[polylane]

The site's dependency lockfile resolved known-vulnerable package versions: a Trivy scan found one critical and sixteen high advisories, each with a fixed release available. Several were pinned deep in the dependency tree, so they could not be dropped by a normal direct-version bump. After this change a fresh scan of the lockfile reports no critical or high advisories.

flowchart LR
  A["bun.lock on main"] --> B["astro 7.1.6 critical, 16 high advisories"]
  B --> C["bun install + bun run build"]
  D["package.json: bumped direct deps + pinned transitive resolutions"] --> E["bun.lock: all critical/high versions replaced"]
  E --> C
  C --> F["build still stops on pre-existing js-yaml ESM error owned by the js-yaml PR"]

Loading

Detection evidence

Affected: int_17ad4b457001o98datdn4tkm

Why this fix

The committed lockfile resolved known-vulnerable versions, and Trivy reproduced one critical and sixteen high advisories on the base branch, each with a fixed version available. The upgrade moves every one of them to a fixed release, and a fresh scan of the resulting lockfile reports no critical or high advisories. One risk remains: the site build already stops on a pre-existing ESM error from js-yaml, which the open js-yaml pull request owns, so the build check stays red until that merges.

Fix walkthrough

Watch the fix explained (1:25). Recorded for commit af3b388d307ef91ac4fab84d27c55b2c883b8dba.

Out of scope

• The js-yaml medium advisory GHSA-r3ph-w7gj-g6xm: the brief keeps it out of scope, and the open js-yaml build fix owns it.
• The postcss-selector-parser and yaml medium advisories: not part of this issue's critical/high ask, so they stay for a separate change.

Production impact: Static-site dependency upgrade changes no deployed runtime resource

I checked the dependency resolution for datum-cloud/cloudvalid.com. The repository has no deploy edges in the infrastructure graph: the only live deploy is GitHub Pages serving static files built by bun run build, and no server runtime or cloud resource uses these packages. The change only replaces vulnerable versions in the lockfile, so no production traffic path is affected.

Checked and not affected: provider#code#account#datum-cloud#region#earth#type#code.repository#id#datum-cloud/cloudvalid.com.

Observability

• The build job's bun run build output shows the site compiles; it currently stops on the pre-existing js-yaml ESM error, visible in CI logs.
• trivy fs --scanners vuln on bun.lock is the scanner signal that shows the critical/high advisories cleared.

Polylane assessed this pull request at 3f49d84.

Causal chain

• Signal (alert): Trivy scan of bun.lock: 1 critical and 10 high advisories with a fixed version
• Surfacing site: datum-cloud/cloudvalid.com at bun.lock
• Mechanism: Dependency resolution kept known-vulnerable versions: direct deps were outdated (astro 7.1.6, @astrojs/node 11.0.3, sharp 0.35.3) and transitive resolutions were either pinned exact by a dependent (lodash 4.17.21 by yaml-language-server, smol-toml 1.7.0 by markdownlint-cli2) or auto-installed to satisfy a peer range (@tailwindcss/vite pulled vite 6.4.1).
• Producer: datum-cloud/cloudvalid.com dependency manifest and lockfile, at package.json + bun.lock
• Blast radius: unknown other resource(s), unknown other tenant(s); data at risk: none named
• Producer evidence:
  • base bun.lock resolved astro 7.1.6, lodash 4.17.21, smol-toml 1.7.0, vite 6.4.1 and 12 other vulnerable packages
  • yaml-language-server pins lodash "4.17.21" and markdownlint-cli2 pins smol-toml "1.7.0" exactly in bun.lock
  • Trivy after the upgrade reports 0 critical and 0 high in bun.lock

2 files changed (+276/-235)

• bun.lock: modified, +262/-231
• package.json: modified, +14/-4

---

Generated by Polylane. You can ask follow-ups by mentioning @polylane in a comment.

[cla-assistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you all sign our Contributor License Agreement before we can accept your contribution.
1 out of 2 committers have signed the CLA.

✅ scotwells
❌ polylane[bot]
_{You have signed the CLA already but the status is still pending? Let us recheck it.}