Hard-gate bun audit in CI; pin patched postcss + mdast-util-to-hast

[lwwmanning]

Summary

Adds a hard bun audit gate to CI plus a dependency-review-action PR-only job, and resolves the two transitive advisories that have a published fix:

Triage (3 advisories at branch time):

Advisory	Severity	Disposition
GHSA-qx2v-qp2m-jg93 (postcss <8.5.10, XSS in CSS stringify)	moderate	Override to 8.5.10
GHSA-4fh9-h7wg-q85m (mdast-util-to-hast <13.2.1, XSS via class attr)	moderate	Override to ^13.2.1
GHSA-w5hq-g745-h8pq (uuid <14.0.0, buffer bounds in v3/v5/v6 with buf)	moderate	Ignore + document

• postcss has two transitive resolutions (next@16.2.4 pins 8.4.31; @tailwindcss/postcss@4.2.3 pulls ^8.5.6). overrides.postcss = "8.5.10" dedupes to the patched version.
• mdast-util-to-hast is reached via three independent paths (shiki/rehype-pretty-code, react-markdown, velite/@mdx-js/mdx), all accepting ^13.0.0. overrides.mdast-util-to-hast = "^13.2.1" lifts every resolution to the patched version.
• uuid comes only from resend@6.12.2 → svix@1.90.0 → uuid@^10.0.0. svix's stated range ^10.0.0 doesn't admit a 14.x override without risking parent CJS imports. Vortex's exposure is theoretical (the /api/subscribe endpoint uses Resend's send-email, not svix's webhook-signing path; the vulnerable v3/v5/v6-with-buf code isn't called). Documented in CLAUDE.md with a removal trigger; CI is gated with --ignore=GHSA-w5hq-g745-h8pq.

ci.yml changes

• New Dependency audit step at the end of the ci job: bun audit --ignore=GHSA-w5hq-g745-h8pq with no continue-on-error.
• New dependency-review job (PR-only) using actions/dependency-review-action@v4.9.0 with fail-on-severity: high and comment-summary-in-pr: on-failure. Stays continue-on-error: true until a baseline of acceptable license/severity findings is established — different gate from bun audit.

Other

• Added CLAUDE.md section "Audit advisories" with one entry per GHSA + removal trigger.
• Added .claude to .gitignore (matches the sibling Bun + Biome sites' convention; was previously letting harness-generated .claude/settings.local.json leak into biome check output).

Verification

$ bun audit --ignore=GHSA-w5hq-g745-h8pq
$ echo $?
0
$ bun pm ls --all | grep -E '^(├── )?(postcss|mdast-util-to-hast)@'
├── mdast-util-to-hast@13.2.1
├── postcss@8.5.10
$ bun run build
✓ Generating static pages (12/12)

Test plan

• CI green (lint, build, typecheck, verify, audit, dependency-review)
• bun audit step exits 0 in the green run
• dependency-review job runs (PR-only) and posts no comment (no high-severity findings expected)
• Browser smoke on Vercel preview: /blog/<slug> MDX still renders correctly (Shiki syntax highlighting works), confirming the mdast-util-to-hast bump is API-compatible

Removal triggers (future cleanup)

• Drop overrides.postcss after next + @tailwindcss/postcss ship releases that pull their transitive postcss to ≥ 8.5.10.
• Drop overrides.mdast-util-to-hast after parents (most likely shiki) ship releases that pull a patched version directly.
• Drop --ignore=GHSA-w5hq-g745-h8pq after svix (or resend) ships a release that bumps uuid to ≥ 14.0.0.

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
vortex	Ready	Preview, Comment	May 4, 2026 6:43pm