Confirm the astro 6.4.6 resolution does not pin vite back below the fixed floor; if it does, add a "vite" override.
#76 astro-icon tar/undici #347 (tar 7.5.22, docs), #346 (undici 7.29.0, docs) Adopt #347 and #346 (both non-breaking, clear the tar and undici CVEs). extract-zip has no bot PR; add an override if a fixed release exists, else pin its vulnerable child. Build-time only.
#295 @babel/core none No bot PR. Add "@babel/core": "^7.29.6" override to docs/package.json. Severity 3.2 (low); lowest priority.
#241 idna none (canary not watched by Dependabot) Add idna>=3.15 constraint to docker-compose/agent-eval-canary/pyproject.toml and re-lock. Preferred long-term: pin idna>=3.15 upstream in opensearch-genai-observability-sdk-py, release a patch, then bump the SDK floor here.

4. Duplicate / superseded PRs to close

Per the maintainer directive to search for and close related/duplicate auto-cut PRs: run the live search first, then for each surviving fix close every other open PR that targets the same package/CVE. As of 2026-07-27 the confirmed duplicate clusters are:

Before closing any PR, confirm the surviving PR (or the new targeted fix) actually clears the same CVE set. Comment the reason and link the survivor on each closed PR.

5. Prioritized execution order

Ordering balances resolution speed (adopt existing non-breaking PRs, batch shared roots) against blast radius (user-facing install path and critical severity first).

P0. Category A install path. #293 (adopt #335, close #289); #214 + #215 residue (fast-xml-parser override across both aws manifests, adopt #339 for the installer lock).

P1. Category B critical. #258 (adopt #334, verify mermaid renders).

P2. Category B remaining, non-breaking only. #278 js-yaml (adopt #319) + postcss override; #296 astro within 6.x to 6.4.6 + js-yaml (adopt #313); #294 vite (adopt #355 or override); #76 tar/undici (adopt #347, #346) + extract-zip.

P3. Low severity and internal. #295 babel override; #241 idna constraint.

6. Cross-cutting: close the Dependabot coverage gap

.github/dependabot.yml watches only /docs, /docs/starlight-docs, and three /examples/* Python dirs. It does not watch aws/cdk, aws/cli-installer, or docker-compose/agent-eval-canary, which is why the Category A and C alerts have no Dependabot PRs and sat open. Add these directories to the Dependabot config in a follow-up PR so future install-path CVEs are auto-surfaced. Track separately from the fixes above.

7. End-to-end validation (required per fix, no breaking changes)

Run the checks that mirror the repo's CI for the touched manifest. A fix is done only when the source alert's vulnerable version no longer resolves AND the component still builds and passes tests.

  • docs/ and docs/starlight-docs/ (mirrors docs-ci.yml): 
    cd docs && npm install && npm run build && npm run test:coverage
    npm run build also builds starlight-docs. Then confirm resolution: 
    npm ls dompurify js-yaml vite @babel/core tar undici    # in the relevant dir
npm audit --omit=dev
    For mermaid-11.15.0.tgz: 9 vulnerabilities (highest severity is: 9.3) #258, load the built docs and confirm mermaid diagrams still render.
  • aws/cdk/: 
    cd aws/cdk && npm install && npm run build && npm run synth
npm ls fast-xml-parser fast-uri brace-expansion aws-cdk-lib
    synth must produce the same template shape (no resource diffs from the dependency bump).
  • aws/cli-installer/ (mirrors cli-unit-tests.yml and e2e.yml): 
    cd aws/cli-installer && npm install && npm test && npm run e2e:list
npm ls fast-xml-parser
    Run npm run e2e where credentials/environment allow; otherwise flag the gap and request QA on the installer path.
  • docker-compose/agent-eval-canary/: 
    cd docker-compose/agent-eval-canary && uv sync && uv run python -c "import idna, importlib.metadata as m; print(m.version('idna'))"
    Confirm >= 3.15 and run the canary's existing smoke path.

Commit the regenerated lockfile alongside every manifest change.

8. Execution checklist for the implementing agent

  1. Run the live open-PR search in "How to use" and build the current package-to-PR map before touching any alert; the snapshots in sections 3 and 4 will have drifted.
  2. For each alert, check section 3. Adopt the existing non-breaking bot PR where one exists; author a new change only where noted.
  3. Rebase the adopted bot PR on main and confirm CI is green before merge.
  4. Where authoring a new change: apply the pin/override exactly as listed, re-lock (npm install, or uv lock/uv sync for the canary).
  5. Run the matching validation block in section 7. Builds and tests green; target vulnerable version absent from npm ls / npm audit / uv resolution.
  6. Close every duplicate PR the live search surfaced for the fixed package (section 4 lists the known clusters), each with a comment linking the survivor.
  7. In every PR description, list the CVEs it closes and reference this tracking issue and the source Mend alert.
  8. When the vulnerable version is confirmed absent on main, the Mend alert auto-closes on the next scan; close manually with a link to the merged PR if it lingers.
  9. Never force a major-version bump (astro 7, starlight 0.41, or any major-tagged bump) to clear a CVE. If the only fix is a major, leave the CVE open with a one-line note and open a separate evaluation issue.

9. Follow-ups to track separately (not blockers for the fixes)

Metadata

Metadata

Assignees

Labels

No labels
No labels

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions