CI: new external advisories fail the parent helper image scans and the SDK npm audit on every PR #1084

Since 2026-10-06 two CI jobs fail on any pull request that triggers them, for reasons unrelated to the PR's changes. First seen on #1045 (head 8716cb0, rebased on master 61a4ef6): 41 checks pass, 3 fail, all three below.

1. OpenSecret backend CI → Parent helper image (enclave-logging) and (credential-requester)

Step "Scan finished image for fixable high and critical vulnerabilities" (Trivy v0.75.0, ignore-unfixed: true, severity: HIGH,CRITICAL) now reports 7 fixable findings, all in one Debian 12.15 package:

The Python layers (boto3, botocore, urllib3, …) are clean. Both images build from python:3.13.16-slim-bookworm pinned by digest in services/opensecret/nitro-toolkit/credential_requester/Dockerfile and services/opensecret/nitro-toolkit/logging/Dockerfile; the Debian security update is newer than that digest.

Master looks green only because this matrix job is skipped on master runs (the last three master runs of the workflow show Parent helper image (${{ matrix.name }}) as skipped), so every PR that triggers the backend workflow will keep failing until the images are refreshed.

Evidence: https://github.com/MaplePrivacyLabs/Maple/actions/runs/37538020846/job/112523976223 and https://github.com/MaplePrivacyLabs/Maple/actions/runs/37538020846/job/112523976187

Proposed fix: add perl-base=5.36.0-7+deb12u4 to the existing apt-get install --only-upgrade line in both Dockerfiles (the same pattern already used there for libpcre2-8-0=10.42-1+deb12u2), or bump the base image digest once upstream has rebuilt against the new Debian point release.

2. SDK publishing boundary tests → SDK package (npm)

Step "Exercise the real package builder without publishing credentials" fails in bun audit:

source-map-js  >=1.0.0 <1.2.2
  vite › postcss › source-map-js
  vite-plugin-dts › @vue/language-core › @vue/compiler-dom › @vue/compiler-core › source-map-js
  high: source-map-js allows event-loop denial of service through indexed source-map section offsets
  https://github.com/advisories/GHSA-68fv-2mgg-jv7q
1 vulnerabilities (1 high)

sdk/bun.lock pins [email protected]; both dependents ([email protected], @vue/[email protected]) declare ^1.2.1, so a lockfile bump to 1.2.2 is sufficient. The last master run of this workflow (2026-10-05) passed; the advisory is newer. Same shape as #1056 (brace-expansion).

Evidence: https://github.com/MaplePrivacyLabs/Maple/actions/runs/37538020223/job/112523845275

Proposed fix: bump source-map-js to 1.2.2 in sdk/bun.lock (dev-only dependency via vite); re-run the affected PRs' checks afterwards.

Impact

Any PR touching services/opensecret or sdk/ currently shows these three red checks regardless of its content. Suggest two small, separate PRs (one per section) rather than folding the fixes into feature PRs.