[github-actions]

osv-scanner exclusion prune

Maintainer action required: this PR is published with the repository GITHUB_TOKEN, so CI may not start automatically. Please approve pending workflow runs and verify all required checks pass before merging.

Removed exclusions

GHSA	Package	Old -> New	Advisory resolved
GHSA-7c78-jf6q-g5cm	tmp	0.2.6 -> 0.2.7 (root resolutions pin)	tmp path traversal via type-confusion in _assertPath (first patched 0.2.7)
GHSA-ch52-4w7c-c8xp	http-cache-semantics	4.2.0 -> 4.3.0 (root resolutions pin)	shared-cache response confusion (affected <= 4.2.0)

Changes: osv-scanner.toml, root package.json (resolutions), yarn.lock.

Validation

• osv-scanner v2.3.8 (--config=osv-scanner.toml --format=json): exit 1 (findings), no scanner error. Neither removed GHSA appears in results. Severity gate (CVSS threshold 7.0): 0 blocking groups; only medium/low advisories remain.
• yarn check-deps: passed (Done).
• yarn lerna run build --scope @bitgo/sdk-coin-apt --include-dependencies: passed (sdk-coin-apt consumes http-cache-semantics at runtime via aptos-client > got > cacheable-request).
• yarn lerna run unit-test --scope @bitgo/sdk-coin-apt with BITGOJS_TEST_PASSWORD set: 135 passing, 0 failing (without that env var, 3 before all hooks fail for an unrelated environment reason).
• tmp is only used by dev tooling (karma, cypress, lerna, nx).

Still blocked

• GHSA-2w8x-224x-785m (sjcl): no upstream fix (first_patched_version: null); mitigated by @bitgo/sjcl fork.
• GHSA-jmr9-qjv8-65gv, GHSA-7pqw-9j4j-h8q3 (extract-zip): latest 2.0.1 is the last affected version; no fix.
• GHSA-w4pp-8pjf-rmxw (pacote): fix is 21.5.1+, but lerna pins pacote@21.0.1 exactly, yeoman-generator uses pacote 15.2.0 (major jump), and @npmcli/metavuln-calculator uses 21.0.3.
• GHSA-vfj7-8cjw-p6xm (braces): GitHub lists no patched version (latest 3.0.3). Note: osv-scanner v2.3.8 now reports this ignore as unused (the finding is no longer emitted), so it may be removable in a follow-up after confirming with maintainers; left in place since the advisory still has no patched version.

[claude]

Claude Code Review

This repository is configured for manual code reviews. Comment @claude review for a one-time review, or @claude review always to subscribe this PR to a review on every future push.

_{Tip: disable this comment in your organization's Code Review settings.}

[zahin-mohammad]

@claude review always

[github-actions]

Claude finished @zahin-mohammad's task in 19s —— View job

---

Review: prune resolved osv-scanner exclusions

No blocking issues found. The diff is small and consistent.

• osv-scanner.toml: The two removed ignores (GHSA-7c78-jf6q-g5cm for tmp, GHSA-ch52-4w7c-c8xp for http-cache-semantics) match the two patched versions pinned in package.json.
• package.json: The resolutions pins are tmp: 0.2.7 and http-cache-semantics: 4.3.0. The root devDependency tmp: ^0.2.3 (line 336) is satisfied by the 0.2.7 pin, so there is no conflict.
• yarn.lock: The tmp entries collapse into a single 0.2.7 block with all ranges (^0.2.1, ^0.2.3, ~0.2.3). http-cache-semantics resolves to 4.3.0 for all ranges. The diff is limited to those two packages. The new http-cache-semantics resolved URL has a hash fragment and the old one didn't. That is cosmetic and matches the tmp entries.

Notes (non-blocking)

• http-cache-semantics is a minor bump (4.2.0 → 4.3.0) applied to every consumer, including the runtime path through sdk-coin-apt (aptos-client > got > cacheable-request). The PR reports the sdk-coin-apt build and its 135 unit tests passing, which covers that path. I did not re-run them.
• The GHSA-vfj7-8cjw-p6xm (braces) ignore is reported as unused by osv-scanner v2.3.8. Pruning it in a follow-up is reasonable.
• The PR description says CI may not start automatically, so a maintainer needs to approve the workflow runs before merging.

I did not run the build or tests myself. The review is based on the diff and a check of the package.json dependency ranges.

[claude]

Code review found no issues

No high-confidence issues detected in this change.

[github-actions]

⚠️ Compatibility checks are failing on Node.js 27-nightly (experimental, non-blocking). This does not block merge, but it signals an incompatibility to fix before this release becomes supported.

View run