Daily dependency CVE audit failed · Issue #13078 · QwenLM/qwen-code · GitHub
Skip to content

Daily dependency CVE audit failed #13078

Open
Open
Daily dependency CVE audit failed#13078
Assignees
LubabaKhalid
Labels
scope/ci-cdContinuous integration/deploymentstatus/needs-triageIssue needs to be triaged and labeled

Description

@github-actions
github-actions
bot
opened on Sep 30, 2026

The scheduled dependency CVE audit failed.

Check the failing step in the run. Possible causes include a new high-severity vulnerability, the npm audit endpoint remaining unavailable after its bounded retry, or a setup or dependency-install failure.

Activity

  1. github-actions
    added
    status/needs-triageIssue needs to be triaged and labeled
    scope/ci-cdContinuous integration/deployment
    on Sep 30, 2026

  2. doudouOUC commented on Sep 30, 2026

    @doudouOUC
    doudouOUC
    on Sep 30, 2026
    Collaborator

    This run's npm audit --omit=dev --audit-level=high failed because of two new high-severity advisories against undici:

    Advisory Title Vulnerable Patched
    GHSA-rfgv-xxqx-mfg5 undici — DoS via unrequested WebSocket subprotocol >=7.0.0 <7.29.1 >=7.29.1
    GHSA-w293-vg96-wgc3 undici — TLS cert validation bypass via dropped connect options in BalancedPool >=7.24.1 <7.29.1 >=7.29.1

    All three production workspaces pin undici: "^7.28.0", and the lockfile currently resolves to a version below 7.29.1 — the audit surfaced the 19-vuln breakdown (4 low | 13 moderate | 2 high):

    • packages/cli/package.json:103
    • packages/core/package.json:167 (line 127 is @opentelemetry/instrumentation-undici, unrelated)
    • integrations/external-context/package.json:34

    Fix: bump undici to ^7.29.1 in all three package.jsons and regenerate the lockfile (npm install at root), then commit + push (or open a dep-bump PR). The 13 moderate + 4 low findings remain in-tree but do not fail the --audit-level=high gate; they can be tracked separately.

    This is the standard dep-bump triage — no qwen-code source change needed, only a dependency version bump. Safe to auto-close once the bump PR merges.

  3. LubabaKhalid commented on Sep 30, 2026

    @LubabaKhalid
    LubabaKhalid
    on Sep 30, 2026

    Hi, I'd like to work on this issue. Could you please assign it to me?

    I can update undici to ^7.29.1 in the three affected production workspaces, regenerate the lockfile, and verify that the dependency audit passes.

  4. github-actions commented on Oct 1, 2026

    @github-actions
    github-actionsBot
    on Oct 1, 2026 – with GitHub Actions
    ContributorAuthor

    Dependency audit failed again: run 36808047834.

  5. yiliang114
    assigned
    LubabaKhalid
    on Oct 1, 2026

  6. yiliang114 commented on Oct 1, 2026

    @yiliang114
    yiliang114
    on Oct 1, 2026
    Collaborator

    Assigned to you, @LubabaKhalid — thanks for picking this up.

    One scope update before you start: the advisory set has grown since the triage above. The latest failing run (36808047834) reports 12 high findings, and undici is only 2 of them. The gate (corepack pnpm audit --prod --audit-level high in .github/workflows/security-checks.yml) stays red until all highs are cleared. I've verified the full recipe below locally: after it, the audit exits 0 (14 remaining findings are moderate/low and do not fail the gate).

    1. undici (2 highs: GHSA-rfgv-xxqx-mfg5, GHSA-w293-vg96-wgc3)

    Bump "undici": "^7.28.0" → "^7.29.1" in:

    • packages/cli/package.json
    • packages/core/package.json
    • integrations/external-context/package.json

    ^7.28.0 already semver-permits the patched version, but raising the floor keeps the lockfile from regressing below it. It resolves to 7.30.0 today. Note the codebase pins all fetch traffic to the bundled undici and only exercises Agent / EnvHttpProxyAgent / setGlobalDispatcher — no BalancedPool, undici WebSocket, or cache interceptors — so the patch is low-risk here. Still worth a quick smoke of a normal chat plus one proxied run after the bump.

    2. axios (6 highs, all patched in >= 1.20.0)

    Transitive via dingtalk-stream-sdk-nodejs, @larksuiteoapi/node-sdk, and @wecom/aibot-node-sdk. Bump the existing override in pnpm-workspace.yaml: axios: '^1.19.0' → '^1.20.0'.

    3. @grpc/grpc-js (1 high, patched in >= 1.14.5)

    Transitive via @opentelemetry/otlp-grpc-exporter-base and @a2a-js/sdk. Add override '@grpc/grpc-js': '^1.14.5' to pnpm-workspace.yaml.

    4. brace-expansion (2 highs, patched in >= 2.1.6)

    Via glob > minimatch in packages/cli and packages/core. Add a major-scoped override 'brace-expansion@2': '^2.1.6' to pnpm-workspace.yaml. Do not use a blanket override — the tree also carries brace-expansion 1.1.12 (minimatch 3.x) and 5.x, which are outside the vulnerable range and must not be moved.

    Then regenerate the lockfile and verify from the repo root:

    corepack pnpm install --lockfile-only
corepack pnpm audit --prod --audit-level high   # must exit 0
npm run check:lockfile

    Notes:

    • The root workspace is pnpm-managed; the root package-lock.json is retired and gitignored, so don't regenerate one with npm. The nested packages/*/package-lock.json files are audited separately by the same workflow but are unaffected by this advisory set (packages/live-host pins undici 6.28.0, outside the vulnerable ranges).
    • New advisories land daily — re-run the audit right before marking the PR ready in case the gate has picked up new highs by then.
    • Commit convention is chore(deps): ...; link this issue with Fixes #13078 in the PR body.

  7. LubabaKhalid commented on Oct 1, 2026

    @LubabaKhalid
    LubabaKhalid
    on Oct 1, 2026

    Thanks for the detailed update. I’ll follow the updated scope, apply the dependency overrides, regenerate the pnpm lockfile and verify that the production audit passes before opening the PR.

  8. github-actions commented on Oct 2, 2026

    @github-actions
    github-actionsBot
    on Oct 2, 2026 – with GitHub Actions
    ContributorAuthor

    Dependency audit failed again: run 36957181036.

  9. github-actions commented on Oct 3, 2026

    @github-actions
    github-actionsBot
    on Oct 3, 2026 – with GitHub Actions
    ContributorAuthor

    Dependency audit failed again: run 37091299242.

  10. github-actions commented on Oct 4, 2026

    @github-actions
    github-actionsBot
    on Oct 4, 2026 – with GitHub Actions
    ContributorAuthor

    Dependency audit failed again: run 37174174662.

  11. github-actions commented on Oct 5, 2026

    @github-actions
    github-actionsBot
    on Oct 5, 2026 – with GitHub Actions
    ContributorAuthor

    Dependency audit failed again: run 37257412738.

  12. github-actions commented on Oct 6, 2026

    @github-actions
    github-actionsBot
    on Oct 6, 2026 – with GitHub Actions
    ContributorAuthor

    Dependency audit failed again: run 37405933205.

  13. LubabaKhalid commented on Oct 6, 2026

    @LubabaKhalid
    LubabaKhalid
    on Oct 6, 2026

    Dependency audit failed again: run 37405933205.

    The scheduled dependency CVE audit is still failing on the latest run (37405933205).

    The dependency fixes from this PR addressed the high-severity advisories identified in the original triage, but new advisories may have been reported since then. I’ll check the latest failing run to identify the current high-severity findings and update the dependency fixes if needed.

  14. github-actions commented on Oct 7, 2026

    @github-actions
    github-actionsBot
    on Oct 7, 2026 – with GitHub Actions
    ContributorAuthor

    Dependency audit failed again: run 37564134628.

  15. 8 remaining items

  16. github-actions commented on Oct 15, 2026

    @github-actions
    github-actionsBot
    on Oct 15, 2026 – with GitHub Actions
    ContributorAuthor

    Dependency audit failed again: run 38672497074.

  17. github-actions commented on Oct 16, 2026

    @github-actions
    github-actionsBot
    on Oct 16, 2026 – with GitHub Actions
    ContributorAuthor

    Dependency audit failed again: run 38841834647.

  18. github-actions commented on Oct 17, 2026

    @github-actions
    github-actionsBot
    on Oct 17, 2026 – with GitHub Actions
    ContributorAuthor

    Dependency audit failed again: run 38995886178.

  19. github-actions commented on Oct 18, 2026

    @github-actions
    github-actionsBot
    on Oct 18, 2026 – with GitHub Actions
    ContributorAuthor

    Dependency audit failed again: run 39091008169.

  20. github-actions commented on Oct 19, 2026

    @github-actions
    github-actionsBot
    on Oct 19, 2026 – with GitHub Actions
    ContributorAuthor

    Dependency audit failed again: run 39191519341.

  21. github-actions commented on Oct 20, 2026

    @github-actions
    github-actionsBot
    on Oct 20, 2026 – with GitHub Actions
    ContributorAuthor

    Dependency audit failed again: run 39360530097.

  22. github-actions commented on Oct 21, 2026

    @github-actions
    github-actionsBot
    on Oct 21, 2026 – with GitHub Actions
    ContributorAuthor

    Dependency audit failed again: run 39534695215.

  23. github-actions commented on Oct 22, 2026

    @github-actions
    github-actionsBot
    on Oct 22, 2026 – with GitHub Actions
    ContributorAuthor

    Dependency audit failed again: run 39713084353.

  24. github-actions commented on Oct 23, 2026

    @github-actions
    github-actionsBot
    on Oct 23, 2026 – with GitHub Actions
    ContributorAuthor

    Dependency audit failed again: run 39891337087.

  25. github-actions commented on Oct 24, 2026

    @github-actions
    github-actionsBot
    on Oct 24, 2026 – with GitHub Actions
    ContributorAuthor

    Dependency audit failed again: run 40055313481.

  26. github-actions commented on Oct 25, 2026

    @github-actions
    github-actionsBot
    on Oct 25, 2026 – with GitHub Actions
    ContributorAuthor

    Dependency audit failed again: run 40155577361.

  27. github-actions commented on Oct 26, 2026

    @github-actions
    github-actionsBot
    on Oct 26, 2026 – with GitHub Actions
    ContributorAuthor

    Dependency audit failed again: run 40261008678.

  28. github-actions commented on Oct 27, 2026

    @github-actions
    github-actionsBot
    on Oct 27, 2026 – with GitHub Actions
    ContributorAuthor

    Dependency audit failed again: run 40440336466.

  29. github-actions commented on Oct 28, 2026

    @github-actions
    github-actionsBot
    on Oct 28, 2026 – with GitHub Actions
    ContributorAuthor

    Dependency audit failed again: run 40621907542.

  30. github-actions commented on Oct 29, 2026

    @github-actions
    github-actionsBot
    on Oct 29, 2026 – with GitHub Actions
    ContributorAuthor

    Dependency audit failed again: run 40807383567.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

scope/ci-cdContinuous integration/deploymentstatus/needs-triageIssue needs to be triaged and labeled

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions