🏥 CI FailureDependency Vulnerability Audit fails: high-severity rollup vulnerability in docs-site #1065
Description
Summary
The "Audit Docs Site Package" job in the Dependency Vulnerability Audit workflow fails because npm audit found a high-severity vulnerability in the docs-site/ package dependencies.
Triggered by commit: b508e3f (feat(proxy): make copilot api target configurable for enterprise envi…)
Vulnerabilities Found
🔴 High Severity
| Package | Range | Advisory | Fix |
|---|---|---|---|
rollup |
4.0.0 – 4.58.0 | GHSA-mw96-cpmx-2vgc — Arbitrary File Write via Path Traversal | npm audit fix |
🟡 Moderate Severity (15 total)
| Package | Chain | Fix |
|---|---|---|
lodash 4.0.0–4.17.21 |
@astrojs/check → @astrojs/language-server → volar-service-yaml → yaml-language-server |
npm audit fix --force (breaking: upgrades @astrojs/check to 0.9.2) |
lodash-es 4.0.0–4.17.22 |
mermaid → @mermaid-js/parser → langium → chevrotain |
npm audit fix |
Total: 15 vulnerabilities (1 low, 13 moderate, 1 high)
Root Cause
The rollup high-severity vulnerability (GHSA-mw96-cpmx-2vgc) was published after the current docs-site/package-lock.json was last updated. The CI audit step uses --audit-level=high, so this is correctly catching the issue.
Recommended Actions
-
Immediate fix — run
npm audit fixindocs-site/to patchrollupandlodash-es(non-breaking):cd docs-site npm audit fix -
For lodash via
@astrojs/check— evaluate whether upgrading@astrojs/checkto 0.9.2 is acceptable:cd docs-site npm audit fix --force # breaking change: `@astrojs/check` → 0.9.2
-
If
@astrojs/checkupgrade is not acceptable, consider adding annpm auditoverrides/resolutions entry indocs-site/package.jsonfor the lodash chain.
Failing Step
- Job: Audit Docs Site Package
- Step: "Run npm audit (fail on high/critical)" — exit code 1
- Note: The "Audit Main Package" job passed ✅ — only docs-site is affected
Generated by CI Doctor