LotusGuild/cinny
3
0
Fork 0
Code Issues 27 Pull Requests 5 Actions Packages Projects Releases Wiki Activity

CI is red for every PR: npm audit fails on a new high advisory in source-map-js 1.2.1 (via sanitize-html → postcss); 1.2.2 fixes it #345

New Issue
Closed
opened 2026-10-10 22:20:35 -04:00 by jared · 0 comments
jared commented 2026-10-10 22:20:35 -04:00
Owner
Copy Link
Copy Source

The Build & Quality Checks job runs npm audit --audit-level=high --omit=dev. Since a new advisory was published after lotus last went green (30e2dbcd, 3 Oct), that step fails on every branch. First seen on PR #344 (run 2417, job 6079). Build, ESLint, unit tests and boot-check all passed in that run; only the audit step failed, which then skips the e2e, Docker and desktop jobs.

source-map-js  1.0.0 - 1.2.1
Severity: high
source-map-js allows event-loop denial of service through indexed source-map section offsets - GHSA-68fv-2mgg-jv7q
fix available via `npm audit fix`

It's a runtime dependency: sanitize-html@2.17.7 → postcss@8.5.28 → source-map-js@1.2.1. npm audit fix --dry-run changes exactly one package, source-map-js 1.2.1 → 1.2.2, within the declared range. The lockfile-only bump is the same shape as #257 (brace-expansion).

Lower-severity items in the same report (they don't fail CI at --audit-level=high):

  • i18next-http-backend <4.0.2: GHSA-xvq9-wjp8-hwqf (low; relevant only if loadPath is built from untrusted input; the fix is a major bump);
  • katex 0.11.0–0.18.1: GHSA-238p-pmpm-9mq7 (low; needs katex 0.19, breaking).

Fix: npm audit fix (lockfile: source-map-js 1.2.2), then re-run CI on the open PRs.

Found in the October 2026 client audit (Playwright against a local Synapse + LiveKit stack, plus code reading). Code refs are at cinny 30e2dbcd, cinny-desktop 8f67ec7, element-call 3b0050e8.

The **Build & Quality Checks** job runs `npm audit --audit-level=high --omit=dev`. Since a new advisory was published after `lotus` last went green (30e2dbcd, 3 Oct), that step fails on every branch. First seen on PR #344 (run 2417, job 6079). Build, ESLint, unit tests and boot-check all passed in that run; only the audit step failed, which then skips the e2e, Docker and desktop jobs. ``` source-map-js 1.0.0 - 1.2.1 Severity: high source-map-js allows event-loop denial of service through indexed source-map section offsets - GHSA-68fv-2mgg-jv7q fix available via `npm audit fix` ``` It's a runtime dependency: `sanitize-html@2.17.7 → postcss@8.5.28 → source-map-js@1.2.1`. `npm audit fix --dry-run` changes exactly one package, **source-map-js 1.2.1 → 1.2.2**, within the declared range. The lockfile-only bump is the same shape as #257 (brace-expansion). Lower-severity items in the same report (they don't fail CI at `--audit-level=high`): - `i18next-http-backend <4.0.2`: GHSA-xvq9-wjp8-hwqf (low; relevant only if `loadPath` is built from untrusted input; the fix is a major bump); - `katex 0.11.0–0.18.1`: GHSA-238p-pmpm-9mq7 (low; needs katex 0.19, breaking). **Fix:** `npm audit fix` (lockfile: source-map-js 1.2.2), then re-run CI on the open PRs. --- _Found in the October 2026 client audit (Playwright against a local Synapse + LiveKit stack, plus code reading). Code refs are at cinny `30e2dbcd`, cinny-desktop `8f67ec7`, element-call `3b0050e8`._
jared added the priority: highdependenciesarea: build-ci labels 2026-10-10 22:20:35 -04:00
jared closed this issue 2026-10-11 00:53:12 -04:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
a11y
Accessibility: keyboard, screen reader, contrast, motion
 area: appearance
Client area: appearance
 area: auth-session
Client area: auth-session
 area: build-ci
Client area: build-ci
 area: calls
Client area: calls
 area: desktop
Client area: desktop
 area: media
Client area: media
 area: messaging
Client area: messaging
 area: mobile
Client area: mobile
 area: moderation
Client area: moderation
 area: navigation
Client area: navigation
 area: notifications
Client area: notifications
 area: settings
Client area: settings
 area: threads
Client area: threads
 bug
Something is not working
 dependencies
Third-party package versions and advisories
 docs
README / LOTUS_* docs wrong or missing
 duplicate
This issue or pull request already exists
 enhancement
New feature
 help wanted
Need some help
 invalid
Something is wrong
 needs-human-review
performance
Re-render storms, leaks, heavy work on hot paths
 planning
priority: critical
Data loss, security hole, or crash on a main path
 priority: high
Broken feature or serious usability problem
 priority: low
Minor issue or polish
 priority: medium
Wrong behaviour in an edge case or notable degradation
 qa
Manual QA: shipped, needs a human in a real environment
 question
More information is needed
 research
security
XSS, unsafe URLs, data leaks, auth/session
 tech-debt
Code health, dead code, fragile patterns
 ux
Usability or visual inconsistency
 wontfix
This won't be fixed
No labels area: build-ci dependencies priority: high
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
cole (Cole Keller) jared (Jared Vititoe) nathan (Nathan Vititoe)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: LotusGuild/cinny#345