fix: resolve 17 dependency CVEs flagged by Vanta

[liliwilson]

Summary

Clears all 17 overdue Vanta findings on the setup-sentry-cli code repository (SLA deadline 2026-09-07, first detected 2026-08-24). All 17 are HIGH severity and all are transitive — this repo declares only three direct runtime dependencies.

Only 1 of the 17 is runtime-reachable. tsup is configured with noExternal: [/.*/], so runtime deps are bundled into the shipped dist/main.js; the other 14 packages are build tooling that never ships.

Package	Before	After	Reachability	CVEs
undici	5.28.3	6.28.1	runtime (bundled)	CVE-2026-2229, CVE-2026-1526, CVE-2026-12151
lodash	4.17.21	4.18.1	build only	CVE-2026-4800
braces	3.0.2	3.0.3	build only	CVE-2024-4068
glob	10.3.10	10.5.0	build only	CVE-2025-64756
minimatch	3.1.2 / 7.4.6 / 9.0.3	3.1.3 / 7.4.8 / 9.0.7	build only	CVE-2026-27903 (×3)
js-yaml	3.14.1	3.15.1	build only	CVE-2026-59869, GHSA-5p4m-2wfm-xmqj
postcss	8.4.35	8.5.18	build only	CVE-2026-45623, CVE-2026-73646
rollup	4.12.0	4.59.0	build only	CVE-2024-47068, CVE-2026-27606
brace-expansion	1.1.11 / 2.0.1	1.1.16 / 2.1.2	build only	CVE-2026-13149 (×2)

Approach: overrides, not direct-dependency bumps

Every vulnerable package is transitive, so the fix is a pnpm.overrides block rather than manifest bumps. Two constraints drove the exact pins:

undici is capped at the 6.x line deliberately. @actions/http-client@2.2.0 requests undici@^5.25.4, and the 5.x line tops out at 5.29.0 — still inside the < 6.24.0 vulnerable range, so no 5.x release fixes this. Reaching a patched version requires an override. undici 7+ is ESM-only, and this action builds CJS (format: ['cjs'], runs: node24), so 6.28.1 is the newest version that is both patched and CJS-consumable.

I first tried bumping @actions/core/io/tool-cache to latest (3.x/3.x/4.x) instead — that pulls @actions/http-client@4 → undici@^6.23.0 and would be the cleaner fix. It does not work here: those versions are ESM-only and tsc --noEmit fails with 5× TS1479 ("CommonJS module whose imports will produce require() calls; the referenced file is an ECMAScript module"). Migrating the action to ESM is a real change with its own risk, so it is left out of a security patch. That upgrade is the natural follow-up and would let the undici override be dropped.

minimatch, brace-expansion, glob and js-yaml are pinned per major line, because three different consumers need three different majors and a blanket >= override crosses breaking boundaries. A first attempt with unbounded minimatch: ">=9.0.7" resolved everything to 10.2.6 and broke pnpm depcheck with TypeError: (0, _minimatch.default) is not a function — minimatch 10 dropped the default export that depcheck@1.4.7 relies on. Per-major pins (minimatch@3 → 3.1.3, minimatch@7 → 7.4.8, minimatch@9 → 9.0.7) keep every consumer on a compatible API.

Exact versions rather than ranges keep this reproducible and prevent silent drift back across a major boundary.

Verification

pnpm@8 was used throughout so pnpm-lock.yaml stays at lockfileVersion: '6.0' — CI pins pnpm/action-setup@v3 to version 8, and a v9 lockfile would break pnpm install --frozen-lockfile.

• All four CI checks pass: typecheck, lint, depcheck, build.
• pnpm install --frozen-lockfile → "Lockfile is up to date".
• Confirmed against baseline: depcheck and typecheck pass on unmodified main, so no pre-existing failure is being masked.
• Parsed the lockfile and asserted every one of the 17 findings resolves at or above its fixed version — all pass, nothing vulnerable remains.
• End-to-end run of the rebuilt bundle (the real undici 6 / http-client 2.2.0 compatibility risk): node dist/main.js with INPUT_VERSION=2.57.0 downloaded sentry-cli through @actions/tool-cache, installed it, and the binary reports sentry-cli 2.57.0. GITHUB_ENV received SENTRY_URL/SENTRY_ORG/SENTRY_PROJECT and GITHUB_PATH the install dir.

dist/main.js is rebuilt and committed, since that is the artifact the action actually runs.

Notes for the reviewer

• Vanta will not clear these findings until it rescans the repo after merge.
• Unrelated but worth flagging: the integration CI job targets ubuntu-20.04, macos-11, macos-12 and windows-2019 runners, all of which GitHub has retired — that job cannot currently run. Not addressed here.

🤖 Generated with Claude Code

[liliwilson]

On the red CodeQL check

The failing CodeQL check is not a regression from this PR — it is misattributed. Both open alerts predate this branch:

Alert	Rule	Created	Commit
#2 high	js/weak-cryptographic-algorithm	2026-08-24	8ae49c7
#1 medium	js/overly-large-range	2026-08-24	8ae49c7

8ae49c7 is the current head of main, not this branch's 8b02fc0, and both alert instances are recorded against refs/heads/main. CodeQL says as much in its own summary: "Alerts not introduced by this pull request might have been detected because the code changes were too large." The regenerated dist/main.js is a ~30k-line diff, which trips that threshold.

Alert #2 (weak-cryptographic-algorithm on uid) comes from uuid@8.3.2, pulled in by @actions/core — git diff main...HEAD -- pnpm-lock.yaml shows no change to uuid, so this PR neither introduces nor moves it. Both alerts are worth fixing, but separately from this security patch.

Heads-up: tests.yml does not run on this repo

Worth knowing when reviewing, because it changes what the green checks mean here. .github/workflows/tests.yml exists but is not registered with Actions:

$ gh api repos/warpdotdev/setup-sentry-cli/actions/workflows
CodeQL   dynamic/github-code-scanning/codeql   active

That is the only workflow. This repo is a fork, and GitHub disables forked workflows until someone explicitly enables them — so typecheck, lint, depcheck and the integration matrix have never run here, on this PR or on main. The CodeQL entry comes from default setup (event: dynamic), not from a workflow file.

So the verification in the PR description is the only verification these changes have. All four checks were run locally against pnpm@8 (matching the pinned CI version), plus an end-to-end run of the rebuilt bundle. I also confirmed depcheck and typecheck pass on unmodified main first, so nothing pre-existing is being masked.

Separately, the integration job targets ubuntu-20.04, macos-11, macos-12 and windows-2019 — all retired runners — so enabling the workflow as-written would need those bumped first.

🤖 Generated with Claude Code