europa-tech-srl/arnold-trader-app
1
0
Fork 0
Code Issues 1 Pull requests 6 Projects Releases Packages Wiki Activity Actions

fix(frontend): закрыть новые high advisories #628

Open
andrei wants to merge 1 commit from fix/frontend-live-advisories-20260805 into master
pull from: fix/frontend-live-advisories-20260805
merge into: europa-tech-srl:master
Conversation 0 Commits 1 Files changed 5 +46 -56
andrei commented 2026-08-04 23:50:23 +00:00
Owner
Copy link

Причина

Frontend audit PR #626 выявил новые live advisories в baseline dependency graph: undici, brace-expansion, postcss и react-router.

Исправление

  • синхронизированы npm/pnpm overrides и оба lockfile
  • обновлены brace-expansion 5.0.9, undici 7.29.0, postcss 8.5.23, react-router 8.3.0
  • Docker frontend builder обновлён до node:22-alpine для поддерживаемого react-router runtime contract

Проверка

  • npm ci + npm audit high: green, 0 vulnerabilities
  • pnpm frozen install + pnpm audit high: green
  • frontend build + regression suite: green
  • Docker frontend-builder exact build: green, Node v22.23.2
  • npm/pnpm lock drift: none
  • exact diff gitleaks: no leaks
  • independent adversarial review exact SHA c43ea1c137: GREEN

Риски

Frontend build-only Node base upgrade; Python runtime base unchanged.

## Причина Frontend audit PR #626 выявил новые live advisories в baseline dependency graph: undici, brace-expansion, postcss и react-router. ## Исправление - синхронизированы npm/pnpm overrides и оба lockfile - обновлены brace-expansion 5.0.9, undici 7.29.0, postcss 8.5.23, react-router 8.3.0 - Docker frontend builder обновлён до node:22-alpine для поддерживаемого react-router runtime contract ## Проверка - npm ci + npm audit high: green, 0 vulnerabilities - pnpm frozen install + pnpm audit high: green - frontend build + regression suite: green - Docker frontend-builder exact build: green, Node v22.23.2 - npm/pnpm lock drift: none - exact diff gitleaks: no leaks - independent adversarial review exact SHA c43ea1c1370238af308141b8c7544c136f1cf435: GREEN ## Риски Frontend build-only Node base upgrade; Python runtime base unchanged.
fix(frontend): patch live audit advisories
All checks were successful
SEO Audit / SEO Audit / arnold (pull_request) Successful in 5s
Details
Arnold Forgejo CI / backend-tests (pull_request) Successful in 12m21s
Details
Arnold Forgejo CI / frontend-audit (pull_request) Successful in 18s
Details
Arnold Forgejo CI / secret-scan (pull_request) Successful in 3s
Details
Frontend Bundle Size Guard / Bundle size + lazy-routes gate (pull_request) Successful in 38s
Details
Frontend Bundle Size Guard / Lighthouse mobile performance (FE-03) (pull_request) Successful in 3s
Details
Forgejo Smoke Test / Smoke (pull_request) Successful in 1s
Details
c43ea1c137
All checks were successful
SEO Audit / SEO Audit / arnold (pull_request) Successful in 5s
Details
Arnold Forgejo CI / backend-tests (pull_request) Successful in 12m21s
Details
Arnold Forgejo CI / frontend-audit (pull_request) Successful in 18s
Details
Arnold Forgejo CI / secret-scan (pull_request) Successful in 3s
Details
Frontend Bundle Size Guard / Bundle size + lazy-routes gate (pull_request) Successful in 38s
Details
Frontend Bundle Size Guard / Lighthouse mobile performance (FE-03) (pull_request) Successful in 3s
Details
Forgejo Smoke Test / Smoke (pull_request) Successful in 1s
Details
This pull request has changes conflicting with the target branch.
  • Dockerfile
  • frontend/package.json
  • frontend/pnpm-lock.yaml
  • frontend/pnpm-workspace.yaml
View command line instructions

Manual merge helper

Use this merge commit message when completing the merge manually.

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin fix/frontend-live-advisories-20260805:fix/frontend-live-advisories-20260805
git switch fix/frontend-live-advisories-20260805

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch master
git merge --no-ff fix/frontend-live-advisories-20260805
git switch fix/frontend-live-advisories-20260805
git rebase master
git switch master
git merge --ff-only fix/frontend-live-advisories-20260805
git switch fix/frontend-live-advisories-20260805
git rebase master
git switch master
git merge --no-ff fix/frontend-live-advisories-20260805
git switch master
git merge --squash fix/frontend-live-advisories-20260805
git switch master
git merge --ff-only fix/frontend-live-advisories-20260805
git switch master
git merge fix/frontend-live-advisories-20260805
git push origin master
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
europa-tech-srl/arnold-trader-app!628
No description provided.