fix(frontend): resolve high-severity npm audit vulns reddening Security Scanning (#1510)

[cristim]

Summary

npm audit --audit-level=high in the frontend was exiting 1 with 30 high-severity advisories, reddening the Security Scanning job (and therefore CI Success) repo-wide on every open PR, including ones that don't touch the frontend.

• postcss <=8.5.17 (GHSA-r28c-9q8g-f849, path traversal in source-map auto-loading): resolved via plain npm audit fix (semver-compatible lockfile bump, no code change).
• brace-expansion <=5.0.7 / minimatch 2.0.0-10.0.2 (GHSA-mh99-v99m-4gvg, DoS via unbounded expansion): pulled in transitively by eslint, jest/@jest/reporters, ts-jest/babel-plugin-istanbul, and serve/serve-handler, all pinning an old minimatch internally. serve and eslint are already at their latest available majors, and serve-handler hard-pins minimatch@3.1.5 with no newer release published, so bumping any of those packages directly would not have fixed it. Resolved with a targeted overrides entry in frontend/package.json forcing minimatch to ^10.2.5 and brace-expansion to ^5.0.8 across the whole dependency tree.

npm audit fix --force was tried first per the standard remediation path, but it actually downgraded jest to ^25.0.0 and serve to ^6.5.8 to satisfy its own resolver heuristics (npm's force-fix picks minimal-diff versions, not necessarily the safest/latest ones). That result was reverted and not shipped; the overrides approach was used instead, which resolves the same advisories without touching eslint/jest major versions at all, so no eslint flat-config migration or jest 30 breaking-change handling was needed.

Verification

• rm -rf node_modules && npm ci from the committed lockfile, then npm audit --audit-level=high -> found 0 vulnerabilities, exit 0.
• npm run build -> webpack compiles clean (1 pre-existing bundle-size warning, unrelated).
• npm run lint -> 0 errors, 125 pre-existing warnings (@typescript-eslint/no-explicit-any).
• npm run typecheck -> clean.
• npm test -> 86/86 suites, 2729 passed, 1 pre-existing skip (same as baseline; note the sandbox's de_DE locale flips $1,200-style assertions to $1.200 independent of this change - confirmed pre-existing on git stash, unrelated, tests pass with LC_ALL=en_US.UTF-8).

Only frontend/package.json and frontend/package-lock.json changed.

Test plan

• npm ci && npm audit --audit-level=high exits 0
• npm run build succeeds
• npm run lint / npm run typecheck clean
• npm test green (86 suites, 2729 passed)
• CI Security Scanning job goes green on this PR

Closes #1510

Summary by CodeRabbit

• Chores
  • Updated dependency version resolutions to improve compatibility and consistency.

[cristim]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[coderabbitai]

Important

Review skipped

No new commits to review since the last review.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 31b6a84d-c243-4dac-b480-5c01da59f8c5

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

📝 Walkthrough

Walkthrough

Adds a frontend npm override that resolves brace-expansion to ^5.0.8 without changing other package metadata or tooling configuration.

Changes

Frontend dependency override

Layer / File(s)	Summary
Override brace-expansion version frontend/package.json	Adds a top-level overrides entry for brace-expansion at ^5.0.8.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Possibly related issues

• LeanerCloud/CUDly#1487 — Both modify frontend dependency resolution through package.json overrides, targeting different transitive packages.

Possibly related PRs

• LeanerCloud/CUDly#872 — Both modify frontend/package.json to control npm dependency versions.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 inconclusive)

Check name	Status	Explanation	Resolution
Linked Issues check	❓ Inconclusive	Cannot fully verify the audit remediation because package-lock.json, where the lockfile fix would live, was excluded by path filters.	Provide reviewable package-lock.json changes or remove the exclusion so the postcss and serve/minimatch fixes can be verified.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the frontend npm-audit vulnerability fix and Security Scanning remediation.
Out of Scope Changes check	✅ Passed	The only visible change is a brace-expansion override, which aligns with the vulnerability remediation scope.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/frontend-npm-audit-1510

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@frontend/package.json`:
- Around line 54-55: Remove the global minimatch entry from the overrides block
in frontend/package.json and scope the override only to the vulnerable
dependency chain, or first upgrade all listed minimatch@^3 consumers so they
safely support the newer version. Preserve compatible dependency resolution for
glob@7.2.3, eslint, `@humanwhocodes/config-array`, test-exclude, and
serve-handler.

🪄 Autofix (Beta)

✅ Autofix completed

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 63f7b6c8-c58d-4637-93a8-b884fe916078

📥 Commits

Reviewing files that changed from the base of the PR and between d9eb097 and eb5cb2e.

⛔ Files ignored due to path filters (1)

• frontend/package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (1)

• frontend/package.json

[coderabbitai]

Note

Autofix is a beta feature. Expect some limitations and changes as we gather feedback and continue to improve it.

Fixes Applied Successfully

Fixed 2 file(s) based on 1 unresolved review comment.

Files modified:

• frontend/package-lock.json
• frontend/package.json

Commit: cbcab4b7471bfbc1edb7751a91f6748aaba375de

The changes have been pushed to the fix/frontend-npm-audit-1510 branch.

Time taken: 16m 17s

[cristim]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.