Daily security sweep — backlog

[benfrank241]

Rolling backlog for the daily security sweep on this repo: advisories that were found but deliberately not bundled, plus structural things that stop the sweep from verifying honestly. Appended to on each run.

---

2026-09-04

Not bundled — out of scope (no Dependabot alert)

yaml@2.7.0 — GHSA-48c2-rrv3-qjmp, moderate (CVSS 4.3, CWE-674), stack overflow via deeply nested YAML collections. Vulnerable range >=2.0.0 <2.8.3; fixed in 2.8.3.

• Location: root package-lock.json, dev-only, transitive via typedoc@0.27.8.
• Not flagged by Dependabot (no alert number), so it fell outside this run's scope of "open alerts". Surfaced by npm audit while verifying the toml bundle.
• Clean fix available: typedoc declares yaml: ^2.6.1, which accepts 2.8.3, and it is the only requester. A plain global override is correct here — no scoping needed:

  "overrides": { "yaml": "^2.8.3" }

  (Use the caret form, not >=2.8.3, so the override cannot jump the major.)
• Left for a maintainer or a future sweep rather than mixed into PR fix(security): bump toml 3.0.0 → 4.3.0 (root lockfile) — closes 4 Dependabot alerts #40, which is scoped to the four toml alerts.

Structural: Dependabot PRs on this repo can never go green

Every Dependabot PR in the last several months is red on all checks, and none of the failures are dependency-related:

• Tests (TS) — Error: VECTORIZE_API_KEY must be set (tests/testContext.ts:11). ci.yml reads secrets.VECTORIZE_TOKEN / secrets.VECTORIZE_ORG, which are not exposed to dependabot/* branches.
• Tests (Python) — same root cause in tests/python.
• Secret Detection — gitleaks-action@v2 fails without secrets.GITLEAKS_LICENSE, likewise unavailable.

Confirmed across dependabot/npm_and_yarn/toml-4.2.0 (#39), …/brace-expansion-2.1.4, …/tests/ts/postcss-8.5.25, …/linkify-it-5.0.2, …/pip/tests/python/pytest-9.0.3. On push to main the same GitLeaks job succeeds, which isolates the cause to the missing secret rather than a real finding.

Consequences worth a maintainer decision:

1. Dependabot security PRs carry no signal — they cannot be merged on a green check, so they accumulate. This is why the sweep recreates them on chore/security-daily-* branches (which do get secrets).
2. Consider populating Dependabot secrets (Settings → Secrets and variables → Dependabot) with VECTORIZE_TOKEN, VECTORIZE_ORG, GITLEAKS_LICENSE so Dependabot's own PRs become self-verifying, or gate the integration tests to skip cleanly when the key is absent.

Structural: Tests (TS) / Tests (Python) are live integration suites

Both jobs hit the real Vectorize API (VECTORIZE_ENV: dev). They are not runnable locally without credentials, and they exercise src/ts / src/python — neither touches the root package.json. A root-lockfile bundle therefore gets no meaningful coverage from CI, and verification has to be derived from the actual consumers (see PR #40's verification section). Not a defect, just a limitation to remember on future root-lockfile sweeps.

Also noted

• Two workflows are both named CI (ci.yml and docs.yml). gh run list output is ambiguous as a result — the CI failures on push/main are docs.yml (GitHub Pages doc generation), not the test workflow, which only triggers on pull_request. Renaming one would make triage easier.
• Label security did not exist and was created by this run. dependencies already existed.

[benfrank241]

Update — Tests (Python) on PR #40 resolved (fail, 3h33m)

It was not a hang. The job ran to completion and failed with 4 failures, and the cause is an account/plan problem, not a code problem:

Three tests got HTTP 402 Payment Required from api-dev.vectorize.io:

{"success":false,"error":"Upgrade Required",
 "message":"API access is available on paid plans only. Please upgrade to use this endpoint.",
 "code":"UPGRADE_REQUIRED"}

• tests/test_client.py::test_get_pipelines — 402
• tests/test_client.py::test_delete_system_connectors — 402
• tests/test_client.py::test_upload_create_pipeline — 402
• tests/test_client.py::test_extraction — polled GET /v1/org/***/extraction/f136ad02… for 3h31m returning 200 ready=False, then a terminal 502 Bad Gateway

The 3.5-hour runtime is the extraction test's ready-poll having no timeout and no failure ceiling — it will burn a full runner slot on every future run whenever the dev API stops advancing a job. That is worth capping independently of the plan issue.

This is very likely org-wide, not specific to this repo. The 2026-09-02 sweep of integrations-python recorded the identical signature — the Vectorize API returning 402 to CI — on PRs #10 and #11 there. Same error, different repo, two days apart. Whatever credential or org plan CI authenticates with appears to have lost paid API access.

What this means for PR #40

Nothing changes. The failures are provably outside the bundle's reach:

• git diff main..branch -- src/python tests/python is empty
• tests/python depends on path = "../../src/python", never the root manifest
• the job's Build step (poetry install && poetry build) passed — the only packaging-adjacent part
• Secret Detection passes

PR #40 stays open.

Added to this backlog

1. CI has lost paid Vectorize API access (402 UPGRADE_REQUIRED) — check whether the org plan or the CI credential changed. Cross-check integrations-python, which showed the same 402 on 2026-09-02.
2. test_extraction has an unbounded ready-poll — cap it so a stalled dev-API job fails in minutes rather than occupying a runner for 3.5 hours.

[benfrank241]

2026-09-05 sweep — no new bundle; correction to the 2026-09-04 yaml entry

Today's run found no un-covered open alerts. All four open alerts (#46–#49, the two toml advisories) are already carried by open PR #40, so nothing was re-bundled.

Correction: yaml was not "unflagged by Dependabot" — it was auto-dismissed

The 2026-09-04 entry above says yaml@2.7.0 was "not flagged by Dependabot (no alert number)". That is wrong, and the same mistake was about to be repeated for a second package today. Both actually have alerts, in state auto_dismissed:

Alert	Package	Path	Advisory	Severity	Scope	Auto-dismissed
#22	yaml	package-lock.json	GHSA-48c2-rrv3-qjmp	medium	development	2026-03-26
#44	nanoid	tests/ts/package-lock.json	GHSA-2v37-7h3g-55p8	high	development	2026-08-16

For both, created_at is byte-identical to auto_dismissed_at, and dismissed_by / dismissed_reason are null — the signature of a Dependabot auto-triage rule firing the instant the alert opened, not a human decision and not a missed alert. Both are scope: development, so the rule in force appears to dismiss dev-scope advisories.

Consequences for this sweep, worth recording:

1. gh api .../dependabot/alerts?state=open will never show these, but npm audit will. The two tools disagreeing is expected here, not a bug in either.
2. state=all is not a valid value for that endpoint (valid: open, dismissed, auto_dismissed, fixed). It returns an empty list rather than erroring, which silently looks like "this repo has no alert history". Query the states individually.
3. Auto-dismissed alerts are a policy decision, so the sweep will not bundle them or re-dismiss them. Recording them here for visibility only.

nanoid — available if a maintainer wants it (not bundled)

nanoid@3.3.16 in tests/ts/package-lock.json, high (CVSS 7.5, uncontrolled loop when size is 0), vulnerable < 3.3.18, fixed in 3.3.18. Dev-only, sole requester is postcss (via vitest → vite), which declares nanoid: ^3.3.16 — that accepts 3.3.18, so this is a plain in-range transitive fix needing no overrides:

npm update nanoid --package-lock-only    # in tests/ts/

Not opened as a PR for two reasons: the alert is auto-dismissed by policy (above), and tests/ts cannot be verified locally — its only script is vitest run, which is the live integration suite against api-dev.vectorize.io and needs VECTORIZE_TOKEN / VECTORIZE_ORG. Per the sweep's own rule, no green verify means no push.

Still-open structural items from 2026-09-04

Unchanged and still reproducing today:

• PR fix(security): bump toml 3.0.0 → 4.3.0 (root lockfile) — closes 4 Dependabot alerts #40 is red on Tests (Python) and Tests (TS), both for the environmental reasons already documented in this issue (HTTP 402 UPGRADE_REQUIRED from the dev API on the paid-plan endpoints; pre-existing TS drift/timeout). Secret Detection passes. mergeStateStatus is BLOCKED. Nothing in that is caused by the toml bump — it remains the maintainer's call to merge.
• Dependabot secrets are still unpopulated; Dependabot's own PRs still cannot go green.
• ci.yml and docs.yml are still both named CI.

Also noted

• There is no .github/dependabot.yml in this repo — version updates are not configured; the alerts come from the default security-update path only. Ecosystem coverage is therefore incidental. Nine manifests exist (root, src/ts [no lockfile], src/examples/node, tests/ts, src/python, tests/python); src/examples/node audits clean.