WIP: fix(deps): patch development toolchain vulnerabilities #23

Closed

clawlter wants to merge 2 commits from audit/dev-toolchain-deps into main

pull from: audit/dev-toolchain-deps

merge into: clawlter:main

clawlter:main

clawlter:wt/t_33b1da60

Conversation 3 Commits 2 Files changed 2 +803 -1181

clawlter commented 2026-07-12 01:18:52 -04:00

Owner

Copy link

Summary

• Upgrade the compatible development test/build chain to Vitest 4.1.10 and Vite 8.1.4.
• Regenerate the npm lockfile, resolving the JSDOM WebSocket path to ws 8.21.0 and refreshing compatible dev-only @babel/core and brace-expansion transitive resolutions.
• Keep JSDOM at 26.1.0: JSDOM 29 altered accessible-name behavior and caused four existing UI tests to fail, while JSDOM 26 is compatible with the patched ws resolution.

Validation

• npm ci
• npm run lint
• npm run typecheck
• npm test (23 files, 50 tests)
• npm test -- --maxWorkers=1 --no-file-parallelism (23 files, 50 tests)
• npm run build

Audit scope / residual exception

npm audit and npm audit --omit=dev now report the same three production findings: next@16.2.3, its postcss@8.4.31, and gray-matter's js-yaml@3.14.2. These are intentionally not changed here because PR #17 owns the production Next.js/YAML remediation; this PR leaves no development-only audit findings.

Draft for review; please keep this separate from PR #17.

## Summary - Upgrade the compatible development test/build chain to Vitest 4.1.10 and Vite 8.1.4. - Regenerate the npm lockfile, resolving the JSDOM WebSocket path to ws 8.21.0 and refreshing compatible dev-only @babel/core and brace-expansion transitive resolutions. - Keep JSDOM at 26.1.0: JSDOM 29 altered accessible-name behavior and caused four existing UI tests to fail, while JSDOM 26 is compatible with the patched ws resolution. ## Validation - `npm ci` - `npm run lint` - `npm run typecheck` - `npm test` (23 files, 50 tests) - `npm test -- --maxWorkers=1 --no-file-parallelism` (23 files, 50 tests) - `npm run build` ## Audit scope / residual exception `npm audit` and `npm audit --omit=dev` now report the same three production findings: `next@16.2.3`, its `postcss@8.4.31`, and `gray-matter`'s `js-yaml@3.14.2`. These are intentionally not changed here because PR #17 owns the production Next.js/YAML remediation; this PR leaves no development-only audit findings. Draft for review; please keep this separate from PR #17.

clawlter added 1 commit 2026-07-12 01:18:56 -04:00

fix(deps): patch development toolchain vulnerabilities 8c8b0175e5

clawlter changed title from fix(deps): patch development toolchain vulnerabilities to WIP: fix(deps): patch development toolchain vulnerabilities 2026-07-12 01:23:13 -04:00

clawlter added 1 commit 2026-07-12 03:38:23 -04:00

fix(deps): refresh ESLint js-yaml lock path 096fddbf16

clawlter force-pushed audit/dev-toolchain-deps from 096fddbf16 to 5cddac1eac 2026-07-12 10:18:54 -04:00 Compare

clawlter commented 2026-07-12 10:20:01 -04:00

Author

Owner

Copy link

Integration staging update (unmerged): reviewed head 096fddbf16058dba3f65b9fb56cda01462e4386d → staged head 5cddac1eacf8585dba2febdf84a9c734067af027. Signed ancestry-only rebase onto main 383b526; stable patch-id confirms the reviewed aggregate delta is unchanged. Local npm ci, lint, typecheck, full Vitest, and production build all pass. Required exact-head Forgejo checks are running; this changed head remains for fresh independent review.

Integration staging update (unmerged): reviewed head `096fddbf16058dba3f65b9fb56cda01462e4386d` → staged head `5cddac1eacf8585dba2febdf84a9c734067af027`. Signed ancestry-only rebase onto main 383b526; stable patch-id confirms the reviewed aggregate delta is unchanged. Local `npm ci`, lint, typecheck, full Vitest, and production build all pass. Required exact-head Forgejo checks are running; this changed head remains for fresh independent review.

clawlter commented 2026-07-12 11:27:27 -04:00

Author

Owner

Copy link

Exact-head staging checks are green for 5cddac1eacf8585dba2febdf84a9c734067af027: both protected pull-request contexts succeeded. Current main is an ancestor and every staged post-main commit has a good signature. This PR remains unmerged and awaits independent staged-head review.

Exact-head staging checks are green for `5cddac1eacf8585dba2febdf84a9c734067af027`: both protected pull-request contexts succeeded. Current main is an ancestor and every staged post-main commit has a good signature. This PR remains unmerged and awaits independent staged-head review.

clawlter commented 2026-07-14 08:16:01 -04:00

Author

Owner

Copy link

Closing without merge because the owner cancelled the code-security-audit-2026-07 campaign. This does not revert previously merged work.

Closing without merge because the owner cancelled the `code-security-audit-2026-07` campaign. This does not revert previously merged work.

clawlter closed this pull request 2026-07-14 08:16:01 -04:00

All checks were successful

Hide checks

Build and publish container image / Build Docker image and publish package tags (pull_request) Successful in 5m49s

Required

Details

CI / Validate lint, types, tests, and production build (pull_request) Successful in 2m21s

Required

Details

Pull request closed

This pull request cannot be reopened because the branch was deleted.

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

clawlter/hermes-brain-web!23

No description provided.