audit frontend dependencies in CI and patch nanoid - #70
Merged
Conversation
The security-scan job audited only the root lockfile, so frontend advisories were invisible to the blocking gate and Dependabot was the sole signal. A frontend-scoped audit-ci config (empty allowlist — the frontend tree is currently clean) now runs as a blocking step in the same job, proven able to fail by running the identical config against a tree with real high advisories. nanoid resolves to 3.3.18 within postcss's declared range, clearing the size-zero infinite-loop advisory. The react-router justification no longer claims a fix is unpublished — 7.18.2 shipped and is resolved; its vestigial root allowlist entry is documented as pending root-scoped cleanup rather than silently kept.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The Security Scan job audited only the root lockfile, so frontend advisories never reached the blocking gate - Dependabot was the sole signal.
audit-cistep forfrontend/package-lock jsonin the same Security Scan job, with its own config (frontend/.audit-ci.json, thresholds mirroring root, allowlist empty - the frontend tree currently audits clean).^3.3.16range; clears the size-zero infinite-loop advisory (GHSA-2v37-7h3g-55p8, HIGH). Closes Dependabot alert #97. Lockfile diff is the nanoid chain only.audit-ci-allowlist-justifications.mdcorrected: the react-router entry claimed no fix was published - 7.18.2 shipped and is resolved (PR build(deps): bump react-router and react-router-dom in /frontend #67). The vestigial allowlist ID in rootaudit-ci.jsonis deliberately untouched (root stays byte-identical) and documented as pending root-scoped cleanup.Testing
Frontend gate exits 0 as configured. Bite-proven despite the clean tree: the identical config run against a tree with real HIGH advisories fails with exit l naming the GHSAs - thresholds live, exit codes propagate. No
continue-on-erroror soft-fail anywhere inci.yml. Frontend jest 2,041 passed exit 0; vite build exit 0; root gate unchanged, exit 0 as on 'main.Notes
No infrastructure or runtime delta - CI config, one dependency patch, and a documentation truth fix. Future frontend advisories without a patch will now need an allowlist entry plus a written justification; the gate enforces that by failing.