fix(deps): align frozen next major and clear npm audit - #130
Merged
Conversation
next moved to 16.2.12 on main, but the frozen dependency guard still declared major 15. The guard rejects a mismatch in either direction, so every open pull request failed the compliance job even though none of them touched next. Align the canonical baseline with the version actually shipped on main.
npm audit --audit-level=high failed on main and therefore on every open pull request. Five advisories were involved, all reachable only through transitive dependencies: - postcss below 8.5.18, path traversal via sourceMappingURL - sharp below 0.35.0, inherited libvips CVEs - valibot below 1.4.2, flatten() throwing on inherited property names - find-my-way below 9.7.0, HTTP2 denial of service - brace-expansion below 5.0.8, denial of service via unbounded expansion The brace-expansion 1.x line has no fixed release for the unbounded expansion advisory, so the override lifts the whole tree to 5.x. That release still ships a CommonJS build, so minimatch 3.x keeps resolving it. Lint, typecheck, unit tests and next build were all run against the resulting tree. npm audit now reports zero vulnerabilities.
WhiteMuush
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Context
The three open Dependabot pull requests (#127, #128, #129) all failed the same two checks,
complianceandDependency audit. Neither failure was caused by those pull requests: both were inherited frommain, where theSecurityworkflow had already failed twice in a row.This branch fixes the root cause so the Dependabot pull requests can go green on rebase.
Frozen dependency guard
mainrunsnext16.2.12 since #126, butcheck-frozen-deps.mjsstill declared major 15 as canonical. The guard deliberately rejects a mismatch in either direction, including once the major has already landed on the baseline branch, so every pull request failedcomplianceregardless of its content.The baseline is now aligned with the version actually shipped.
next16 is treated as intended.Dependency audit
npm audit --audit-level=highreported nine findings coming from five advisories, all in transitive dependencies:^8.5.23^0.35.3^1.4.2^9.7.0^5.0.8npm audit fixwas tried first and made things worse, cascading into theminimatchchain, so targeted overrides were used instead.The
brace-expansion1.x line has no fixed release for the unbounded expansion advisory, so the override lifts the whole tree to 5.x. That release still publishes a CommonJS build underexports.require, sominimatch3.x keeps resolving it.npm auditnow reports zero vulnerabilities.Verification
Run locally against the resulting tree:
npm run lint, cleannpx tsc --noEmit, cleannpm test, 152 tests across 28 files passednpm run build, succeedednpm audit --audit-level=high, zero vulnerabilitiesFollow-up
Once this lands, the three Dependabot pull requests need a rebase before merge.