Fix expired npm audit exception (#279)

Author: Widthdom

CHANGELOG.md

@@ -15,6 +15,10 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 
 - **Report sample synchronization is regression-tested** — Added `GoldenReportSampleConsistencyTests` to compare the ordered configured-normalization tables in both checked-in Markdown and HTML samples with the complete `creator-default` profile plus the sample-only overlap-warning value. The testing guide now distinguishes this cross-artifact consistency check from the structural and generation-determinism coverage in `GoldenFileSnapshotTests`. Affected: `FolderDiffIL4DotNet.Tests/Services/GoldenReportSampleConsistencyTests.cs`, `doc/TESTING_GUIDE.md`. Tests: `MarkdownNormalizationTable_MatchesCreatorDefaultProfile`, `HtmlNormalizationTable_MatchesCreatorDefaultProfile`.
 
+#### Fixed
+
+- **Expired npm audit exception no longer blocks CI** — Removed the expired `GHSA-mh99-v99m-4gvg` exception after the locked Jest dependency graph began selecting patched `brace-expansion` releases through the existing overrides. The CI configuration test now requires the npm exception list to remain empty, and the testing guide records that there are no active npm audit exceptions. Affected: `npm-audit-exceptions.json`, `FolderDiffIL4DotNet.Tests/Architecture/CiAutomationConfigurationTests.cs`, `doc/TESTING_GUIDE.md`.
+
 ### [2.0.1] - 2026-08-21
 
 #### Changed
@@ -1764,6 +1768,10 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 
 - **レポートsample同期を回帰テストで保護** — `GoldenReportSampleConsistencyTests`を追加し、commit済みMarkdown/HTML両sampleの設定済み正規化tableを、順序を含む`creator-default` profile全体およびsample固有のoverlap warning用設定値と比較するようにしました。テストガイドでは、この成果物間の整合性検証と、`GoldenFileSnapshotTests`が担う構造／生成決定論の検証との役割を区別しました。対象: `FolderDiffIL4DotNet.Tests/Services/GoldenReportSampleConsistencyTests.cs`, `doc/TESTING_GUIDE.md`。テスト: `MarkdownNormalizationTable_MatchesCreatorDefaultProfile`, `HtmlNormalizationTable_MatchesCreatorDefaultProfile`。
 
+#### 修正
+
+- **期限切れ npm 監査例外による CI 失敗を解消** — ロック済み Jest 依存グラフが既存の overrides により修正版 `brace-expansion` を選択するようになったため、期限切れの `GHSA-mh99-v99m-4gvg` 例外を削除しました。CI 設定テストでは npm 例外リストが空のままであることを必須とし、テストガイドには現在有効な npm 監査例外がないことを記載しました。対象: `npm-audit-exceptions.json`, `FolderDiffIL4DotNet.Tests/Architecture/CiAutomationConfigurationTests.cs`, `doc/TESTING_GUIDE.md`。
+
 ### [2.0.1] - 2026-08-21
 
 #### 変更

FolderDiffIL4DotNet.Tests/Architecture/CiAutomationConfigurationTests.cs

@@ -263,10 +263,8 @@ public void DotNetWorkflow_RunsPinnedJavaScriptTestsAndAuditGate()
             var nodeVersion = File.ReadAllText(GetRepositoryFilePath(".node-version")).Trim();
             var packageJson = JsonDocument.Parse(File.ReadAllText(GetRepositoryFilePath("package.json"))).RootElement;
             var auditGate = File.ReadAllText(GetRepositoryFilePath("scripts", "npm-audit-gate.js"));
-            var auditException = JsonDocument.Parse(
-                File.ReadAllText(GetRepositoryFilePath("npm-audit-exceptions.json")))
-                .RootElement
-                .GetProperty("exceptions")[0];
+            using var auditExceptions = JsonDocument.Parse(
+                File.ReadAllText(GetRepositoryFilePath("npm-audit-exceptions.json")));
 
             Assert.Equal("24.18.0", nodeVersion);
             Assert.Contains("javascript-tests:", workflow, StringComparison.Ordinal);
@@ -285,13 +283,7 @@ public void DotNetWorkflow_RunsPinnedJavaScriptTestsAndAuditGate()
                 packageJson.GetProperty("scripts").GetProperty("audit:high").GetString());
             Assert.Contains("runAudit(repositoryRoot, ['--omit=dev'])", auditGate, StringComparison.Ordinal);
             Assert.Contains("result.expiredExceptions.length > 0", auditGate, StringComparison.Ordinal);
-            Assert.Equal("GHSA-mh99-v99m-4gvg", auditException.GetProperty("advisory").GetString());
-            Assert.Equal(1124334, auditException.GetProperty("source").GetInt32());
-            Assert.Equal("brace-expansion", auditException.GetProperty("package").GetString());
-            Assert.Equal("high", auditException.GetProperty("severity").GetString());
-            Assert.Equal("2026-08-31", auditException.GetProperty("expires").GetString());
-            Assert.False(string.IsNullOrWhiteSpace(auditException.GetProperty("rationale").GetString()));
-            Assert.False(string.IsNullOrWhiteSpace(auditException.GetProperty("scope").GetString()));
+            Assert.Empty(auditExceptions.RootElement.GetProperty("exceptions").EnumerateArray());
         }
 
         /// <summary>

doc/TESTING_GUIDE.md

@@ -141,7 +141,7 @@ npm run test:js
 npm run audit:high
 ```
 
-The audit gate fails on every High/Critical advisory except the exact, time-bounded entries in [`npm-audit-exceptions.json`](../npm-audit-exceptions.json). The current `GHSA-mh99-v99m-4gvg` exception is limited to the development-only Jest dependency chain because the latest Jest 30.4.x graph cannot yet select the patched `brace-expansion` major safely; a separate `--omit=dev` audit enforces that scope, and the exception expires on 2026-08-31. [`scripts/npm-audit-gate.js`](../scripts/npm-audit-gate.js) also fails on an expired exception or if npm audit cannot return a valid report.
+The audit gate fails on every High/Critical advisory except exact, time-bounded entries in [`npm-audit-exceptions.json`](../npm-audit-exceptions.json). There are currently no active npm audit exceptions; the locked Jest graph selects patched `brace-expansion` releases through the overrides in `package.json`. A separate `--omit=dev` audit enforces that any future exception remains limited to development dependencies. [`scripts/npm-audit-gate.js`](../scripts/npm-audit-gate.js) also fails on an expired exception or if npm audit cannot return a valid report.
 
 Run the NuGet audit-gate tests and the same full-solution direct/transitive dependency audit used by CI:
 
@@ -395,7 +395,7 @@ npm run test:js
 npm run audit:high
 ```
 
-監査ゲートは、[`npm-audit-exceptions.json`](../npm-audit-exceptions.json) に完全一致かつ期限付きで記録した項目を除き、High/Critical advisory をすべて失敗させます。現在の `GHSA-mh99-v99m-4gvg` 例外は、最新 Jest 30.4.x の依存グラフが修正版 `brace-expansion` のメジャーバージョンをまだ安全に選択できないため、開発専用 Jest 依存チェーンだけに限定します。この範囲は別の `--omit=dev` 監査で強制し、例外は 2026-08-31 に失効します。[`scripts/npm-audit-gate.js`](../scripts/npm-audit-gate.js) は、例外が期限切れの場合や npm audit から有効なレポートを取得できない場合も失敗します。
+監査ゲートは、[`npm-audit-exceptions.json`](../npm-audit-exceptions.json) に完全一致かつ期限付きで記録した項目を除き、High/Critical advisory をすべて失敗させます。現在有効な npm 監査例外はなく、ロック済み Jest 依存グラフでは `package.json` の overrides により修正版 `brace-expansion` を選択します。将来追加する例外が開発用依存関係だけに限定されることは、別の `--omit=dev` 監査で強制します。[`scripts/npm-audit-gate.js`](../scripts/npm-audit-gate.js) は、例外が期限切れの場合や npm audit から有効なレポートを取得できない場合も失敗します。
 
 NuGet 監査ゲートのテストと、CI と同じソリューション全体の直接・推移的依存関係監査を実行する場合:
 

npm-audit-exceptions.json

@@ -1,13 +1,3 @@
 {
-  "exceptions": [
-    {
-      "advisory": "GHSA-mh99-v99m-4gvg",
-      "source": 1124334,
-      "package": "brace-expansion",
-      "severity": "high",
-      "rationale": "The latest Jest 30.4.x dependency graph still requires glob/minimatch releases whose brace-expansion ranges cannot select the patched 5.0.8 major version safely.",
-      "scope": "Development-only Jest and jsdom test tooling; nildiff runtime and published .NET packages do not consume this dependency.",
-      "expires": "2026-08-31"
-    }
-  ]
+  "exceptions": []
 }