[Security] Dependency vulnerability triage: catch-all tracking issue for the open Mend alerts

Security dependency triage: catch-all tracking issue

Generated by Claude (Anthropic) on behalf of a maintainer. This consolidates the open Mend auto-cut dependency alerts and their existing auto-cut remediation PRs into one prioritized, agent-actionable plan. Every fix must be validated end to end with no breaking changes before its source alert is closed.

How to use this issue

Most alerts already have an open bot PR (Dependabot or Mend). The fastest safe path is to adopt the existing PR when it is a non-breaking bump, close duplicates, and only author a new change where no PR exists or the only bot PR is a major-version jump. Do not blind-merge a major-version bot PR to clear a CVE.

Before touching any alert, run a live search of the full open-PR list and dedup. The bot cuts a new PR on every scan, so the PR numbers in section 3 and 4 are a snapshot from 2026-07-27 and will drift. For each package you are about to fix, list every open PR that touches it, not just the one referenced here:

gh pr list --repo opensearch-project/observability-stack --state open --limit 200 \
  --json number,title,headRefName,labels
# then filter to the package/manifest you are working, e.g.
gh pr list --repo opensearch-project/observability-stack --state open --limit 200 \
  --search "astro in:title"

When several PRs target the same package, keep the one that touches both the manifest and the lockfile and covers the most alerts, and close the rest referencing the survivor. A single dependabot PR that bundles several packages (for example an esbuild + starlight + astro group) supersedes the narrower single-package PRs it contains; prefer the superset only when every bump in it is non-breaking, otherwise close the superset and adopt the narrow non-breaking PRs individually.

1. Scope

All open alerts labeled Mend: dependency security vulnerability as of 2026-07-27:

Alert	Manifest(s)	Root library	Highest sev	Direct/transitive	Ships to users?
#214	aws/cli-installer, aws/cdk	@aws-sdk/client-amp	6.1	transitive (fast-xml-parser)	Yes (installer)
#215	aws/cdk, aws/cli-installer	@aws-sdk/credential-provider-node	6.1	transitive (fast-xml-parser)	Yes (installer)
#293	aws/cdk	aws-cdk-lib	7.5	direct + transitive (fast-uri, brace-expansion)	Yes (installer)
#258	docs/starlight-docs	mermaid	9.3	transitive (dompurify)	Docs site
#278	docs/starlight-docs	@astrojs/starlight	7.5	transitive (js-yaml, postcss-selector-parser)	Docs site
#296	docs	astro	8.3	direct + transitive (js-yaml)	Docs site
#294	docs	vite (via astro)	8.3	transitive (vite)	Docs build
#76	docs	astro-icon	8.6	transitive (tar, undici, extract-zip)	Docs build
#295	docs	@astrojs/react	3.2	transitive (@babel/core)	Docs build
#241	docker-compose/agent-eval-canary	opensearch-genai-observability-sdk-py	5.3	transitive (idna)	Internal canary

2. Blast-radius categorization

Category A: user-facing install path (aws/cli-installer, aws/cdk). Code users execute to install the stack on AWS. Highest blast radius. Not covered by Dependabot (see section 6). Alerts #214, #215, #293.

Category B: published documentation site (docs, docs/starlight-docs). Runtime XSS surface (mermaid/DOMPurify) plus build-time supply-chain surface (tar, undici, vite, babel). Content is maintainer-authored, so runtime XSS exploitability is low, but the critical DOMPurify CVE still warrants a prompt pin. Covered by Dependabot weekly. Alerts #258, #278, #296, #294, #76, #295.

Category C: internal canary (docker-compose/agent-eval-canary). Not shipped, not exposed. The idna DoS needs an attacker-controlled oversized domain string the canary never receives. Lowest blast radius. Not covered by Dependabot. Alert #241.

3. Alert-to-PR map and recommended action

PR numbers are a 2026-07-27 snapshot. Re-run the live search in "How to use" before acting; adopt whatever open PR currently satisfies the same criteria.

Alert	Existing bot PR(s)	Recommended action
#293 aws-cdk-lib	#335 (Dependabot, manifest+lock to 2.260.0), #289 (Mend, lock only to 2.260.0)	Adopt #335 (2.260.0 is a non-breaking minor, clears direct CVE-2026-13760). Close #289 as duplicate of #335. Confirm 2.260.0 also clears the fast-uri / brace-expansion transitives; if not, add overrides in the same PR.
#215 credential-provider-node	#339 (Mend, lock only, aws/cli-installer to 3.972.30)	#339 covers only aws/cli-installer; the alert also lists aws/cdk. Adopt #339 for the installer, then extend the fix to aws/cdk (bump floor or add fast-xml-parser override) so both manifests are clean.
#214 client-amp	none	No bot PR. Root cause is fast-xml-parser 5.5.8, shared with #215. Add "overrides": { "fast-xml-parser": "^5.7.0" } to both aws/cli-installer/package.json and aws/cdk/package.json, re-lock. Resolves #214 and the #215 residue together.
#258 mermaid/dompurify	#334 (Dependabot, dompurify 3.4.5 to 3.4.12 in starlight-docs)	Adopt #334 (patch within 3.x, clears critical CVE-2026-49978). Verify mermaid still renders after merge.
#278 starlight js-yaml/postcss	#319 (js-yaml 4.3.0, starlight-docs); #336 / #356 (multi: astro v7 + starlight 0.41 + sharp/esbuild)	Adopt #319 for js-yaml (non-breaking). #336 and #356 are major bumps (astro 7, starlight 0.41); do NOT adopt to clear this alert. Handle postcss-selector-parser (CVE-2026-9358, sev 4.3) with a targeted override if no minor bot PR exists.
#296 astro (docs)	#267 (astro 6.3.8 patch), #327 / #340 (astro v7 major), #313 (js-yaml 4.3.0)	The high CVE-2026-54299/54298 are fixed in astro 6.4.6 (within 6.x). Confirm whether #267 (6.3.8) clears them; if not, bump to ^6.4.6 in a new PR. Do NOT adopt #327/#340 (astro v7 major) in this pass. Adopt #313 for js-yaml. Leave CVE-2026-59727/59729 (astro 7-only) open with a note; track astro-7 separately.
#294 vite (docs)	#355 (Dependabot, vite 7.3.3 to 7.3.6 in docs)	Adopt #355 (7.3.6 >= 7.3.5, clears the CVE; non-breaking patch). Confirm the astro 6.4.6 resolution does not pin vite back below the fixed floor; if it does, add a "vite" override.
#76 astro-icon tar/undici	#347 (tar 7.5.22, docs), #346 (undici 7.29.0, docs)	Adopt #347 and #346 (both non-breaking, clear the tar and undici CVEs). extract-zip has no bot PR; add an override if a fixed release exists, else pin its vulnerable child. Build-time only.
#295 @babel/core	none	No bot PR. Add "@babel/core": "^7.29.6" override to docs/package.json. Severity 3.2 (low); lowest priority.
#241 idna	none (canary not watched by Dependabot)	Add idna>=3.15 constraint to docker-compose/agent-eval-canary/pyproject.toml and re-lock. Preferred long-term: pin idna>=3.15 upstream in opensearch-genai-observability-sdk-py, release a patch, then bump the SDK floor here.

4. Duplicate / superseded PRs to close

Per the maintainer directive to search for and close related/duplicate auto-cut PRs: run the live search first, then for each surviving fix close every other open PR that targets the same package/CVE. As of 2026-07-27 the confirmed duplicate clusters are:

• #289 (Mend, aws-cdk-lib lock-only) is superseded by #335 (Dependabot, manifest+lock). Close #289 referencing #335.
• astro-v7 for /docs: #327 (Dependabot) and #340 (Mend) are duplicate astro-7 major bumps. Keep at most one, and only if the astro-7 evaluation approves the major bump; otherwise close both and rely on the targeted minor pins above.
• astro-7 / starlight-0.41 for /docs/starlight-docs: #336 (sharp + starlight + astro) and #356 (esbuild + starlight + astro) overlap heavily; #348 in this cluster is already closed. Keep at most one of #336/#356, gated on the astro-7 decision; otherwise close both and adopt the narrow non-breaking PRs (#334 dompurify, #319 js-yaml) individually.

Before closing any PR, confirm the surviving PR (or the new targeted fix) actually clears the same CVE set. Comment the reason and link the survivor on each closed PR.

5. Prioritized execution order

Ordering balances resolution speed (adopt existing non-breaking PRs, batch shared roots) against blast radius (user-facing install path and critical severity first).

P0. Category A install path. #293 (adopt #335, close #289); #214 + #215 residue (fast-xml-parser override across both aws manifests, adopt #339 for the installer lock).

P1. Category B critical. #258 (adopt #334, verify mermaid renders).

P2. Category B remaining, non-breaking only. #278 js-yaml (adopt #319) + postcss override; #296 astro within 6.x to 6.4.6 + js-yaml (adopt #313); #294 vite (adopt #355 or override); #76 tar/undici (adopt #347, #346) + extract-zip.

P3. Low severity and internal. #295 babel override; #241 idna constraint.

6. Cross-cutting: close the Dependabot coverage gap

.github/dependabot.yml watches only /docs, /docs/starlight-docs, and three /examples/* Python dirs. It does not watch aws/cdk, aws/cli-installer, or docker-compose/agent-eval-canary, which is why the Category A and C alerts have no Dependabot PRs and sat open. Add these directories to the Dependabot config in a follow-up PR so future install-path CVEs are auto-surfaced. Track separately from the fixes above.

7. End-to-end validation (required per fix, no breaking changes)

Run the checks that mirror the repo's CI for the touched manifest. A fix is done only when the source alert's vulnerable version no longer resolves AND the component still builds and passes tests.

• docs/ and docs/starlight-docs/ (mirrors docs-ci.yml):

  cd docs && npm install && npm run build && npm run test:coverage
  

  npm run build also builds starlight-docs. Then confirm resolution:

  npm ls dompurify js-yaml vite @babel/core tar undici    # in the relevant dir
  npm audit --omit=dev
  

  For #258, load the built docs and confirm mermaid diagrams still render.
• aws/cdk/:

  cd aws/cdk && npm install && npm run build && npm run synth
  npm ls fast-xml-parser fast-uri brace-expansion aws-cdk-lib
  

  synth must produce the same template shape (no resource diffs from the dependency bump).
• aws/cli-installer/ (mirrors cli-unit-tests.yml and e2e.yml):

  cd aws/cli-installer && npm install && npm test && npm run e2e:list
  npm ls fast-xml-parser
  

  Run npm run e2e where credentials/environment allow; otherwise flag the gap and request QA on the installer path.
• docker-compose/agent-eval-canary/:

  cd docker-compose/agent-eval-canary && uv sync && uv run python -c "import idna, importlib.metadata as m; print(m.version('idna'))"
  

  Confirm >= 3.15 and run the canary's existing smoke path.

Commit the regenerated lockfile alongside every manifest change.

8. Execution checklist for the implementing agent

1. Run the live open-PR search in "How to use" and build the current package-to-PR map before touching any alert; the snapshots in sections 3 and 4 will have drifted.
2. For each alert, check section 3. Adopt the existing non-breaking bot PR where one exists; author a new change only where noted.
3. Rebase the adopted bot PR on main and confirm CI is green before merge.
4. Where authoring a new change: apply the pin/override exactly as listed, re-lock (npm install, or uv lock/uv sync for the canary).
5. Run the matching validation block in section 7. Builds and tests green; target vulnerable version absent from npm ls / npm audit / uv resolution.
6. Close every duplicate PR the live search surfaced for the fixed package (section 4 lists the known clusters), each with a comment linking the survivor.
7. In every PR description, list the CVEs it closes and reference this tracking issue and the source Mend alert.
8. When the vulnerable version is confirmed absent on main, the Mend alert auto-closes on the next scan; close manually with a link to the merged PR if it lingers.
9. Never force a major-version bump (astro 7, starlight 0.41, or any major-tagged bump) to clear a CVE. If the only fix is a major, leave the CVE open with a one-line note and open a separate evaluation issue.

9. Follow-ups to track separately (not blockers for the fixes)

• astro 7.x / starlight 0.41 major-upgrade evaluation (covers #296 CVE-2026-59727/59729 and the #327/#340/#336/#356 bot PRs).
• Dependabot coverage for aws/cdk, aws/cli-installer, docker-compose/agent-eval-canary.
• Upstream idna>=3.15 pin in opensearch-genai-observability-sdk-py.