[SECURITY][LOW] No pnpm audit step in CI — supply chain vulnerabilities not auto-detected
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-2 days
- Newbie friendliness
- 72/100
Research direction
Start by inspecting the CI workflow files under .github/workflows/ in both repositories and the committed pnpm-lock.yaml files. Check how pnpm is installed and dependencies are currently checked, then add the requested audit coverage and verify the workflow runs pnpm audit with the specified severity threshold. Done means the CI pipeline performs the vulnerability audit successfully.
Written by the indexing model from the issue text.
Description
Summary
Both repos use pnpm and have pnpm-lock.yaml committed (good). However, no CI pipeline runs pnpm audit. Without automated audit, newly disclosed CVEs in dependencies like nano (CouchDB client), ws, fastify, vite, or serve will not be detected until a manual audit is run. The pnpm-lock.yaml pins all transitive deps, but vulnerability databases update daily.
CVSS Score
3.1 (Low) — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Category
OWASP A06 — Vulnerable and Outdated Components
Affected File(s)
.github/workflows/(missing audit step)pnpm-lock.yaml
Remediation
Add a CI step to both repos:
- name: Dependency vulnerability audit
run: pnpm audit --audit-level=moderate
Also consider enabling Dependabot or Renovate on both GitHub repos for automated dependency update PRs.
References
- Dominant language
- TypeScript
- Stars
- 23
- Forks
- 13
- Avg merge
- 1d 7h
- Merged PRs (30d)
- 95
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from Eyevinn/open-live
-
Difficulty 4/5 3-5 days Newbie friendliness 55/100
-
Difficulty 4/5 3-5 days Newbie friendliness 38/100
-
Difficulty 5/5 Over a week Newbie friendliness 32/100
-
enhancement
Difficulty 5/5 Over a week Newbie friendliness 30/100
-
bug
Difficulty 4/5 3-5 days Newbie friendliness 38/100
All issues in Eyevinn/open-live
Similar issues
-
calcite-components needs triage refactor
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
Esri/calcite-design-system#15203 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 91/100
-
community first-timers-only good first issue hacktoberfest help wanted low hanging fruit up-for-grabs
Difficulty 1/5 Under an hour Newbie friendliness 95/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
Automattic/studio#4908 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 90/100