You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
chore(ci): exclude encodeurl@2.0.2 from the site template trust policy - #12947
The Supply Chain - Site Template @latest and @canary jobs fail on main and on every PR (for example @latest and @canary):
High-risk trust downgrade for "encodeurl@2.0.2" (possible package takeover)
encodeurl@3.0.0 was published with npm trusted publishing, then 2.0.2 was published by hand from the 2.x branch. pnpm's trustPolicy: no-downgrade compares releases by publish date, so it flags 2.0.2. I reviewed the release: it is legitimate (see below). This PR adds it to the trustPolicyExclude list of the Site Template job, like the existing entries. A TODO comment links the upstream issue, to remove the entry once it is closed.
Review of encodeurl 2.0.2 (and 1.0.3)
Tarballs downloaded and read as data, never installed. Their sha512 matches the registry dist.integrity.
2.0.1 → 2.0.2 only changes one regex in index.js (ENCODE_CHARS_REGEXP, capped at {1,1024} runs to bound RegExp stack use) and the version.
No install scripts (only lint/test), no new files, no require, process, fs, network, child_process or eval, no obfuscated code.
No @docusaurus/* package depends on encodeurl directly. It only comes in through webpack-dev-server (v5 for @latest, v6 for @canary) → express 4/5 → send, serve-static and finalhandler, which require encodeurl~2.0.0 / ^2.0.0. v3 is ESM-only and only exports a named encodeUrl, while they call require('encodeurl')(url), so overriding it to v3 would break them.
Possible follow-up
The monorepo job passes because the lockfile pins encodeurl@2.0.0. Once the lockfile moves to 2.0.2, the root pnpm-workspace.yaml might need the same trustPolicyExclude entry.
Test Plan
CI: the Supply Chain - Site Template jobs pass on this PR.
No actionable comments were generated in the recent review.
Walkthrough
The supply-chain workflow adds encodeurl@2.0.2 to the site-template dependency installation’s trustPolicyExclude list. A comment links the exclusion to issue 43. Install retries and the subsequent build remain unchanged.
This is a small CI-only change that excludes one package version from the supply-chain trust policy check so the Site Template jobs can pass. It does not alter shipped code, and no merge-blocking risk was found.
Pre-merge checks: 4
Check name
Status
Explanation
Description Check
Check skipped - CodeRabbit’s high-level summary is enabled.
Title check
The title names the change accurately: the PR adds encodeurl@2.0.2 to the site template job's trustPolicyExclude list. The diff is a single added line in .github/workflows/security-supply-chain.yml, a…
Linked Issues check
Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check
Check skipped because no linked issues were found for this pull request.
Full details: Title check
Explanation
The title names the change accurately: the PR adds encodeurl@2.0.2 to the site template job's trustPolicyExclude list. The diff is a single added line in .github/workflows/security-supply-chain.yml, and the PR objectives describe the same exclusion to fix the no-downgrade failures. The title is specific and follows the conventional-commit style. The 'chore(ci)' prefix is accurate for a CI workflow change.
Finishing Touches
Generate unit tests (beta)
Commit to this branch
Create a new PR
Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
File: No configuration file from this repository applied
Commit: Unavailable
Layers: defaults
Review profile: CHILL
Plan: Advanced
Run ID: 0edfd1e6-76b0-4f8b-8270-9b95f126a74c
Commits
Reviewing files that changed from the base of the PR and between c00f04e and dffb04f.
Files selected for processing: 1
.github/workflows/security-supply-chain.yml
Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 8 remain after this review.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
CLA SignedSigned Facebook CLApr: maintenanceThis PR does not produce any behavior differences to end users when upgrading.
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Motivation
The
Supply Chain - Site Template @latestand@canaryjobs fail onmainand on every PR (for example @latest and @canary):encodeurl@3.0.0was published with npm trusted publishing, then2.0.2was published by hand from the2.xbranch. pnpm'strustPolicy: no-downgradecompares releases by publish date, so it flags 2.0.2. I reviewed the release: it is legitimate (see below). This PR adds it to thetrustPolicyExcludelist of the Site Template job, like the existing entries. A TODO comment links the upstream issue, to remove the entry once it is closed.Review of encodeurl 2.0.2 (and 1.0.3)
dist.integrity.index.js(ENCODE_CHARS_REGEXP, capped at{1,1024}runs to bound RegExp stack use) and the version.lint/test), no new files, norequire,process, fs, network,child_processoreval, no obfuscated code.v2.0.2tag (f805c3e, a GitHub-verified commit on2.x), from the merged backport Backport encoding regex pillarjs/encodeurl#41 of Fix encoding of a "%" next to a valid sequence or at the end pillarjs/encodeurl#40.1.x(Backport encoding regex pillarjs/encodeurl#42), also identical to its tag. Our templates don't pull it.Why not upgrade to encodeurl v3?
No
@docusaurus/*package depends onencodeurldirectly. It only comes in throughwebpack-dev-server(v5 for@latest, v6 for@canary) → express 4/5 → send, serve-static and finalhandler, which requireencodeurl~2.0.0/^2.0.0. v3 is ESM-only and only exports a namedencodeUrl, while they callrequire('encodeurl')(url), so overriding it to v3 would break them.Possible follow-up
The monorepo job passes because the lockfile pins
encodeurl@2.0.0. Once the lockfile moves to 2.0.2, the rootpnpm-workspace.yamlmight need the sametrustPolicyExcludeentry.Test Plan
CI: the
Supply Chain - Site Templatejobs pass on this PR.Related issues/PRs
docusaurus serveserves the nearest 404.html, like localized 404 pages #12946🤖 Generated with Claude Code
Summary by CodeRabbit