Repository navigation
Resolve the remaining production moderate dependency families in scoped PRs #186
Description
Follow-up to #156/#157; source 385e7679fabc60b80cd65cf0a1aa4cdf3d592514, reviewed 2026-10-23. The security inventory records bounded evidence, not deployed-site clearance.
Priority: P2, with bounded reachability evidence. Final Security Scan passes the high/critical threshold with eight moderate entries; it does not clear all advisories.
| Family | Observed evidence | Separate PR validation |
|---|---|---|
| React Router 6.30.6 + DOM (2 entries) | Browser routes; inspected destinations fixed, no SSR hydration sink found. Navigation advisory. | Patched router; redirects/deep routes, login callbacks, role guards, browser history and mobile navigation. |
| UUID 9.0.1 + inherited Apollo federation/subgraph (3 entries) | Core declaration; inspected app calls use unbuffered v4. Advisory concerns buffered v3/v5/v6. | Every affected resolution path, CJS/ESM startup, schema generation, generated IDs and MCP contracts. |
| Tailwind/postcss-nested/selector parser (3 entries) | CSS build pipeline, not an established request-time parser. Selector advisory. | Compatible patched chain or validated Tailwind migration; built styles and responsive workflows. |
Reproduce with a pinned install and fresh-cache npm audit --omit=dev --json; save source/lock revision, time, response and installed paths. Package counts include inherited entries and do not establish live exploitability.
Acceptance criteria:
- Land separately reviewable router, UUID/federation and CSS dependency PRs, checking official fixed ranges at implementation time.
- Eliminate each targeted vulnerable path; do not reclassify Tailwind merely to hide an audit count or force unrelated major versions.
- Add bounded regression controls where practical, run the compatibility checks above and complete integrated gates without weakened thresholds.
- Update the canonical inventory with dated before/after dependency paths, source and actual test results; preserve the production high/critical gate and explicit residual findings.
The absence of an inspected source sink is not a guarantee for future callers. Full dev-tool/image findings are tracked separately; this issue does not claim hosted exposure.
Activity
mvalancy commentedon Oct 24, 2026
PR #191's fresh-cache production audit on
abc29d9dbe0da966cbc22976feebaa2dfced21c1now reports 9 moderate, 0 high, 0 critical findings. This supersedes the previous eight-moderate snapshot; it is not a clean-audit claim. The unchangednpm audit --omit=dev --audit-level=highgate passed in CI 40043184454.The current payload additionally lists
undici6.5.0–6.29.0, EventSource parser advisory GHSA-4qv8-2p9j-2685; npm reports a non-force fix available. The audit observation alone does not establish when the advisory appeared or the installed application's exploitability. Keep this issue open for a reviewed dependency correction and relevant regression/runtime validation.mvalancy commentedon Oct 24, 2026
Main PR #191 is blocked by its fresh production audit at
d9278cb: 8 moderate and 1 high finding, exit 1. CI 40043858265 correctly fails the unchanged high/critical gate. This supersedes the earlier passing audit snapshot; no merge has occurred.The high finding is GHSA-xjj6-f33q-929c in
undici6.28.1. The existing optional path issqlite3 → node-gyp → undici ^6.25.0; no direct Core source import was found. This does not establish public-request exploitability, but it is a merge-gate blocker. Version 6.29.1 patches this and the EventSource advisory within the current range.A narrow lockfile update, clean install, fresh audit, relevant SQLite/runtime checks and final CI are being prepared in an isolated worktree. No force audit fix, threshold change or unvalidated merge.
mvalancy commentedon Oct 24, 2026
Independent dated-evidence note: the GitHub advisory API records the high finding's publication at 2026-10-23 22:14:31 UTC, before both recent audit runs. The earlier nine-moderate payload and later high-bearing payload are retained observations; their difference is not attributed to publication timing or a proven cache cause.
I independently inspected the failed main-target Security Scan, its unchanged fresh-cache threshold, actual merge checkout and matching source tree. This supports the blocker recorded above; it does not establish a live application exploit path or waive final exact-head validation.