fix(deps): resolve npm audit high-severity advisories + add audit CI step #32

2026-07-29T16:36:16Z

KofTwentyTwo commented

2026-07-29 16:36:16 +00:00

(Migrated from github.com)

Summary

Resolves all 9 HIGH-severity npm audit advisories, all rooted in a single transitive chain: eslint/eslint-config-next tooling pulling in a vulnerable minimatch (<=10.0.2) -> brace-expansion <=5.0.7 (GHSA-mh99-v99m-4gvg, DoS via unbounded expansion). These are dev/build-time-only packages, not shipped in the runtime Docker image (Trivy scan is already 0 CRITICAL/0 HIGH).
Fixed via a minimatch override pinned to ^10.0.3 in package.json (newer minimatch drops the vulnerable brace-expansion dependency entirely in favor of @isaacs/brace-expansion). This avoids a semver-major eslint 9->10 bump; npm audit fix --force's proposed eslint major bump was evaluated and not needed.
Adds a non-blocking npm audit --audit-level=high step to the lint-and-build job (continue-on-error: true) so future advisories stay visible in CI logs without gating a solo dev's merges on build-time dev-dependency findings.

Test plan

npm ci then npm audit before fix: 9 high severity vulnerabilities
npm audit after fix: 0 vulnerabilities
npm run lint passes (0 errors; 3 pre-existing unrelated warnings)
npm run build passes (Next.js production build succeeds, all routes generated)
Required checks (build, lint-and-build, trivy-scan, CodeQL) expected green on this PR

## Summary - Resolves all 9 HIGH-severity `npm audit` advisories, all rooted in a single transitive chain: eslint/eslint-config-next tooling pulling in a vulnerable `minimatch` (<=10.0.2) -> `brace-expansion` <=5.0.7 (GHSA-mh99-v99m-4gvg, DoS via unbounded expansion). These are dev/build-time-only packages, not shipped in the runtime Docker image (Trivy scan is already 0 CRITICAL/0 HIGH). - Fixed via a `minimatch` override pinned to `^10.0.3` in `package.json` (newer minimatch drops the vulnerable `brace-expansion` dependency entirely in favor of `@isaacs/brace-expansion`). This avoids a semver-major eslint 9->10 bump; `npm audit fix --force`'s proposed eslint major bump was evaluated and not needed. - Adds a non-blocking `npm audit --audit-level=high` step to the `lint-and-build` job (`continue-on-error: true`) so future advisories stay visible in CI logs without gating a solo dev's merges on build-time dev-dependency findings. ## Test plan - [x] `npm ci` then `npm audit` before fix: 9 high severity vulnerabilities - [x] `npm audit` after fix: 0 vulnerabilities - [x] `npm run lint` passes (0 errors; 3 pre-existing unrelated warnings) - [x] `npm run build` passes (Next.js production build succeeds, all routes generated) - [x] Required checks (build, lint-and-build, trivy-scan, CodeQL) expected green on this PR

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: KofTwentyTwo/nuncio-website#32