chore(deps): audit + bump vulnerable/outdated deps; add minimumReleaseAge guard; docs accuracy pass - #5
Merged
Conversation
…eAge guard; docs accuracy pass Weekly Dependency + Security Sweep (Wk 3) — onboards Vespasian to the PMDS sweep rotation. Security (pnpm audit: 12 vulnerabilities -> 0): - esbuild >=0.28.1 (dev-server request vuln via electron-vite's 0.21.5) - js-yaml@3 >=3.15.0 <4, js-yaml@4 >=4.2.0 <5 (merge-key DoS; capped per-major so 3.x consumers keep the safeLoad API) - tar >=7.5.16 (7 advisories; major bump from app-builder-lib's 6.2.1 — classic c/x/t CJS API verified intact from app-builder-lib) - ws@7 >=7.5.11 <8, ws@8 >=8.21.0 <9 (memory-exhaustion DoS via @lhci) - @babel/core already at 7.29.7 (>=7.29.6) — no action needed Outdated (in-range bumps): playwright 1.60.0 -> 1.61.1 (pinned), fast-xml-parser, fflate, zod 3.x, tsx, typescript, typescript-eslint, electron, electron-builder, commitlint, pixelmatch, @types/*. minimumReleaseAge guard: no sibling repo carries one (verified); added .github/dependabot.yml modeled on Nerva's with Dependabot `cooldown` (7d default / 14d majors) as the equivalent guard. Dependency graph + Dependabot alerts still need enabling in repo settings (owner action). Docs: added release/CI/node/pnpm/license badges to README; verified agent (54) and skill (10) counts, sibling cross-links, and quick-start install steps. Tests: test:all (233), test:canva-e2e (6), gui test/typecheck/build all green. Closes #2 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
12 tasks
The uncapped pre-existing "cookie": ">=0.7.0" override floated to cookie@2.0.1 when the lockfile was regenerated. cookie@2 declares engines.node >=22, and .npmrc sets engine-strict=true, so every Node 20 CI job failed at pnpm install. Capping to <1 restores the CI-proven cookie@0.7.2 (still above the >=0.7.0 advisory floor). Verified no other resolved package requires Node >20; audit remains clean and all suites pass. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The site-validation run failed on transient packages.microsoft.com apt signing errors during 'Install jq' — but jq ships preinstalled on GitHub-hosted ubuntu runners, so the apt call is pure flake surface. Guard the step to only hit apt when jq is actually missing. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Weekly Dependency + Security Sweep (Wk 3) — onboards Vespasian to the PMDS sweep rotation. Closes #2.
Security —
pnpm audit: 12 vulnerabilities (8 high, 4 moderate) → 0All fixes via scoped
pnpm.overrides(transitive deps; lockfile regenerated with pnpm, never hand-edited):>=0.28.1>=3.15.0 <4>=4.2.0 <5>=7.5.16>=7.5.11 <8>=8.21.0 <9>=floated js-yaml 3.x consumers onto 5.2.1 (which drops thesafeLoadAPI @lhci uses) — caught and fixed before commit.require('tar')from app-builder-lib still exposes the classicc/x/t/create/extractAPI on 7.5.19.Outdated deps (in-range bumps)
playwright
1.60.0 → 1.61.1(exact pin, all 3 packages), fast-xml-parser, fflate, zod 3.x, tsx, typescript, typescript-eslint, electron, electron-builder, commitlint, pixelmatch,@types/*. Majors (react 19, vite 8, eslint 10, electron-vite 5, zod 4, …) intentionally left for dedicated upgrade PRs, not a weekly sweep.minimumReleaseAge guard
Checked all four siblings first, per the issue: none carries a
minimumReleaseAgeconfig (only Nerva has any dependency automation — a plaindependabot.yml). Added .github/dependabot.yml modeled on Nerva's structure plus Dependabotcooldown(7-day default, 14-day majors) — Dependabot's equivalent of Renovate'sminimumReleaseAge— for both npm and github-actions ecosystems.Docs accuracy pass
.claude/agents/*.md), 10 skills — README claims match.pnpm install+ wizard scripts run cleanly on this tree.Tests
pnpm test:all— 54 + 124 + 55 pass (init / pipeline / wix-driver)pnpm test:canva-e2e— 6 pass (CI site-validation gate)pnpm gui:test(63 pass) ·gui:typecheck·gui:build(exercises the esbuild 0.28.1 override through electron-vite/vite)pnpm auditclean🤖 Generated with Claude Code