fix(16): fail closed on unparseable audit-waiver expiry date

scripts/__tests__/check-audit.test.mjs

@@ -76,6 +76,16 @@ const noExpiryAllowlist = {
   },
 };
 
+// Fixture: allowlist whose expiry date is malformed (typo). Must fail CLOSED —
+// a bad date can never grant an indefinite waiver.
+const malformedExpiryAllowlist = {
+  'GHSA-gv7w-rqvm-qjhr': {
+    reason: 'esbuild dev transitive — not in production runtime',
+    reviewer: 'luc',
+    expires: '2026-13-99',
+  },
+};
+
 test('unwaived High advisory is blocking', () => {
   const blocking = selectBlocking(highUnwaived, emptyAllowlist);
   assert.equal(blocking.length, 1);
@@ -123,4 +133,11 @@ test('isWaived: future expiry waives, past expiry does not, missing entry does n
   assert.equal(isWaived(adv, expiredAllowlist), false); // past expiry
   assert.equal(isWaived(adv, noExpiryAllowlist), true); // no expiry → indefinite waive
   assert.equal(isWaived(adv, emptyAllowlist), false); // not listed
+  assert.equal(isWaived(adv, malformedExpiryAllowlist), false); // unparseable expiry → fail closed
+});
+
+test('malformed expiry fails closed — High advisory re-blocks', () => {
+  const blocking = selectBlocking(highWaived, malformedExpiryAllowlist);
+  assert.equal(blocking.length, 1);
+  assert.equal(blocking[0].github_advisory_id, 'GHSA-gv7w-rqvm-qjhr');
 });