[dimka90]

Issue 845: npm run test:scripts is not referenced by any root aggregate test command or CI-facing convention doc

Problem: scripts/__tests__ has real coverage wired via npm run test:scripts, but CONTRIBUTING.md's Testing table only listed the contract/API/SDK/e2e suites — a contributor changing scripts/*.ts had no documented signal that a dedicated suite exists.

Resolution: Added an Operational scripts row to the Testing table (npm run test:scripts, node-only, no external services). Documented that no workflow under .github/workflows/ currently invokes test:scripts (explicit gap, with a run-before-push instruction), and listed the scripts/*.ts files that have no corresponding test in scripts/__tests__/ for future coverage tracking. Verified npm run test:scripts runs clean after npm install (75 tests, 0 fail).

Closes #845

Issue 844: No CI or pre-commit check that docs/dep-graph.svg stays in sync with scripts/dep-graph.ts output

Problem: make dep-graph regenerates docs/dep-graph.svg, but nothing detects a forgotten regeneration, so the artifact silently drifts from the real workspace graph.

Resolution: Added scripts/check-dep-graph.ts (npm check:dep-graph, Make check-dep-graph): it regenerates the graph via scripts/dep-graph.ts, renders it with Graphviz, and diffs against the committed docs/dep-graph.svg, failing (exit 1) if they differ or the file is missing. It guards Graphviz availability first — when dot is absent it prints a clear install hint and exits 0 (non-blocking), matching the "optional initially" criterion. The generator-version comment is stripped so the comparison isn't sensitive to the exact Graphviz build. Documented the check in CONTRIBUTING.md alongside the existing lint/typecheck items.

Closes #844

Issue 836: Security: dependency vulnerability found — 2026-08-03

Problem: The scheduled security audit flagged NPM vulnerabilities, including a critical tar advisory. The root cause is that the committed package-lock.json was corrupt JSON (a bad merge left a malformed @next/swc-* / sharp entry at line ~2295), so npm audit and npm ci could not read it and the existing overrides were never actually applied.

Resolution: Repaired the lockfile: removed the corrupt committed package-lock.json and regenerated a valid one (npm install --package-lock-only). This makes the pre-existing overrides effective. Also fixed the install blocker that prevented regeneration — lightningcss-darwin-arm64 was wrongly listed as a hard dependency (breaking non-mac installs with EBADPLATFORM); moved it to optionalDependencies. Result: npm audit now reports 0 critical (the tar critical is resolved) and npm audit --audit-level=critical (the dependency_scan.yml gate) passes. Added a low-risk toml override (^4.2.0, fixes @stellar/stellar-sdk's toml advisories), dropping total vulnerabilities from 27→25 high.

Closes #836

Issue 833: Security: dependency vulnerability found — 2026-08-02

Problem: A second scheduled-audit report listing the same NPM dependency vulnerabilities (all high, no critical). The audit could not act on them for the same reason — the committed lockfile was invalid JSON.

Resolution: The repaired, regenerate-able lockfile together with the widened overrides addresses this report: npm audit --audit-level=critical passes (0 critical). Remaining high/moderate findings are warnings only — the audit workflow (audit.yml) fails solely on critical NPM vulnerabilities and treats high as warnings, and the rest are the @opentelemetry/* family (requires a breaking major bump of apps/api tracing) plus dev-only semantic-release transitives. These are documented as follow-ups rather than forced with risky major-version overrides.

Closes #833

Verification

• npm run test:scripts → 75 tests, 22 suites, 0 fail.
• npm run check:dep-graph → runs; prints non-blocking Graphviz-missing hint and exits 0 in this environment (dot not installed).
• npm audit on the repaired lockfile → {critical:0, high:25, moderate:46}; npm audit --audit-level=critical → PASS.
• package-lock.json validated as well-formed JSON.

Notes

• package-lock.json is regenerated wholesale (it was previously invalid); it is excluded from the pr-size check by .prsize-ignore.
• The lightningcss-darwin-arm64 platform fix and lockfile repair were required to make the security overrides effective and to unblock npm ci/npm audit.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
tariff-shield-web	Error		Oct 18, 2026 5:41am UTC

[drips-wave]

@dimka90 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits