fix(deps): move pyjwt and brace-expansion off versions with new advisories

.ash/.ash.yaml

@@ -9,6 +9,93 @@ external_reports_to_include: []
 global_settings:
   severity_threshold: MEDIUM
   suppressions:
+    # === Time-boxed: brace-expansion bundled inside aws-cdk-lib (expires 2026-10-30) ===
+    # Remove when an aws-cdk-lib release bundles brace-expansion >= 5.0.12 and the
+    # lockfiles move to it. Tighten to package-aware matching once ASH supports it.
+    - rule_id: "GHSA-6j4f-fj2g-mc7p-brace-expansion"
+      path: "deploy/cdk/package-lock.json"
+      expiration: "2026-10-30"
+      reason: >-
+        brace-expansion 5.0.9 is bundled inside aws-cdk-lib (inBundle: true in the
+        lockfile). No aws-cdk-lib release ships a fixed copy: 2.272.0, the latest when
+        this was written, still bundles 5.0.9. npm `overrides` cannot rewrite a bundled
+        dependency, so this repository has no way to remove it. Upstream fix:
+        https://github.com/aws/aws-cdk/pull/38929, tracked in
+        https://github.com/aws/aws-cdk/issues/38932. Time-boxed risk acceptance
+        approved by the maintainer.
+        Known limit: the matcher keys on rule id and path only, so this entry covers
+        this advisory for ANY brace-expansion copy in this lockfile, not just the
+        bundled one; a vulnerable copy reintroduced here before expiry would be hidden.
+    - rule_id: "GHSA-qhr7-859c-m2p7-brace-expansion"
+      path: "deploy/cdk/package-lock.json"
+      expiration: "2026-10-30"
+      reason: >-
+        brace-expansion 5.0.9 is bundled inside aws-cdk-lib (inBundle: true in the
+        lockfile). No aws-cdk-lib release ships a fixed copy: 2.272.0, the latest when
+        this was written, still bundles 5.0.9. npm `overrides` cannot rewrite a bundled
+        dependency, so this repository has no way to remove it. Upstream fix:
+        https://github.com/aws/aws-cdk/pull/38929, tracked in
+        https://github.com/aws/aws-cdk/issues/38932. Time-boxed risk acceptance
+        approved by the maintainer.
+        Known limit: the matcher keys on rule id and path only, so this entry covers
+        this advisory for ANY brace-expansion copy in this lockfile, not just the
+        bundled one; a vulnerable copy reintroduced here before expiry would be hidden.
+    - rule_id: "GHSA-q2hr-2g5m-vwhr-brace-expansion"
+      path: "deploy/cdk/package-lock.json"
+      expiration: "2026-10-30"
+      reason: >-
+        brace-expansion 5.0.9 is bundled inside aws-cdk-lib (inBundle: true in the
+        lockfile). No aws-cdk-lib release ships a fixed copy: 2.272.0, the latest when
+        this was written, still bundles 5.0.9. npm `overrides` cannot rewrite a bundled
+        dependency, so this repository has no way to remove it. Upstream fix:
+        https://github.com/aws/aws-cdk/pull/38929, tracked in
+        https://github.com/aws/aws-cdk/issues/38932. Time-boxed risk acceptance
+        approved by the maintainer.
+        Known limit: the matcher keys on rule id and path only, so this entry covers
+        this advisory for ANY brace-expansion copy in this lockfile, not just the
+        bundled one; a vulnerable copy reintroduced here before expiry would be hidden.
+    - rule_id: "GHSA-6j4f-fj2g-mc7p"
+      path: "node_modules/aws-cdk-lib/brace-expansion/package.json"
+      expiration: "2026-10-30"
+      reason: >-
+        brace-expansion 5.0.9 is bundled inside aws-cdk-lib (inBundle: true in the
+        lockfile). No aws-cdk-lib release ships a fixed copy: 2.272.0, the latest when
+        this was written, still bundles 5.0.9. npm `overrides` cannot rewrite a bundled
+        dependency, so this repository has no way to remove it. Upstream fix:
+        https://github.com/aws/aws-cdk/pull/38929, tracked in
+        https://github.com/aws/aws-cdk/issues/38932. Time-boxed risk acceptance
+        approved by the maintainer.
+        Scope: npm-audit reports the bundled copy at this path and every other copy at a
+        different one, so this entry matches only the aws-cdk-lib-bundled copy (in any
+        tree whose aws-cdk-lib bundles it).
+    - rule_id: "GHSA-qhr7-859c-m2p7"
+      path: "node_modules/aws-cdk-lib/brace-expansion/package.json"
+      expiration: "2026-10-30"
+      reason: >-
+        brace-expansion 5.0.9 is bundled inside aws-cdk-lib (inBundle: true in the
+        lockfile). No aws-cdk-lib release ships a fixed copy: 2.272.0, the latest when
+        this was written, still bundles 5.0.9. npm `overrides` cannot rewrite a bundled
+        dependency, so this repository has no way to remove it. Upstream fix:
+        https://github.com/aws/aws-cdk/pull/38929, tracked in
+        https://github.com/aws/aws-cdk/issues/38932. Time-boxed risk acceptance
+        approved by the maintainer.
+        Scope: npm-audit reports the bundled copy at this path and every other copy at a
+        different one, so this entry matches only the aws-cdk-lib-bundled copy (in any
+        tree whose aws-cdk-lib bundles it).
+    - rule_id: "GHSA-q2hr-2g5m-vwhr"
+      path: "node_modules/aws-cdk-lib/brace-expansion/package.json"
+      expiration: "2026-10-30"
+      reason: >-
+        brace-expansion 5.0.9 is bundled inside aws-cdk-lib (inBundle: true in the
+        lockfile). No aws-cdk-lib release ships a fixed copy: 2.272.0, the latest when
+        this was written, still bundles 5.0.9. npm `overrides` cannot rewrite a bundled
+        dependency, so this repository has no way to remove it. Upstream fix:
+        https://github.com/aws/aws-cdk/pull/38929, tracked in
+        https://github.com/aws/aws-cdk/issues/38932. Time-boxed risk acceptance
+        approved by the maintainer.
+        Scope: npm-audit reports the bundled copy at this path and every other copy at a
+        different one, so this entry matches only the aws-cdk-lib-bundled copy (in any
+        tree whose aws-cdk-lib bundles it).
     # === detect-secrets: broad patterns by path (no inline nosec support) ===
     - rule_id: "SECRET-*"
       path: "tests/**"

.ash/.ash_community_plugins.yaml

@@ -10,6 +10,51 @@ external_reports_to_include: []
 global_settings:
   severity_threshold: MEDIUM
   suppressions:
+    # === Time-boxed: brace-expansion bundled inside aws-cdk-lib (expires 2026-10-30) ===
+    # Remove when an aws-cdk-lib release bundles brace-expansion >= 5.0.12 and the
+    # lockfiles move to it. Tighten to package-aware matching once ASH supports it.
+    - rule_id: "CVE-2026-102276"
+      path: "deploy/cdk/package-lock.json"
+      expiration: "2026-10-30"
+      reason: >-
+        brace-expansion 5.0.9 is bundled inside aws-cdk-lib (inBundle: true in the
+        lockfile). No aws-cdk-lib release ships a fixed copy: 2.272.0, the latest when
+        this was written, still bundles 5.0.9. npm `overrides` cannot rewrite a bundled
+        dependency, so this repository has no way to remove it. Upstream fix:
+        https://github.com/aws/aws-cdk/pull/38929, tracked in
+        https://github.com/aws/aws-cdk/issues/38932. Time-boxed risk acceptance
+        approved by the maintainer.
+        Known limit: the matcher keys on rule id and path only, so this entry covers
+        this advisory for ANY brace-expansion copy in this lockfile, not just the
+        bundled one; a vulnerable copy reintroduced here before expiry would be hidden.
+    - rule_id: "CVE-2026-102278"
+      path: "deploy/cdk/package-lock.json"
+      expiration: "2026-10-30"
+      reason: >-
+        brace-expansion 5.0.9 is bundled inside aws-cdk-lib (inBundle: true in the
+        lockfile). No aws-cdk-lib release ships a fixed copy: 2.272.0, the latest when
+        this was written, still bundles 5.0.9. npm `overrides` cannot rewrite a bundled
+        dependency, so this repository has no way to remove it. Upstream fix:
+        https://github.com/aws/aws-cdk/pull/38929, tracked in
+        https://github.com/aws/aws-cdk/issues/38932. Time-boxed risk acceptance
+        approved by the maintainer.
+        Known limit: the matcher keys on rule id and path only, so this entry covers
+        this advisory for ANY brace-expansion copy in this lockfile, not just the
+        bundled one; a vulnerable copy reintroduced here before expiry would be hidden.
+    - rule_id: "CVE-2026-102277"
+      path: "deploy/cdk/package-lock.json"
+      expiration: "2026-10-30"
+      reason: >-
+        brace-expansion 5.0.9 is bundled inside aws-cdk-lib (inBundle: true in the
+        lockfile). No aws-cdk-lib release ships a fixed copy: 2.272.0, the latest when
+        this was written, still bundles 5.0.9. npm `overrides` cannot rewrite a bundled
+        dependency, so this repository has no way to remove it. Upstream fix:
+        https://github.com/aws/aws-cdk/pull/38929, tracked in
+        https://github.com/aws/aws-cdk/issues/38932. Time-boxed risk acceptance
+        approved by the maintainer.
+        Known limit: the matcher keys on rule id and path only, so this entry covers
+        this advisory for ANY brace-expansion copy in this lockfile, not just the
+        bundled one; a vulnerable copy reintroduced here before expiry would be hidden.
     - path: automated_security_helper/schemas/cyclonedx_bom_1_6_schema/__init__.py
       rule_id: API_KEY_OR_SECRET
       reason: "False positive — generated CycloneDX schema definitions contain field names that match secret patterns"

pyproject.toml

@@ -41,6 +41,10 @@ dependencies = [
  # Transitive via pyjwt[crypto] <- mcp[crypto]; pinned to patch GHSA-g6cj-pr64-35w5.
  # >=50.0 keeps that floor: the advisory affects >= 44.0.0, < 50.0.0, so 50.0.0 is the fix.
  "cryptography>=50.0,<51",
+ # Transitive via mcp[crypto]. The floor keeps a resolver from picking 2.13.0, which ten
+ # advisories published 2026-09-29 cover (GHSA-ffc3-869f-jxw9 critical among them); every
+ # one of them is fixed in 2.14.0.
+ "pyjwt>=2.14,<3",
  "uvicorn>=0.53.0,<1",
  "jsonpatch>=1.33,<2",
 ]