fix(ci): clear the 2 HIGH browserslist advisories blocking the image build #26

2026-09-02T10:00:27Z

sharang commented

2026-09-02 10:00:27 +00:00

Unblocks the deploy of #25. The shared job's trivy fs scan started failing on CVE-2026-73088 and CVE-2026-73089 (browserslist 4.28.2 — prototype pollution + unbounded DoS, both fixed in 4.28.7). image is gated on shared, so no image was built and the entitlement fix could not reach the running portal.

Not introduced by a code change. shared passed on the previous commit (ac28e22) with the same dependency tree; trivy refreshes its vulnerability DB each run, so these advisories were published in between.

Cleared with a pnpm override — the pattern already used in this repo for nanoid, postcss, @auth/core and sharp. browserslist is transitive (not a declared dependency), so an override is the only lever. Lockfile now resolves 4.28.8.

Verified: tsc --noEmit 0 · next build 0.

**Unblocks the deploy of #25.** The `shared` job's trivy fs scan started failing on `CVE-2026-73088` and `CVE-2026-73089` (browserslist 4.28.2 — prototype pollution + unbounded DoS, both fixed in 4.28.7). `image` is gated on `shared`, so no image was built and the entitlement fix could not reach the running portal. **Not introduced by a code change.** `shared` passed on the previous commit (`ac28e22`) with the same dependency tree; trivy refreshes its vulnerability DB each run, so these advisories were published in between. Cleared with a **pnpm override** — the pattern already used in this repo for `nanoid`, `postcss`, `@auth/core` and `sharp`. `browserslist` is transitive (not a declared dependency), so an override is the only lever. Lockfile now resolves **4.28.8**. Verified: `tsc --noEmit` 0 · `next build` 0.

sharang added 1 commit 2026-09-02 10:00:28 +00:00

fix(ci): clear the 2 HIGH browserslist advisories blocking the image build

ci / e2e (pull_request) Blocked by required conditions

Details

ci / shared (pull_request) Successful in 12s

Details

ci / test (pull_request) Successful in 10m20s

Details

ci / image (pull_request) Skipped

Details

778b587640

The `shared` job's trivy fs scan started failing on CVE-2026-73088 and
CVE-2026-73089 (browserslist 4.28.2, prototype pollution + unbounded DoS,
both fixed in 4.28.7). Because `image` is gated on `shared`, no image was
built and the portal entitlement fix could not deploy.

Not introduced by any code change: `shared` passed on the previous commit
(ac28e22) with the same dependency tree. Trivy refreshes its vulnerability DB
each run, so these advisories were published in between.

Cleared with a pnpm override, the same pattern already used here for nanoid,
postcss, @auth/core and sharp. browserslist is transitive (not a declared
dependency), so an override is the only lever. Lockfile now resolves 4.28.8.

Verified: tsc --noEmit 0, next build 0.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CNdLL9BdsWm7MCyui5ffPD

sharang merged commit 7bcb1dfc38 into main

2026-09-02 10:00:37 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: platform/portal#26