fix(frontend): update audited transitive overrides #627

Merged

andrei merged 4 commits from fix/frontend-audit-20260805 into master 2026-08-05 00:18:10 +00:00

Conversation 4 Commits 4 Files changed 18 +64 -108

andrei commented 2026-08-04 23:26:09 +00:00

Owner

Copy link

Причина

Live Forgejo frontend-audit on PR #626 detected two newly published high advisories in the unchanged master dependency graph:

• GHSA-4cwx-7wf7-3272: undici <7.29.0
• GHSA-rgw5-rvv9-x895: brace-expansion >=4 <5.0.9

Исправление

• override undici 7.28.0 -> 7.29.0
• override brace-expansion 5.0.8 -> 5.0.9
• regenerate pnpm lockfile

Проверка

• pnpm install --frozen-lockfile: green
• pnpm audit --audit-level=high: exit 0 (one low remains)
• frontend build: green
• frontend regression tests: green
• eslint: green
• diff-only gitleaks: no leaks

This baseline remediation unblocks the separately verified Grid profitability PR #626.

## Причина Live Forgejo frontend-audit on PR #626 detected two newly published high advisories in the unchanged master dependency graph: - GHSA-4cwx-7wf7-3272: undici <7.29.0 - GHSA-rgw5-rvv9-x895: brace-expansion >=4 <5.0.9 ## Исправление - override undici 7.28.0 -> 7.29.0 - override brace-expansion 5.0.8 -> 5.0.9 - regenerate pnpm lockfile ## Проверка - pnpm install --frozen-lockfile: green - pnpm audit --audit-level=high: exit 0 (one low remains) - frontend build: green - frontend regression tests: green - eslint: green - diff-only gitleaks: no leaks This baseline remediation unblocks the separately verified Grid profitability PR #626.

andrei added 1 commit 2026-08-04 23:26:10 +00:00

fix(frontend): update audited transitive overrides 0a7a72a457

andrei added 1 commit 2026-08-04 23:38:04 +00:00

fix(frontend): align npm audit lock path 852ba2ba99

andrei commented 2026-08-04 23:38:37 +00:00

Author

Owner

Copy link

Correction after independent review, exact HEAD 852ba2ba99:

• regenerated tracked package-lock.json (Docker/npm CI path)
• aligned npm overrides for undici 7.29.0, brace-expansion 5.0.9, postcss 8.5.23 and react-router 8.3.0
• npm audit --package-lock-only --audit-level=high: 0 vulnerabilities
• actual npm ci: green
• npm build + full frontend regression chain + eslint: green
• pnpm audit --audit-level=high: exit 0 (one low only)
• diff-only gitleaks: no leaks
  New independent exact-head review and Forgejo CI are running. The prior BLOCKING SHA 0a7a72a45 must not be merged.

Correction after independent review, exact HEAD 852ba2ba99bf6c4b929e1878006477eb1b788b98: - regenerated tracked package-lock.json (Docker/npm CI path) - aligned npm overrides for undici 7.29.0, brace-expansion 5.0.9, postcss 8.5.23 and react-router 8.3.0 - npm audit --package-lock-only --audit-level=high: 0 vulnerabilities - actual npm ci: green - npm build + full frontend regression chain + eslint: green - pnpm audit --audit-level=high: exit 0 (one low only) - diff-only gitleaks: no leaks New independent exact-head review and Forgejo CI are running. The prior BLOCKING SHA 0a7a72a45 must not be merged.

andrei referenced this pull request 2026-08-04 23:38:47 +00:00

fix(grid): enforce normal local stop cap in aligned trends #626

andrei added 1 commit 2026-08-04 23:50:50 +00:00

build(frontend): align builder with audited router engine b31bebc0e4

andrei commented 2026-08-04 23:51:15 +00:00

Author

Owner

Copy link

Second review blocker resolved. Final exact HEAD b31bebc0e4 aligns the production builder with react-router 8.3 engine requirements via node:22.22-alpine. Verified real Docker paths: frontend-builder image sha256:9bc35da47e966dae808fda8344d77f011749be383fd2ebc3abff248f4b1ca5a9 and full 18-stage application image sha256:0c74e775b4b7afb3d1c1511526e02b0a4f45ec1751b209dce21580aeaeccc60c both built successfully. Prior SHA 852ba2ba9 must not be merged. Final independent exact-head review and fresh Forgejo CI are running.

Second review blocker resolved. Final exact HEAD b31bebc0e44527bcb4b5465a2458a355ebffaa0d aligns the production builder with react-router 8.3 engine requirements via node:22.22-alpine. Verified real Docker paths: frontend-builder image sha256:9bc35da47e966dae808fda8344d77f011749be383fd2ebc3abff248f4b1ca5a9 and full 18-stage application image sha256:0c74e775b4b7afb3d1c1511526e02b0a4f45ec1751b209dce21580aeaeccc60c both built successfully. Prior SHA 852ba2ba9 must not be merged. Final independent exact-head review and fresh Forgejo CI are running.

andrei added 1 commit 2026-08-05 00:03:18 +00:00

fix(frontend): migrate to supported router package f5ed46e610

andrei commented 2026-08-05 00:03:50 +00:00

Author

Owner

Copy link

Third review blocker resolved at exact HEAD f5ed46e610. Unsupported react-router-dom 7 / react-router 8 override is gone. Frontend now uses the official consolidated react-router@8.3.0 package directly; all 13 source/test imports migrated and no react-router-dom references remain. npm: engine-strict install, audit 0 vulns, build, regression chain, 290/290 unit tests, lint green. pnpm: frozen install, no high audit findings, build, regressions, 290/290 unit tests, lint green. Real frontend-builder and full production Docker image builds green. Prior SHA b31bebc0e must not be merged; fresh CI and exact-head review are running.

Third review blocker resolved at exact HEAD f5ed46e6101570d97e45282419f45c9827aed2df. Unsupported react-router-dom 7 / react-router 8 override is gone. Frontend now uses the official consolidated react-router@8.3.0 package directly; all 13 source/test imports migrated and no react-router-dom references remain. npm: engine-strict install, audit 0 vulns, build, regression chain, 290/290 unit tests, lint green. pnpm: frozen install, no high audit findings, build, regressions, 290/290 unit tests, lint green. Real frontend-builder and full production Docker image builds green. Prior SHA b31bebc0e must not be merged; fresh CI and exact-head review are running.

andrei commented 2026-08-05 00:11:07 +00:00

Author

Owner

Copy link

Independent adversarial review of exact HEAD f5ed46e610: GREEN, no blocking findings. Reviewer independently confirmed all required browser/test exports, zero react-router-dom references, supported React peers, canonical npm lock, strict npm/frozen pnpm installs, audits, builds, lint, full regression chain and 290/290 tests.

Independent adversarial review of exact HEAD f5ed46e6101570d97e45282419f45c9827aed2df: GREEN, no blocking findings. Reviewer independently confirmed all required browser/test exports, zero react-router-dom references, supported React peers, canonical npm lock, strict npm/frozen pnpm installs, audits, builds, lint, full regression chain and 290/290 tests.

andrei merged commit 00782249dd into master 2026-08-05 00:18:10 +00:00

andrei referenced this pull request from a commit 2026-08-05 00:18:11 +00:00

Merge PR #627: remediate frontend dependency advisories

andrei referenced this pull request 2026-08-05 00:19:16 +00:00

fix(grid): enforce normal local stop cap in aligned trends #626

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

europa-tech-srl/arnold-trader-app!627

No description provided.