chore: security audit cleanup — CodeQL, workflow permissions, dependency overrides (#2884)

ihabadham · claude · web-flow · commit b72f12dc6ccd · 2026-03-29T05:11:05.000+02:00
## Summary Addresses all 65 open GitHub security alerts (49 code scanning + 16 Dependabot) identified during a full security audit. None represent real risk to end users — see #2883 for the complete investigation. - **Switch CodeQL to advanced setup** with path exclusions for test fixtures and spec/dummy apps (eliminates 14 false-positive code scanning alerts from build artifacts and test infrastructure) - **Add `permissions: { contents: read }`** to all 14 CI workflows that lacked a top-level permissions block (resolves 22 code scanning alerts, follows GitHub's principle of least privilege) - **Generate pnpm overrides** via `pnpm audit --fix` for 28 transitive dependency vulnerabilities (all dev-only, reduces npm audit from 38 to 8 — remaining are unfixable or pnpm edge cases) - **Update loofah** 2.25.0 → 2.25.1 across 4 Gemfile.lock files (URI detection fix) Additionally, 13 code scanning false positives were dismissed via API with documented reasons (by-design VM execution, internal service architecture, non-vulnerable regex patterns). See #2883 for each dismissal rationale. ## Post-merge admin action After merging, disable the "Default setup" CodeQL scanner in Settings > Code security > Code scanning. The new advanced setup workflow replaces it — if both run, the default scanner ignores path exclusions. ## Test plan - [ ] CI passes on all existing workflows (the permissions change is additive and non-breaking) - [ ] CodeQL workflow runs successfully on this PR (new workflow) - [ ] After merge + default CodeQL disabled: code scanning alerts drop to ~0 - [ ] After merge: Dependabot detects lockfile changes and auto-closes resolved alerts Closes #2883 🤖 Generated with [Claude Code](https://claude.com/claude-code)  ## Summary by CodeRabbit * **Chores** - Restrict CI workflow permissions to read-only access for repository contents. - Add a scheduled automated CodeQL security scan covering JavaScript/TypeScript and Ruby. - Exclude test fixture and dummy application directories from automated security analysis. - Expand package manager override rules to pin/remap many transitive dependency versions for more consistent installs.  --------- Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
diff --git a/.github/codeql/codeql-config.yml b/.github/codeql/codeql-config.yml
@@ -0,0 +1,9 @@
+# Excludes directories that generate false positives:
+# - tests/fixtures: pre-built webpack bundles checked in as test artifacts, not source code
+# - spec/dummy: Rails test apps used for integration testing, not production code
+
+paths-ignore:
+  - 'packages/react-on-rails-pro-node-renderer/tests/fixtures/**'
+  - 'react_on_rails_pro/spec/dummy/**'
+  - 'react_on_rails_pro/spec/execjs-compatible-dummy/**'
+  - 'react_on_rails/spec/dummy/**'
diff --git a/.github/workflows/actionlint.yml b/.github/workflows/actionlint.yml
@@ -1,5 +1,8 @@
 name: Lint GitHub Actions
 
+permissions:
+  contents: read
+
 on:
   push:
     branches:
diff --git a/.github/workflows/bundle-size.yml b/.github/workflows/bundle-size.yml
@@ -1,5 +1,8 @@
 name: Bundle Size
 
+permissions:
+  contents: read
+
 on:
   pull_request:
     paths:
diff --git a/.github/workflows/check-markdown-links.yml b/.github/workflows/check-markdown-links.yml
@@ -1,5 +1,8 @@
 name: Check Markdown Links
 
+permissions:
+  contents: read
+
 on:
   push:
     branches: [main]
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
@@ -0,0 +1,39 @@
+name: CodeQL
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    - cron: '0 6 * * 1' # Weekly Monday 6am UTC
+
+jobs:
+  analyze:
+    name: Analyze
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+      contents: read
+      actions: read
+    strategy:
+      fail-fast: false
+      matrix:
+        language: ['javascript-typescript', 'ruby']
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v4
+        with:
+          languages: ${{ matrix.language }}
+          config-file: ./.github/codeql/codeql-config.yml
+
+      - name: Autobuild
+        uses: github/codeql-action/autobuild@v4
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v4
+        with:
+          category: '/language:${{ matrix.language }}'
diff --git a/.github/workflows/examples.yml b/.github/workflows/examples.yml
@@ -1,5 +1,8 @@
 name: Generator tests # TODO needs to be duplicated for RoR Pro
 
+permissions:
+  contents: read
+
 on:
   push:
     branches:
diff --git a/.github/workflows/gem-tests.yml b/.github/workflows/gem-tests.yml
@@ -1,5 +1,8 @@
 name: Rspec test for gem
 
+permissions:
+  contents: read
+
 on:
   push:
     branches:
diff --git a/.github/workflows/integration-tests.yml b/.github/workflows/integration-tests.yml
@@ -1,5 +1,8 @@
 name: Integration Tests
 
+permissions:
+  contents: read
+
 on:
   push:
     branches:
diff --git a/.github/workflows/lint-js-and-ruby.yml b/.github/workflows/lint-js-and-ruby.yml
@@ -1,5 +1,8 @@
 name: Lint JS and Ruby
 
+permissions:
+  contents: read
+
 on:
   push:
     branches:
diff --git a/.github/workflows/package-js-tests.yml b/.github/workflows/package-js-tests.yml
@@ -1,5 +1,8 @@
 name: JS unit tests for Renderer package
 
+permissions:
+  contents: read
+
 on:
   push:
     branches:
diff --git a/.github/workflows/playwright.yml b/.github/workflows/playwright.yml
@@ -1,5 +1,8 @@
 name: Playwright E2E Tests
 
+permissions:
+  contents: read
+
 on:
   push:
     branches: [main]
diff --git a/.github/workflows/precompile-check.yml b/.github/workflows/precompile-check.yml
@@ -1,5 +1,8 @@
 name: Assets Precompile Check
 
+permissions:
+  contents: read
+
 on:
   push:
     branches:
diff --git a/.github/workflows/pro-integration-tests.yml b/.github/workflows/pro-integration-tests.yml
@@ -1,5 +1,8 @@
 name: React on Rails Pro - Integration Tests
 
+permissions:
+  contents: read
+
 on:
   push:
     branches:
diff --git a/.github/workflows/pro-lint.yml b/.github/workflows/pro-lint.yml
@@ -1,5 +1,8 @@
 name: React on Rails Pro - Lint
 
+permissions:
+  contents: read
+
 on:
   push:
     branches:
diff --git a/.github/workflows/pro-test-package-and-gem.yml b/.github/workflows/pro-test-package-and-gem.yml
@@ -1,5 +1,8 @@
 name: React on Rails Pro - Package Tests
 
+permissions:
+  contents: read
+
 on:
   push:
     branches:
diff --git a/.github/workflows/trigger-docs-site.yml b/.github/workflows/trigger-docs-site.yml
@@ -1,5 +1,8 @@
 name: Trigger docs site rebuild
 
+permissions:
+  contents: read
+
 on:
   push:
     branches: [main]
diff --git a/package.json b/package.json
@@ -120,13 +120,40 @@
   "homepage": "https://github.com/shakacode/react_on_rails#readme",
   "packageManager": "pnpm@9.14.2",
   "pnpm": {
+    "// for overrides": [
+      "Generated via pnpm audit --fix, with manual caps added to prevent major version jumps.",
+      "These force patched versions of transitive dev dependencies. Remove when upstream packages update.",
+      "ajv overrides were intentionally excluded: ajv v8 breaks webpack's schema-utils/ajv-keywords.",
+      "The 2 moderate ajv alerts (ReDoS in $data option) are tolerable — ajv only validates our own config files."
+    ],
     "overrides": {
       "react": "$react",
       "react-dom": "$react-dom",
       "app>react": "^18.3.1",
       "app>react-dom": "^18.3.1",
       "sentry-testkit>body-parser": "npm:empty-npm-package@1.0.0",
-      "sentry-testkit>express": "npm:empty-npm-package@1.0.0"
+      "sentry-testkit>express": "npm:empty-npm-package@1.0.0",
+      "lodash@>=4.0.0 <=4.17.22": ">=4.17.23 <5",
+      "qs@>=6.7.0 <=6.14.1": ">=6.14.2 <7",
+      "bn.js@>=5.0.0 <5.2.3": ">=5.2.3 <6",
+      "bn.js@<4.12.3": ">=4.12.3 <5",
+      "minimatch@<3.1.4": ">=3.1.4 <4",
+      "minimatch@>=9.0.0 <9.0.7": ">=9.0.7 <10",
+      "basic-ftp@<5.2.0": ">=5.2.0 <6",
+      "serialize-javascript@<7.0.5": ">=7.0.5 <8",
+      "@tootallnate/once@<3.0.1": ">=3.0.1 <4",
+      "svgo@=4.0.0": ">=4.0.1 <5",
+      "svgo@>=2.1.0 <2.8.1": ">=2.8.1 <3",
+      "immutable@>=5.0.0 <5.1.5": ">=5.1.5 <6",
+      "flatted@<=3.4.1": ">=3.4.2 <4",
+      "smol-toml@<1.6.1": ">=1.6.1 <2",
+      "handlebars@>=4.0.0 <4.7.9": ">=4.7.9 <5",
+      "path-to-regexp@<0.1.13": ">=0.1.13 <0.2",
+      "brace-expansion@<1.1.13": ">=1.1.13 <2",
+      "brace-expansion@>=2.0.0 <2.0.3": ">=2.0.3 <3",
+      "picomatch@<2.3.2": ">=2.3.2 <3",
+      "picomatch@>=4.0.0 <4.0.4": ">=4.0.4 <5",
+      "yaml@>=1.0.0 <1.10.3": ">=1.10.3 <2"
     }
   }
 }
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
diff --git a/react_on_rails/Gemfile.lock b/react_on_rails/Gemfile.lock
diff --git a/react_on_rails_pro/Gemfile.lock b/react_on_rails_pro/Gemfile.lock
diff --git a/react_on_rails_pro/spec/dummy/Gemfile.lock b/react_on_rails_pro/spec/dummy/Gemfile.lock
diff --git a/react_on_rails_pro/spec/execjs-compatible-dummy/Gemfile.lock b/react_on_rails_pro/spec/execjs-compatible-dummy/Gemfile.lock
