fix(16): fail closed on unparseable audit-waiver expiry date

scripts/__tests__/check-audit.test.mjs

@@ -76,6 +76,16 @@ const noExpiryAllowlist = {
   },
 };
 
+// Fixture: allowlist whose expiry date is malformed (typo). Must fail CLOSED —
+// a bad date can never grant an indefinite waiver.
+const malformedExpiryAllowlist = {
+  'GHSA-gv7w-rqvm-qjhr': {
+    reason: 'esbuild dev transitive — not in production runtime',
+    reviewer: 'luc',
+    expires: '2026-13-99',
+  },
+};
+
 test('unwaived High advisory is blocking', () => {
   const blocking = selectBlocking(highUnwaived, emptyAllowlist);
   assert.equal(blocking.length, 1);
@@ -123,4 +133,11 @@ test('isWaived: future expiry waives, past expiry does not, missing entry does n
   assert.equal(isWaived(adv, expiredAllowlist), false); // past expiry
   assert.equal(isWaived(adv, noExpiryAllowlist), true); // no expiry → indefinite waive
   assert.equal(isWaived(adv, emptyAllowlist), false); // not listed
+  assert.equal(isWaived(adv, malformedExpiryAllowlist), false); // unparseable expiry → fail closed
+});
+
+test('malformed expiry fails closed — High advisory re-blocks', () => {
+  const blocking = selectBlocking(highWaived, malformedExpiryAllowlist);
+  assert.equal(blocking.length, 1);
+  assert.equal(blocking[0].github_advisory_id, 'GHSA-gv7w-rqvm-qjhr');
 });

scripts/check-audit.mjs

@@ -37,8 +37,13 @@ const BLOCKING_SEVERITIES = new Set(['high', 'critical']);
 export function isWaived(adv, allowlist) {
   const w = allowlist[adv.github_advisory_id];
   if (!w) return false;
-  // No expiry or future expiry → waived; past (or equal) expiry → NOT waived (re-blocks).
+  // No expiry → waived; future expiry → waived; past/equal expiry → NOT waived.
-  if (w.expires && Date.parse(w.expires) <= Date.now()) return false;
+  // An unparseable `expires` (typo) fails CLOSED: treated as expired so a malformed
+  // date can never grant an indefinite waiver (same failure class as CR-01).
+  if (w.expires) {
+    const ts = Date.parse(w.expires);
+    if (Number.isNaN(ts) || ts <= Date.now()) return false;
+  }
   return true;
 }