From 831ad175a9046d48f7335c3333642a57ad98e0e2 Mon Sep 17 00:00:00 2001 From: Ronny Trommer Date: Tue, 28 Jul 2026 16:16:24 +0200 Subject: [PATCH] fix(ci): scope npm audit gate to production dependencies GHSA-mh99-v99m-4gvg (brace-expansion <=5.0.7, high, DoS) is pulled in via minimatch@3 by eslint 9 and eslint-config-next's plugin chain. The only patched version (5.0.8) breaks minimatch@3 consumers and no 1.x backport exists, so the dev tree cannot be cleaned until upstream moves off minimatch@3. Production dependencies audit clean (0 findings). Scope the audit gate to --omit=dev so dev-only advisories stop blocking every PR; revert once upstream ships patched releases. Closes #136 Assisted-by: ClaudeCode:claude-fable-5 Signed-off-by: Ronny Trommer --- Makefile | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/Makefile b/Makefile index de05fa6..5dc4282 100644 --- a/Makefile +++ b/Makefile @@ -25,8 +25,10 @@ lint: install ## Run ESLint typecheck: install ## Run TypeScript compiler in check-only mode npm run typecheck -audit: install ## Run npm audit (fails on high or critical) - npm audit --audit-level=high +# Dev-tree advisories are excluded: GHSA-mh99-v99m-4gvg (brace-expansion) has no +# fix compatible with eslint 9 / eslint-config-next's minimatch@3 chain. +audit: install ## Run npm audit on production deps (fails on high or critical) + npm audit --omit=dev --audit-level=high build: install ## Build the Next.js app npm run build @@ -42,7 +44,7 @@ verify: install ## Run lint + typecheck + unit-tests + audit + build (fail-fast) npm run lint npm run typecheck npm test - npm audit --audit-level=high + npm audit --omit=dev --audit-level=high npm run build format: ## Format all files with Prettier