Repository navigation
chore(frontend): clear the dependency-audit backlog - #54
Merged
Merged
Conversation
…e-browser-mapping) The Dependency audit CI job has been red on every PR since early September because npm audit's fail condition (npm audit --audit-level=high) is evaluated against the whole tree, not just the files a PR touches. Dependabot opens one PR per package, so a PR that only bumped vitest (#49) or baseline-browser-mapping (#50) still failed the gate: the unfixed browserslist advisories (GHSA-c83g-rgw3-j3cx, GHSA-73wf-gq98-2v4g, high severity) were still present in the tree. This was not a build or test regression from the Dependabot bumps themselves - the "Frontend (typecheck, test, build)" job passed on all three open Dependabot PRs. `npm audit fix` alone resolved browserslist and baseline-browser-mapping (transitive, no manifest changes needed) but left the vitest family (vitest, @vitest/mocker, @vitest/coverage-v8 - GHSA-82fw-gwwq-j7x9) unresolved even though the fixed version (4.1.11) satisfies the existing ^4.1.10 semver range. Bumping vitest and @vitest/coverage-v8 to 4.1.11 directly closes it without any semver-major change. npm audit now reports 0 vulnerabilities (was 5: 1 high, 4 moderate). Verified: npx tsc --noEmit, npm test, npm run build all pass, matching what the "Frontend (typecheck, test, build)" CI job runs. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UoFoJWJX28B7nM6HfriV7M
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The "Dependency audit" check has failed on every PR since early September.
pip-auditreports no Python vulnerabilities — all five advisories were frontend npm packages.Why Dependabot couldn't fix this
Its PRs weren't broken. The Frontend job passed on all three (#48 browserslist, #49 vitest, #50 baseline-browser-mapping).
The gate is
npm audit --audit-level=highrun against the whole tree. Each Dependabot PR bumps one package, so every one of them still left the high-severitybrowserslistadvisory in place and failed the audit job. No single-package PR could ever satisfy that gate — the advisories had to land together, which Dependabot cannot do on its own.That's why three valid PRs sat unmerged for three weeks, and why every unrelated PR has shipped with a red check ever since. The normalisation of a permanently-failing check is the real cost here; the advisories themselves are mostly moderate.
The fix — minimum change, no
--force, no major bumpsnpm audit fix— resolvedbrowserslist(high) andbaseline-browser-mapping, lockfile-only transitives.vitest@4.1.11+@vitest/coverage-v8@4.1.11— a patch bump inside the existing^4.1.10range, whichnpm audit fixalone left untouched.Only
frontend/package.jsonandfrontend/package-lock.jsonchanged..github/workflows/ci.ymlis untouched — making the check green by weakening the check would have been worse than leaving it red.Verification
npm audit→ 0 vulnerabilities (was 5: 1 high, 4 moderate). CI's own frontend commands run locally:npm ci✓,npx tsc --noEmit✓,npm run build✓.npm testwas flaky in the sandbox, but it reproduced identically on unpatchedmain— CPU contention, with import times swinging 11s–200s for the same suite. Forced serial (--no-file-parallelism) it passed 30/30 three times on this branch. Pre-existing local artifact, not caused by these bumps; GitHub's runners already passed the Frontend job on all three Dependabot PRs.Local Node was v25.8 against CI's Node 20 — noted, not expected to matter for a lockfile change.
Follow-up worth considering
Closing #48, #49 and #50 as superseded, and deciding whether the audit gate should be advisory rather than blocking — otherwise the next single-package advisory recreates the same deadlock.
🤖 Generated with Claude Code
https://claude.ai/code/session_01UoFoJWJX28B7nM6HfriV7M