The commit that fixed my only security advisory failed its security audit. The audit never ran.
On 4 September I cut two releases of safari-mcp ten minutes apart. The second one exists because of a mistake in the first, and its CI run went red for a reason that had nothing to do with either. Here is the sequence, because the order is the point. Release one: shipped with the alerts open v2.18.0 was a real release: receipts that survive a reconnect, screenshot downscaling, a queue for parked…
On September 4th, two releases of safari-mcp were cut just minutes apart. The second release's CI run failed due to a mistake in the first release. The CI run for the second release tested production dependencies using npm audit with a high severity threshold, and the audit endpoint was unreachable causing the step to fail. The release was still published to npm before the CI run finished.
After the incident, the CI run was modified to allow each Node version to report its own result and for the audit step to differentiate between the two failure modes: no audit ran or the audit could not run at all. The release still does not wait for CI on its own commit, which is a larger change to the workflow that the author is not prepared to make.
The question remains whether to fail the build when an external service is down or skip the check and mark it as unknown.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
