security: 3 high-severity Dependabot alerts on default branch, gh api read returns empty

[kyle-sexton]

Context

While pushing a work-loop branch (fix/324-review-trigger-gate-contract), git push reported:

"GitHub found 3 vulnerabilities on melodic-software/claude-code-plugins's default branch (3 high). To find out more, visit: https://github.com/melodic-software/claude-code-plugins/security/dependabot"

Attempted to check gh api repos/melodic-software/claude-code-plugins/dependabot/alerts from this session and got an empty result -- either the bound token lacks the security_events/Dependabot read scope, or there is a repo-setting gap. Either way this session cannot itself confirm or triage the 3 alerts, and this is unrelated to any of the work-loop items in flight, so filing rather than fixing.

Proposed work

• Check the Dependabot alerts tab directly (https://github.com/melodic-software/claude-code-plugins/security/dependabot) or fix the token/permission gap that made gh api .../dependabot/alerts return empty despite git push reporting 3 high-severity findings.
• Triage and remediate (or dismiss with rationale) the 3 high-severity alerts.

Acceptance criteria

• The 3 high-severity Dependabot alerts are identified by name/package.
• Each is remediated (dependency bump) or dismissed with a recorded reason.
• If the gh api read gap was a token/scope issue rather than zero-alerts, note the fix for future automated checks.

References

• Surfaced during PR fix(source-control): narrow review-trigger gate contract to pending #1392 (issue fix(source-control): reconcile review-trigger 'pending or failing' gate contract with pending-only code #324) push, by /work-items:work-loop orchestration.

Metadata

Work-class: unclassified -- self-filed raw intake, security-surface, routing left to triage. Path/topic hard gate applies (security-critical surface) -- this is filed, not worked, by this lane. 🤖

[kyle-sexton]

This was generated by AI during triage.

Verified — the alerts were real, and are already remediated.

Role-label resolution note: .work-item-tracker.json has no config.role_labels entry, so this session used the documented defaults (agent-ready / needs-human) — flagging per the taxonomy's loud-warning requirement.

What I checked:

• gh api repos/melodic-software/claude-code-plugins/dependabot/alerts (no state filter, same form quoted in this issue) returns 7 alerts, 0 currently open — 6 fixed, 1 dismissed. This session's token carries only repo scope (no security_events); that's sufficient here because the repo is public. security_and_analysis.dependabot_security_updates is enabled on the repo.
• The 3 high-severity alerts matching this report's "3 high" count are alerts feat(hook-telemetry): marketplace-wide telemetry contract + markdown-formatter producer #5, perf(markdown-formatter): unwired producer builds telemetry payload before the opt-in guard (~90ms/edit on Windows) #6, docs(playbook): document the local plugin development loop #7 (brace-expansion DoS, postcss path traversal ×2), created_at 2026-07-25T17:32:48Z, fixed_at 2026-07-25T20:48:26Z-20:48:37Z.
• Root cause of fixed: Dependabot's own auto-generated PRs build: bump brace-expansion from 5.0.7 to 5.0.8 in /plugins/ai-briefing/skills/generate/output/build #1373, build: bump postcss from 8.5.17 to 8.5.23 in /plugins/miro #1374, build: bump postcss from 8.5.17 to 8.5.23 in /plugins/knowledge/skills/youtube-digest/extraction #1375 (bumping brace-expansion 5.0.7->5.0.8, postcss 8.5.17->8.5.23 in two manifests) were squash-merged to main at 20:48:26Z-20:48:33Z - 6-11 minutes before this issue was filed (20:54:58Z). Merge commits 6d343c82, 3a66476b, eab6d9bc confirmed on origin/main.

On the "gh api read returns empty" claim: I could not reproduce it and could not determine its cause. My session's identical bare command (no state filter) returns all 7 alerts including the 3 fixed ones, so a post-fix query in that exact form should have shown 3 fixed alerts, not an empty array - the timing race doesn't fully explain an empty result, only a non-open one. No token/scope/repo-setting gap is evident from the current state (public repo, repo scope sufficient, Dependabot security updates enabled). Filing this as unresolved-but-unreproducible rather than asserting a cause I can't back with evidence.

Acceptance criteria status:

• The 3 high-severity alerts are identified: brace-expansion (GHSA-mh99-v99m-4gvg, alert feat(hook-telemetry): marketplace-wide telemetry contract + markdown-formatter producer #5), postcss (GHSA-r28c-9q8g-f849, alerts perf(markdown-formatter): unwired producer builds telemetry payload before the opt-in guard (~90ms/edit on Windows) #6, docs(playbook): document the local plugin development loop #7).
• Each is remediated via merged dependency-bump PRs build: bump brace-expansion from 5.0.7 to 5.0.8 in /plugins/ai-briefing/skills/generate/output/build #1373, build: bump postcss from 8.5.17 to 8.5.23 in /plugins/miro #1374, build: bump postcss from 8.5.17 to 8.5.23 in /plugins/knowledge/skills/youtube-digest/extraction #1375 - no dismissal needed.
• Token/scope root cause for the empty read: not confirmed either way (see above) - no fix to note since no gap was reproduced.

Closing as completed. The remediation work this issue asked for already landed via #1373/#1374/#1375 before triage began. If the empty-read tooling gap recurs, please attach the exact command and token/environment details from that session so it can be reproduced.