Summary
The "Audit Docs Site Package" job in the Dependency Vulnerability Audit workflow fails because npm audit found a high-severity vulnerability in the docs-site/ package dependencies.
Triggered by commit: b508e3f (feat(proxy): make copilot api target configurable for enterprise envi…)
Vulnerabilities Found
🔴 High Severity
| Package |
Range |
Advisory |
Fix |
rollup |
4.0.0 – 4.58.0 |
GHSA-mw96-cpmx-2vgc — Arbitrary File Write via Path Traversal |
npm audit fix |
🟡 Moderate Severity (15 total)
| Package |
Chain |
Fix |
lodash 4.0.0–4.17.21 |
@astrojs/check → @astrojs/language-server → volar-service-yaml → yaml-language-server |
npm audit fix --force (breaking: upgrades @astrojs/check to 0.9.2) |
lodash-es 4.0.0–4.17.22 |
mermaid → @mermaid-js/parser → langium → chevrotain |
npm audit fix |
Total: 15 vulnerabilities (1 low, 13 moderate, 1 high)
Root Cause
The rollup high-severity vulnerability (GHSA-mw96-cpmx-2vgc) was published after the current docs-site/package-lock.json was last updated. The CI audit step uses --audit-level=high, so this is correctly catching the issue.
Recommended Actions
-
Immediate fix — run npm audit fix in docs-site/ to patch rollup and lodash-es (non-breaking):
cd docs-site
npm audit fix
-
For lodash via @astrojs/check — evaluate whether upgrading @astrojs/check to 0.9.2 is acceptable:
cd docs-site
npm audit fix --force # breaking change: `@astrojs/check` → 0.9.2
-
If @astrojs/check upgrade is not acceptable, consider adding an npm audit overrides/resolutions entry in docs-site/package.json for the lodash chain.
Failing Step
- Job: Audit Docs Site Package
- Step: "Run npm audit (fail on high/critical)" — exit code 1
- Note: The "Audit Main Package" job passed ✅ — only docs-site is affected
Generated by CI Doctor
Summary
The "Audit Docs Site Package" job in the Dependency Vulnerability Audit workflow fails because
npm auditfound a high-severity vulnerability in thedocs-site/package dependencies.Triggered by commit:
b508e3f(feat(proxy): make copilot api target configurable for enterprise envi…)Vulnerabilities Found
🔴 High Severity
rollupnpm audit fix🟡 Moderate Severity (15 total)
lodash4.0.0–4.17.21@astrojs/check→@astrojs/language-server→volar-service-yaml→yaml-language-servernpm audit fix --force(breaking: upgrades@astrojs/checkto 0.9.2)lodash-es4.0.0–4.17.22mermaid→@mermaid-js/parser→langium→chevrotainnpm audit fixTotal: 15 vulnerabilities (1 low, 13 moderate, 1 high)
Root Cause
The
rolluphigh-severity vulnerability (GHSA-mw96-cpmx-2vgc) was published after the currentdocs-site/package-lock.jsonwas last updated. The CI audit step uses--audit-level=high, so this is correctly catching the issue.Recommended Actions
Immediate fix — run
npm audit fixindocs-site/to patchrollupandlodash-es(non-breaking):cd docs-site npm audit fixFor lodash via
@astrojs/check— evaluate whether upgrading@astrojs/checkto 0.9.2 is acceptable:If
@astrojs/checkupgrade is not acceptable, consider adding annpm auditoverrides/resolutions entry indocs-site/package.jsonfor the lodash chain.Failing Step