ci(root): migrate dependency audit from improved-yarn-audit to osv-scanner#9263
Open
roshan-bitgo wants to merge 1 commit into
Open
ci(root): migrate dependency audit from improved-yarn-audit to osv-scanner#9263roshan-bitgo wants to merge 1 commit into
roshan-bitgo wants to merge 1 commit into
Conversation
roshan-bitgo
force-pushed
the
fix/migrate-to-osv-scanner
branch
from
July 15, 2026 13:55
4225a46 to
8cb6db4
Compare
roshan-bitgo
changed the title
roshan-bitgo
force-pushed
the
fix/migrate-to-osv-scanner
branch
from
July 15, 2026 14:02
8cb6db4 to
c71679c
Compare
roshan-bitgo
marked this pull request as ready for review
July 15, 2026 14:16
lcovar
previously approved these changes
Jul 15, 2026
louib
requested changes
Jul 15, 2026
| continue-on-error: true | ||
| run: retry --up-to 2x --every 3s -- yarn run audit-high --retry-on-network-failure | ||
| - name: Audit Dependencies | ||
| uses: google/osv-scanner-action@v2 |
Contributor
There was a problem hiding this comment.
@roshan-bitgo we should be pinning this action to a commit sha
Contributor
roshan-bitgo
marked this pull request as draft
July 17, 2026 14:11
roshan-bitgo
force-pushed
the
fix/migrate-to-osv-scanner
branch
from
July 17, 2026 14:22
2ba289d to
7b35013
Compare
…anner Replaces improved-yarn-audit with google/osv-scanner-action@v2 in both release workflows. npm retired the legacy security audits endpoint on 2026-07-15 (HTTP 410); yarn classic audit and improved-yarn-audit are permanently broken as a result. osv-scanner reads yarn.lock directly and queries OSV.dev -- no npm registry dependency. All 14 CVE exclusions migrated 1:1 from .iyarc to osv-scanner.toml with original justifications preserved. Severity threshold remains HIGH+. VL-7134
roshan-bitgo
force-pushed
the
fix/migrate-to-osv-scanner
branch
from
July 17, 2026 14:44
7b35013 to
c067b4c
Compare
roshan-bitgo
marked this pull request as ready for review
July 17, 2026 15:02
roshan-bitgo
requested review from
lcovar,
louib,
mohammadalfaiyazbitgo and
vibhavgo
July 17, 2026 15:03
louib
approved these changes
Jul 17, 2026
| @@ -271,9 +271,14 @@ jobs: | |||
| with: | |||
| targets: EricCrosson/retry@v1.4.8:sha256-d207746ff0eda67c706df25e88c02520f0cf3172279eb8eec8224fb0d3558911 | |||
Contributor
There was a problem hiding this comment.
@roshan-bitgo I think we can remove this step from this workflow as well (you removed it from the other workflow already)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Replaces
improved-yarn-auditwithgoogle/osv-scanner-actionin both release workflows.Why: npm permanently retired the legacy security audits endpoint (
/-/npm/v1/security/audits) on 2026-07-15 with HTTP 410. Yarn v1'syarn auditcalls this endpoint;improved-yarn-auditwrapsyarn auditand inherits the breakage. The yarn team closed the fix as "not planned" — yarn classic's audit is permanently broken.Why osv-scanner: Unlike
audit-ci(which also callsyarn audit --jsonunder the hood for Yarn Classic),osv-scannerreadsyarn.lockdirectly and queries the OSV.dev database. No npm registry dependency. Works identically locally and in CI.Changes
.github/workflows/publish.yml— replace broken audit step withosv-scanner-action@v2.github/workflows/npmjs-release.yml— replace broken audit step withosv-scanner-action@v2package.json— removeimproved-yarn-auditdevDependency andaudit-highscriptosv-scanner.toml— new config; all 14 exclusions migrated 1:1 from.iyarcwith original justifications preserved.iyarc— deleted (superseded byosv-scanner.toml).claude/agents/iyarc-prune.md— updated all references toosv-scanner.tomland new CLI invocationSecurity posture
All 14 existing CVE exclusions are preserved with their original justifications. Severity threshold remains HIGH+. No change to which vulnerabilities are accepted.
Follows the immediate unblock in #9262. Tracked in VL-7134.