Backlog from the daily security sweep. Items here could not be completed or verified automatically and need a human.
2026-08-26 — CI cannot produce a signal on this repo (startup_failure)
Not a dependency problem — an Actions problem. Filed because it blocks verification, not because a bump broke.
This is not caused by PR #29
main...chore/security-daily-20260826-vectorize-connect-sdk-npm-root changes exactly two files:
package-lock.json, package.json
.github/ is untouched, so the workflow definition on the branch is byte-identical to main.
Context
Every previous run in this repo succeeded, but the last one was 2026-05-13 — over three months before this failure. Something in the environment changed in between. startup_failure with no logs and no annotations usually means the run was rejected before a runner was assigned. Most likely candidates:
- An org/repo Actions policy change now disallowing the third-party action
gitleaks/gitleaks-action@v2 (allow-list restriction).
- Actions billing/entitlement state for the org.
- A missing or expired
GITLEAKS_LICENSE / org secret policy change.
(1) fits best, but this could not be confirmed from the sweep: GET /repos/.../actions/permissions, .../actions/permissions/selected-actions, and GET /orgs/vectorize-io/actions/permissions all return 403 for the sweep's token. An org admin needs to check Settings → Actions → General → Allowed actions.
Why it matters beyond this PR
The whole premise of this sweep is that a human-authored branch gets CI that Dependabot's own branches do not. On this repo no branch currently gets a usable CI signal at all, so that premise does not hold here until the above is fixed.
Verification status of PR #29
The dependency bundle itself was verified locally and green, so the PR is left open for review rather than closed:
- Verify set derived from
package.json scripts — this repo has build/clean/dev/prepublishOnly and no test or lint script.
npm ci — clean, 0 vulnerabilitiesnpm run build (tsup: CJS + ESM + d.ts) — successdist/ built from unmodified main and from the branch is byte-identical across index.d.ts, index.js, index.mjs, so the published API surface is unchanged.
No dependency was backlogged. All 16 open alerts are addressed in PR #29.
Also worth a human decision (from PR #29, repeated here so it is not lost)
peerDependencies is ^14.2.25 || ^15.5.18 and was deliberately left alone. That range still admits next@14.x, and GHSA-p9j2-gv94-2wf4 (alert #42, high) has no fix on the 14.x line — it is patched only in 15.5.21. Consumers installing this SDK against next 14 therefore stay exposed no matter what PR #29 does. Narrowing to ^15.5.21 closes it but drops next 14 support, which is a breaking change to this SDK's public contract — a maintainer call, out of scope for the sweep.
Backlog from the daily security sweep. Items here could not be completed or verified automatically and need a human.
2026-08-26 — CI cannot produce a signal on this repo (
startup_failure)Not a dependency problem — an Actions problem. Filed because it blocks verification, not because a bump broke.
vectorize-io/vectorize-connect-sdkGitLeaks Security Scan(.github/workflows/secret-scan.yml), jobSecret Detectionstartup_failure— the job never started; it stayedqueuedwith no steps and no logs (gh run view --log→failed to get run log: log not found; check-run annotations empty).chore/security-daily-20260826-vectorize-connect-sdk-npm-root)This is not caused by PR #29
main...chore/security-daily-20260826-vectorize-connect-sdk-npm-rootchanges exactly two files:.github/is untouched, so the workflow definition on the branch is byte-identical tomain.Context
Every previous run in this repo succeeded, but the last one was 2026-05-13 — over three months before this failure. Something in the environment changed in between.
startup_failurewith no logs and no annotations usually means the run was rejected before a runner was assigned. Most likely candidates:gitleaks/gitleaks-action@v2(allow-list restriction).GITLEAKS_LICENSE/ org secret policy change.(1) fits best, but this could not be confirmed from the sweep:
GET /repos/.../actions/permissions,.../actions/permissions/selected-actions, andGET /orgs/vectorize-io/actions/permissionsall return 403 for the sweep's token. An org admin needs to check Settings → Actions → General → Allowed actions.Why it matters beyond this PR
The whole premise of this sweep is that a human-authored branch gets CI that Dependabot's own branches do not. On this repo no branch currently gets a usable CI signal at all, so that premise does not hold here until the above is fixed.
Verification status of PR #29
The dependency bundle itself was verified locally and green, so the PR is left open for review rather than closed:
package.jsonscripts— this repo hasbuild/clean/dev/prepublishOnlyand notestorlintscript.npm ci— clean,0 vulnerabilitiesnpm run build(tsup: CJS + ESM + d.ts) — successdist/built from unmodifiedmainand from the branch is byte-identical acrossindex.d.ts,index.js,index.mjs, so the published API surface is unchanged.No dependency was backlogged. All 16 open alerts are addressed in PR #29.
Also worth a human decision (from PR #29, repeated here so it is not lost)
peerDependenciesis^14.2.25 || ^15.5.18and was deliberately left alone. That range still admitsnext@14.x, and GHSA-p9j2-gv94-2wf4 (alert #42, high) has no fix on the 14.x line — it is patched only in 15.5.21. Consumers installing this SDK against next 14 therefore stay exposed no matter what PR #29 does. Narrowing to^15.5.21closes it but drops next 14 support, which is a breaking change to this SDK's public contract — a maintainer call, out of scope for the sweep.