[ExcelDsigN-tech]

Overview

Security Gates fails on every PR. Two causes: cargo install cargo-audit pulls 0.22.2+, which needs rustc 1.88 while the job pins 1.85.0; and npm audit --audit-level=high finds high-severity advisories in backend and frontend. This PR pins cargo-audit and patches the npm advisories.

No linked issue.

Feature Summary

• cargo-audit job installs 0.22.1 and uses a versioned cache key
• toml override bumped 4.3.0 to 5.0.1 in backend, frontend and scripts
• frontend override zod 4.6.7 (@serwist 9.5.13 pins vulnerable 4.6.5)
• lockfiles refreshed with npm audit fix --ignore-scripts (no --force)

Technical Implementation

• .github/workflows/security-gates.yml: cargo install cargo-audit --version 0.22.1 --locked, cache key cargo-audit-0.22.1-${{ runner.os }} so the old unpinned binary is not restored.
• backend still had one high finding after npm audit fix: brace-expansion@1.1.18 via eslint-plugin-import > minimatch@3. npm update brace-expansion moved it to 1.1.21, which satisfies minimatch's ^1.1.7, so no override was needed.
• Remaining low/moderate findings only clear with --force (breaking upgrades) and are left for a follow-up.
• No runtime code changes. No migrations, redeploys or env vars.

Test Coverage

• npm audit --audit-level=high exits 0 in backend, frontend and scripts
• ./scripts/ci-local.sh supply scripts backend frontend: all areas passed (backend 1217 tests, frontend 293 tests, frontend build and bundle budget pass)

Checklists

General

• Ran ./scripts/ci-local.sh <area> and it passes
• Tests added or updated for the change (dependency-only change)
• No skipped tests, removed assertions or raised limits
• Docs updated if behaviour changed (no behaviour change)
• Conventional Commits title and messages
• Security-sensitive change: .github/THREAT_MODEL.md attached and maintainer review requested

[coderabbitai]

Important

• Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 50107d64-ff56-4ce8-b42f-1f83da2efe95

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Tip

🎯 Customize your risk assessments

Guide how CodeRabbit assesses merge risk and security architecture risk. Highlight sensitive changes and explain your security boundaries using Merge Risk Instructions and Security Risk Instructions in your review settings. Security architecture risk assessments require the Advanced plan or above.

✅ Automatic approvals, with your rules

Let CodeRabbit approve pull requests once required threads are resolved, pre-merge checks pass, and your risk limits are met. Enable Automatic approvals in review settings, with overrides for teams or file paths.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn