Repository navigation
Accept bundled undici CVE temporarily and install npm 12 in development images - #264
Merged
Merged
Conversation
npm 11.21.1 and 12.2.1 both bundle undici 6.29.0 through node-gyp, which is affected by CVE-2026-109869 (fixed in undici 6.29.1). No npm release ships the fix yet, so development image scans fail on master. Scope a temporary exception to that exact package path and version, tracked in #250 with the existing review date. Drop the undici 6.28.0 and brace-expansion 5.0.9 entries, which no longer match the bundled versions.
npm 12.2.1 bundles the same dependency versions as npm 11.21.1, so the reason for staying on npm 11 no longer applies. Pin the major instead of npm@latest so a future npm major is not picked up by a rebuild without review.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Since 2026-10-25 the nightly master rebuild has failed for every development image. The regular images still build, but nothing is pushed because the whole run fails. Example: run 40258225811.
Cause
The security scan found a new high-severity issue in a networking library that npm ships inside its own package. Only development images include npm. A fixed version of the library exists, but no npm release includes it yet, on either the npm 11 or the npm 12 line. Separately, the images were kept on npm 11 because npm 12 used to ship more outdated libraries. That is no longer true: the current npm 11 and npm 12 releases ship the same versions.
Solution
Accept this one issue temporarily, only for the copy of the library that comes with npm, and review it by the existing date or once npm ships the fix. Remove two older temporary acceptances that no longer match anything. Move development images to npm 12, pinned to that major version so a future npm major is not picked up by a rebuild without review. Every other scan rule stays as it is, and the full scan report stays unfiltered.
Details
.github/actions/grype/exceptions.yaml: ignore CVE-2026-109869 forundici6.29.0at/usr/lib/node_modules/npm/node_modules/undici/package.jsononly (bundled throughnode-gyp; fixed in undici 6.29.1; upstream Bundled undici@6.29.0 is vulnerable to CVE-2026-109383 (fixed in 6.29.1) npm/cli#10163). Removed theundici 6.28.0(CVE-2026-19534) andbrace-expansion 5.0.9entries; npm 11.21.1 and 12.2.1 bundle undici 6.29.0 and brace-expansion 5.0.12. Removal is still tracked in Remove temporary npm bundled-dependency CVE exceptions after upstream fixes #250.8/Dockerfile:npm@11→npm@12.Validation
/usr/lib/node_modules/npmin an image: identical findings (undici High + Medium, ip-address Medium).--only-fixed, high cutoff,GRYPE_SHOW_SUPPRESSED) with the new exceptions file: passes, and the undici High is shown as suppressed.^22.22.2 || ^24.15.0 || >=26.0.0), corepack enables yarn 4.18.1.