fix(deps): resolve npm audit high-severity advisories + add audit CI step #32

Merged

KofTwentyTwo merged 2 commits from fix/npm-audit-high-severity into main

2026-07-29 16:40:17 +00:00

Author	SHA1	Message	Date
James Maes	bc8be32840	ci(app): add non-blocking npm audit step to lint-and-build job Surface high-severity advisories in CI logs without gating merges on build-time dev-dependency findings a solo dev can triage async.	2026-07-29 11:35:47 -05:00
James Maes	c3699a1d79	security(deps): resolve high-severity npm audit advisories via minimatch override All 9 high-severity advisories stemmed from a single transitive chain: eslint/eslint-config-next tooling depend on a vulnerable minimatch (<=10.0.2) that pulls in brace-expansion <=5.0.7 (GHSA-mh99-v99m-4gvg, DoS via unbounded expansion). These are dev/build-time only packages, not shipped in the runtime image. Bumping eslint itself would require a semver-major jump (9.x -> 10.x). Instead, pin minimatch to ^10.0.3 via package.json overrides, which drops the vulnerable brace-expansion dependency entirely (newer minimatch uses @isaacs/brace-expansion). Verified npm audit reports 0 vulnerabilities and both npm run lint and npm run build still pass.	2026-07-29 11:35:41 -05:00

Author

SHA1

Message

Date

James Maes

bc8be32840

ci(app): add non-blocking npm audit step to lint-and-build job

Surface high-severity advisories in CI logs without gating merges on
build-time dev-dependency findings a solo dev can triage async.

2026-07-29 11:35:47 -05:00

James Maes

c3699a1d79

security(deps): resolve high-severity npm audit advisories via minimatch override

All 9 high-severity advisories stemmed from a single transitive chain:
eslint/eslint-config-next tooling depend on a vulnerable minimatch
(<=10.0.2) that pulls in brace-expansion <=5.0.7 (GHSA-mh99-v99m-4gvg,
DoS via unbounded expansion). These are dev/build-time only packages,
not shipped in the runtime image.

Bumping eslint itself would require a semver-major jump (9.x -> 10.x).
Instead, pin minimatch to ^10.0.3 via package.json overrides, which
drops the vulnerable brace-expansion dependency entirely (newer
minimatch uses @isaacs/brace-expansion). Verified npm audit reports 0
vulnerabilities and both npm run lint and npm run build still pass.

2026-07-29 11:35:41 -05:00