ci: unpin the registry for the audit's advisory API, and clear the advisory it finds

[netanelgilad]

The Security Audit job has failed on every run for three weeks, on main and on every PR. It was not reporting clean and it was not reporting a vulnerability: it was not reporting at all.

npm warn audit 400 Bad Request - POST https://registry.npmjs.org/-/npm/v1/security/audits/quick
{ statusCode: 400, error: 'Bad Request', message: 'Invalid request payload JSON format' }
npm error audit endpoint returned an error

Two commits: the first makes the gate report again, the second clears what it then reports.

1. Why the gate stopped reporting

.github/actions/wix-gateway-proxy pins registry.npmjs.org in /etc/hosts, which routes the entire host through the embargo gateway, npm's advisory API included. npm POSTs to /-/npm/v1/security/advisories/bulk first and falls back to the retired /-/npm/v1/security/audits/quick when that fails, logging the first error only at --loglevel silly so it never appears. The fallback then 400s and the job exits 1 before reading a single advisory.

#247 called this out in advance: "security-audit.yml runs npm audit, which POSTs to the registry's bulk-advisory endpoint through the pinned gateway. If the gateway doesn't proxy that endpoint, the weekly audit will fail loudly."

Timeline, from the workflow's run history:

Run	Date	Result
201	3 Aug	success (last green)
—	12 Aug	gateway lands (#248)
203	16 Aug	failure (first run after)
204-261	16 Aug - 6 Sep	failure, all of them, identically

Not an npm-version problem: the audit code in npm 10.8.2 (this runner) and 10.9.7 is byte-identical (prepareBulkData and _getReport both diff clean), and the same command against the public registry resolves the bulk endpoint and reports normally. A Node 24 bump does not fix it.

The fix drops the /etc/hosts pin after npm ci, so only the audit steps resolve the registry publicly. This does not weaken the embargo: auditing downloads no package code, and npm ci is the only step in this job that fetches tarballs, so every byte that reaches disk still comes through the gateway, in the same order, from the same lockfile. .github/scripts/check_wix_proxy_steps.py enforces that the action runs as step 2 of every job, which it still does.

2. What it then reported

With the endpoint reachable, the gating step immediately found a high-severity advisory that had been sitting on main invisibly for the whole outage:

socket.io-parser  4.0.0 - 4.2.6
Severity: high
Socket.IO: Zero-attachment Memory Exhaustion — GHSA-2m8v-j782-fhvr

It arrives via socket.io-client, a production dependency, so --omit=dev does not skip it — and it ships to consumers of the SDK, where it lands in their own scans.

socket.io-client@4.8.3 declares socket.io-parser: ~4.2.4, so 4.2.7 is already in range. The second commit refreshes that one lockfile entry: no package.json change, no range change, no new package, three lines in a single entry.

Verified rather than assumed:

• The tarball's sha512 was computed locally and matches the integrity the lockfile now records, so the hash is not just the registry's own claim
• 4.2.7 was published 2026-07-15, 54 days ago, well past the 14-day min-release-age cooldown in .npmrc (npm 10.x ignores that setting, so the age was checked by hand rather than left to the resolver)
• The resolved URL stays on registry.npmjs.org, as do all 394 entries

Verification

Check	Result
check_wix_proxy_steps.py	verified 8 of 8 jobs
test_check_wix_proxy_steps.py	11 tests, OK
npm ci	installs socket.io-client@4.8.3 → socket.io-parser@4.2.7
npm run lint	clean
npm test	286 passed (24 files)
npm audit --omit=dev --audit-level=high	0 vulnerabilities, exit 0

The intermediate commit is genuinely useful history here: CI on it shows the failure message changing from audit endpoint returned an error to a real advisory report, which is the proof the unpin works, independently of the dependency fix. Each commit is revertable on its own.

Not fixed here

The informational all-deps step (continue-on-error: true, does not gate) now reports 7 high advisories in dev dependencies — brace-expansion, browserslist, js-yaml, linkify-it, nanoid, postcss, @humanfs/node. These accumulated unseen during the outage and are the first thing anyone has been able to see about them in three weeks. Left for their own change rather than widening this one.

Follow-up

Reported to the embargo gateway owners. The durable fix is theirs: proxy POST /-/npm/v1/security/* faithfully (preserving Content-Encoding: gzip, which npm sets on both audit requests) or pass those paths through. The gateway does forward these POSTs upstream today — the 400 and the retirement notice both come from npm itself — so the body is arriving mangled rather than being refused by policy. The unpin step comes out once that lands; the comment in the workflow says so.

Worth knowing for triage: javascript-sdk is the only repo of the twelve in this org's set that runs npm audit in CI at all, so nobody else will report this and it will likely be triaged low.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Sw4VYAkAmuJkff162j1hbv

[github-actions]

🚀 Package Preview Available!

---

Install this PR's preview build with npm:

npm i @base44-preview/sdk@0.8.46-pr.278.d5b4fe4

Prefer not to change any import paths? Install using npm alias so your code still imports @base44/sdk:

npm i "@base44/sdk@npm:@base44-preview/sdk@0.8.46-pr.278.d5b4fe4"

Or add it to your package.json dependencies:

{
  "dependencies": {
    "@base44/sdk": "npm:@base44-preview/sdk@0.8.46-pr.278.d5b4fe4"
  }
}

• 📦 Preview Package: @base44-preview/sdk@0.8.46-pr.278.d5b4fe4
• 🔗 View this commit on GitHub

---

_{Preview published to npm registry — try new features instantly!}