chore(docs): bump Blume to 1.4.2 - #48
Conversation
Pin Blume 1.4.2, refresh bun audit overrides from the hub canary (drop brace-expansion/fast-uri/ip-address/postcss; add nanoid/js-yaml), and ignore unfixed image-size highs in CI until a patched release exists.
SutuSebastian
added
the
docs
|
📝 WalkthroughWalkthroughThe pull request updates the ChangesDependency and audit maintenance
Estimated code review effort: 2 (Simple) | ~10 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/ci.yml:
- Around line 241-245: The Bun audit step currently searches for unsupported
severity-prefix output, so high or critical findings may bypass the CI gate.
Update the audit logic in the workflow step to use Bun’s documented
--audit-level=high behavior or parse --json findings, while preserving the
existing ignored advisories and ensuring high-severity vulnerabilities cause the
CI check to fail.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: c5b0259a-2d1a-48e0-a71f-6c8ce000b074
⛔ Files ignored due to path filters (1)
bun.lockis excluded by!**/*.lock
📒 Files selected for processing (3)
.github/workflows/ci.ymlapps/docs/package.jsonpackage.json
| # Ignore unfixed image-size highs from Blume (no patched release yet). | ||
| run: | | ||
| set +e | ||
| # bun emits ANSI color even when piped — strip it or the severity grep misses it. | ||
| NO_COLOR=1 bun audit 2>&1 | sed -E 's/\x1b\[[0-9;]*m//g' > /tmp/bun-audit.log | ||
| NO_COLOR=1 bun audit --ignore=GHSA-w3rx-r6r6-pgpr --ignore=GHSA-5p2g-fcmc-qvqq 2>&1 | sed -E 's/\x1b\[[0-9;]*m//g' > /tmp/bun-audit.log |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
summary='3 vulnerabilities (1 high, 2 moderate)'
pattern='(^|[[:space:]])(high|critical):[[:space:]]'
if printf '%s\n' "$summary" | grep -Eq "$pattern"; then
echo "The current detector matched unexpectedly"
exit 1
fi
echo "Confirmed: the current detector misses Bun's documented high-severity summary"Repository: stainless-code/persist
Length of output: 1959
🌐 Web query:
Bun audit high critical vulnerabilities summary format
💡 Result:
The bun audit command provides a security scan of dependencies defined in bun.lock by checking them against the npm security advisory database [1][2][3]. Formatted Summary Format When vulnerabilities are detected, Bun displays a list of affected packages, each including the severity, a short description, and a link to the advisory [1][4]. At the end of the report, it provides a cumulative summary of the vulnerabilities found [1][5]. The summary format follows this pattern [5]: {total_count} vulnerabilities ({count} critical, {count} high, {count} moderate, {count} low) Example output: 3 vulnerabilities (1 high, 2 moderate) Following the summary, the report provides standard advice for remediation: - To update all dependencies to the latest compatible versions: bun update - To update all dependencies to the latest versions (including breaking changes): bun update --latest [1][5] Filtering You can filter the output by severity using the --audit-level flag [1][2]. For example, to view only high and critical vulnerabilities, you can run: bun audit --audit-level=high Supported levels from lowest to highest are low, moderate, high, and critical [2]. JSON Output Using the --json flag provides the raw security report as a JSON object [2][4]. Recent updates ensure that the --json flag correctly respects --audit-level and --ignore filters, returning a filtered JSON response that reflects only the relevant vulnerabilities [6][7]. Bun exits with code 0 if no vulnerabilities are found, and 1 if any vulnerabilities are reported (regardless of whether --json is used) [2][4].
Citations:
- 1: https://bun.com/docs/pm/cli/audit
- 2: https://oven-sh-bun.mintlify.app/pm/audit
- 3: https://bun.com/blog/release-notes/bun-v1.2.15
- 4: https://docs.w3cub.com/bun/pm/cli/audit
- 5: https://github.com/oven-sh/bun/blob/7abe6c38/src/cli/audit_command.zig
- 6: audit: apply --audit-level and --ignore filters to --json output oven-sh/bun#31013
- 7: --json flag overrides --audit-level in bun audit oven-sh/bun#31009
🌐 Web query:
site:github.com/oven-sh/bun src/cli/audit_command.zig vulnerabilities summary
💡 Result:
The file src/cli/audit_command.zig is a source code component of the Bun runtime, specifically responsible for the implementation of the bun audit command [1][2][3]. This command is used to check installed project dependencies for known security vulnerabilities [4]. Key aspects of this module include: Functionality: It interacts with the project's lockfile, builds a dependency tree, and collects packages to audit [2][5]. It then communicates with a package registry or security service to identify vulnerabilities [1][2]. Exit Codes: By design, the audit command returns 0 if no vulnerabilities are found and 1 if vulnerabilities are detected [1][2]. When the --json flag is used, it typically returns 0 as it is treated as a successful request for audit information regardless of the presence of vulnerabilities [1][2]. Development: The module has been subject to ongoing development, including efforts to implement automated vulnerability remediation through features like bun audit --fix [6]. It is important to note that src/cli/audit_command.zig itself is not a vulnerability; rather, it is the programmatic implementation of the security scanning tool within the Bun CLI [1][2]. Users should rely on standard security practices and the official Bun documentation for managing project dependencies and responding to security advisories [4][7].
Citations:
- 1: https://github.com/oven-sh/bun/blob/7e57e529/src/cli/audit_command.zig
- 2: https://github.com/oven-sh/bun/blob/7abe6c38/src/cli/audit_command.zig
- 3: https://github.com/oven-sh/bun/tree/main/src/cli
- 4: https://github.com/oven-sh/bun/blob/7e57e529/src/cli.zig
- 5: https://github.com/oven-sh/bun/blob/1498d7b7/src/runtime/cli/audit_command.rs
- 6: Implement bun audit --fix command oven-sh/bun#20301
- 7: https://github.com/oven-sh/bun/blob/7abe6c38/src/install/PackageManager/security_scanner.zig
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
if [ ! -d .git ]; then
echo "Repository is not available in the sandbox"
exit 0
fi
printf '\n--- candidate workflow lines ---\n'
if [ -f .github/workflows/ci.yml ]; then
sed -n '220,260p' .github/workflows/ci.yml | nl -ba -v220
else
fd -a 'ci.yml|workflows' .github 2>/dev/null || true
fi
printf '\n--- relevant detector pattern matches ---\n'
rg -n 'high|critical|bun audit|grep -E' .github/workflows/ci.yml || true
printf '\n--- static detector behavior probe ---\n'
python3 - <<'PY'
import re
lines = [
'3 vulnerabilities (1 high, 2 moderate)',
'3 vulnerabilities (1 critical, 2 moderate)',
'1 high: some advisory',
'1 critical: some advisory',
]
pat = re.compile(r'(^|[ \t])high:|[ \t]critical:|[ \t]high:\s|critical:')
for line in lines:
print(f"{'PASS' if bool(pat.search(line)) else 'FAIL'}: {line!r}")
PYRepository: stainless-code/persist
Length of output: 1930
Use a Bun audit output format that actually reports high/critical vulnerabilities.
bun audit documents summary lines such as 3 vulnerabilities (1 high, 2 moderate) and JSON output, but not severity-prefix output like high: or critical:. Run bun audit --audit-level=high or parse bun audit --json so high-severity findings cannot pass the CI gate.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/ci.yml around lines 241 - 245, The Bun audit step
currently searches for unsupported severity-prefix output, so high or critical
findings may bypass the CI gate. Update the audit logic in the workflow step to
use Bun’s documented --audit-level=high behavior or parse --json findings, while
preserving the existing ignored advisories and ensuring high-severity
vulnerabilities cause the CI check to fail.
Source: MCP tools
1 participant
Summary
blume1.3.1 → 1.4.2 inapps/docs.postcss); keep product pins +path-to-regexp; addnanoid+js-yamlfor remaining highs.bun auditignores Blume's unpatchedimage-sizeGHSAs until a release ships.Test plan
bun run validate/check/build/auditinapps/docs(0 errors)bun audit --ignore=…— no high/critical