chore(docs): bump Blume to 1.4.2 - #54
Conversation
Pin Blume 1.4.2, refresh bun audit overrides from the hub canary (drop brace-expansion/fast-uri/ip-address; add nanoid/js-yaml), and ignore unfixed image-size highs in CI until a patched release exists.
SutuSebastian
added
the
docs
|
📝 WalkthroughWalkthroughThe PR updates the ChangesDependency and audit maintenance
Estimated code review effort: 2 (Simple) | ~10 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/ci.yml:
- Around line 262-266: Update the audit step around bun audit so the GHSA
exceptions are not globally suppressing advisories without validation. Run an
unignored audit and verify that each ignored advisory is reported only through
the Blume image-size dependency path, failing or documenting the exception when
it appears elsewhere; preserve the existing ANSI-stripping and audit-log
handling.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 4ac7b1ab-25e9-41c5-b76e-d8376c8241e6
⛔ Files ignored due to path filters (1)
bun.lockis excluded by!**/*.lock
📒 Files selected for processing (3)
.github/workflows/ci.ymlapps/docs/package.jsonpackage.json
| # Ignore unfixed image-size highs from Blume (no patched release yet). | ||
| run: | | ||
| set +e | ||
| # bun emits ANSI color even when piped — strip it or the severity grep misses it. | ||
| NO_COLOR=1 bun audit 2>&1 | sed -E 's/\x1b\[[0-9;]*m//g' > /tmp/bun-audit.log | ||
| NO_COLOR=1 bun audit --ignore=GHSA-w3rx-r6r6-pgpr --ignore=GHSA-5p2g-fcmc-qvqq 2>&1 | sed -E 's/\x1b\[[0-9;]*m//g' > /tmp/bun-audit.log |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
log="$(mktemp)"
trap 'rm -f "$log"' EXIT
set +e
NO_COLOR=1 bun audit 2>&1 | sed -E 's/\x1b\[[0-9;]*m//g' > "$log"
audit_status="${PIPESTATUS[0]}"
set -e
cat "$log"
printf '\nAudit exit status: %s\n' "$audit_status"
grep -n -C 12 -E 'GHSA-w3rx-r6r6-pgpr|GHSA-5p2g-fcmc-qvqq|image-size' "$log" || trueRepository: stainless-code/layers
Length of output: 220
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== files =="
git ls-files | rg '(^package\.json$|^bun\.lock$|^bun\.lockb$|\.github/workflows/ci\.yml$)' || true
echo
echo "== package.json deps/packageManager =="
python3 - <<'PY'
import json
p=json.load(open('package.json'))
for k in ['name','private','packageManager','dependencies','devDependencies','peerDependencies','optionalDependencies']:
print(f'{k}:', p.get(k))
PY
echo
echo "== lockfile entries for image-size / blume / advisories =="
for f in bun.lock bun.lockb; do
if [ -f "$f" ]; then
echo "--- $f size ---"
wc -l "$f"
echo "--- grep ---"
rg -n -C 3 'image-size|blume|GHSA-w3rx-r6r6-pgpr|GHSA-5p2g-fcmc-qvqq|GHSA-w3rx-r6r6-pgpr|GHSA-5p2g-fcmc-qvqq' "$f" || true
fi
done
echo
echo "== ci workflow relevant lines =="
sed -n '240,285p' .github/workflows/ci.ymlRepository: stainless-code/layers
Length of output: 9255
🌐 Web query:
Bun audit --ignore advisory ID semantics bun.lock image-size GHSA
💡 Result:
To ignore a specific vulnerability in Bun, you use the --ignore flag followed by the advisory identifier [1][2]. Contrary to some older documentation that may specify "CVEs," the --ignore flag accepts both CVE IDs and GHSA (GitHub Security Advisory) IDs, as well as substrings of the advisory URL [2]. You can use the flag multiple times to ignore several vulnerabilities in a single command [1][2]. Example usage: bun audit --ignore GHSA-xxxx-xxxx-xxxx --ignore CVE-YYYY-NNNN The --ignore flag works by filtering out the specified advisories from the audit report [2]. This filtering also applies when using the --json output format [2]. Ensure that the ID you provide matches the identifier reported by the bun audit command [1][2].
Citations:
- 1: https://bun.sh/docs/pm/cli/audit
- 2: audit: apply --audit-level and --ignore filters to --json output oven-sh/bun#31013
🌐 Web query:
"bun audit" "--ignore" advisory only specified package
💡 Result:
The bun audit command does not currently support ignoring vulnerabilities by specifying only the package name [1][2]. The --ignore flag is designed to suppress specific security advisories by referencing their vulnerability identifiers, such as CVE IDs or GHSA IDs [1][3][4]. You can use the flag multiple times to ignore multiple vulnerabilities: bun audit --ignore CVE-2022-25883 --ignore GHSA-xxxx-xxxx-xxxx According to official Bun documentation and source code, there is no built-in functionality to globally ignore all vulnerabilities for a specific package name [1][5]. Filtering is applied based on severity (using --audit-level) or by explicitly listing the specific vulnerability identifiers you wish to suppress [1][6].
Citations:
- 1: https://bun.com/docs/pm/cli/audit
- 2: https://docs.w3cub.com/bun/pm/cli/audit
- 3: audit: apply --audit-level and --ignore filters to --json output oven-sh/bun#31013
- 4: https://oven-sh-bun.mintlify.app/pm/audit
- 5: https://github.com/oven-sh/bun/blob/88417471/src/install/PackageManager/CommandLineArguments.rs
- 6: docs: add missing v1.2.21 features to documentation oven-sh/bun#23085
🌐 Web query:
Bun audit source ignore advisory filtering packageName
💡 Result:
The bun audit command in Bun supports filtering vulnerabilities, but it does not provide a mechanism to ignore advisories specifically by packageName. The available options for filtering and ignoring are as follows: --ignore: This flag allows you to ignore specific security advisories by their ID (e.g., CVE IDs or GHSA IDs) [1][2][3]. You can repeat this flag to ignore multiple advisories (e.g., bun audit --ignore CVE-2022-25883 --ignore CVE-2023-26136) [1][4]. Documentation notes that this matches against the advisory ID or a substring of the advisory URL, rather than being limited only to CVEs [5]. --audit-level: This flag allows you to filter the audit report to only show vulnerabilities at or above a specific severity level (low, moderate, high, or critical) [1][3][4]. --prod: This flag restricts the audit to production dependencies, excluding devDependencies [1][2][3]. There is currently no native flag to ignore all vulnerabilities associated with a specific package name. If you need to filter out vulnerabilities from a specific package, you must target the individual advisories associated with that package using the --ignore flag.
Citations:
- 1: https://bun.sh/docs/pm/cli/audit
- 2: https://bun.com/docs/pm/cli/audit
- 3: https://oven-sh-bun.mintlify.app/pm/audit
- 4: https://docs.w3cub.com/bun/pm/cli/audit
- 5: audit: apply --audit-level and --ignore filters to --json output oven-sh/bun#31013
Scope the audit exceptions to image-size.
bun audit --ignore suppresses advisories by ID across the whole dependency graph, and Bun has no package-scoped ignore option. If either GHSA-w3rx-r6r6-pgpr or GHSA-5p2g-fcmc-qvqq later affects a different dependency, this step will hide its high/critical result. Run an unignored audit to ensure the current reports only come through the Blume image-size path, or document/package-validate the scope before relying on the exception.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/ci.yml around lines 262 - 266, Update the audit step
around bun audit so the GHSA exceptions are not globally suppressing advisories
without validation. Run an unignored audit and verify that each ignored advisory
is reported only through the Blume image-size dependency path, failing or
documenting the exception when it appears elsewhere; preserve the existing
ANSI-stripping and audit-log handling.
1 participant
Summary
blume1.3.1 → 1.4.2 inapps/docs.path-to-regexp/yuku-parser; addnanoid+js-yamlfor remaining highs.bun auditignores Blume's unpatchedimage-sizeGHSAs until a release ships.Test plan
bun run validate/check/build/auditinapps/docs(0 errors)bun audit --ignore=…— no high/critical