From b82fef56c1d314703cff5737c5609c4285bbe945 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Enes=20Ya=C4=9F=C4=B1z?= Date: Tue, 27 Oct 2026 01:55:54 +0300 Subject: [PATCH 1/2] fix(deps): resolve frontend npm advisories blocking the dependency gate npm audit fix bumps the patched body-parser (prod high, GHSA-27r3-jxmh-p828), fast-uri and ip-address. Two non-breaking overrides pin the remaining build-time advisories without downgrading the toolchain: undici 7.30.1 (above all three advisory ceilings, under @angular/build) and postcss-selector-parser 6.1.5 (advisory <6.1.5). npm audit reports 0 vulnerabilities, production and full. Co-Authored-By: Claude Opus 4.8 --- src/frontend/package-lock.json | 141 +++++++++++++++++++-------------- src/frontend/package.json | 6 +- 2 files changed, 85 insertions(+), 62 deletions(-) diff --git a/src/frontend/package-lock.json b/src/frontend/package-lock.json index 80efbc9..2b2c00e 100644 --- a/src/frontend/package-lock.json +++ b/src/frontend/package-lock.json @@ -349,14 +349,14 @@ } }, "node_modules/@angular/build": { - "version": "21.2.27", - "resolved": "https://registry.npmjs.org/@angular/build/-/build-21.2.27.tgz", - "integrity": "sha512-CqsGWRitHaSyVJU4+4CaGImgPmyqnjV168TJOWNXjgenm5FyMbfDi2SQ+Mq11P1ul+P7gBM6cQh0C0bs7Vw1Hw==", + "version": "21.2.28", + "resolved": "https://registry.npmjs.org/@angular/build/-/build-21.2.28.tgz", + "integrity": "sha512-oYHbXLX5gi3Oycxb/xRktDF38quK31okFqelYpUfusnhgX/m5QbVfcZ+oNa4Q13UT7VfwN16LgSreEdJ7IfsJQ==", "dev": true, "license": "MIT", "dependencies": { "@ampproject/remapping": "2.3.0", - "@angular-devkit/architect": "0.2102.27", + "@angular-devkit/architect": "0.2102.28", "@babel/core": "7.29.7", "@babel/helper-annotate-as-pure": "7.27.3", "@babel/helper-split-export-declaration": "7.24.7", @@ -380,7 +380,7 @@ "source-map-support": "0.5.21", "tinyglobby": "0.2.15", "undici": "7.29.1", - "vite": "7.3.6", + "vite": "7.3.7", "watchpack": "2.5.1" }, "engines": { @@ -399,7 +399,7 @@ "@angular/platform-browser": "^21.0.0", "@angular/platform-server": "^21.0.0", "@angular/service-worker": "^21.0.0", - "@angular/ssr": "^21.2.27", + "@angular/ssr": "^21.2.28", "karma": "^6.4.0", "less": "^4.2.0", "ng-packagr": "^21.0.0", @@ -448,6 +448,53 @@ } } }, + "node_modules/@angular/build/node_modules/@angular-devkit/architect": { + "version": "0.2102.28", + "resolved": "https://registry.npmjs.org/@angular-devkit/architect/-/architect-0.2102.28.tgz", + "integrity": "sha512-hgUMgAkXTC9YmDU2LEBonOrjtnBWLcg58cSvl8cgTjOAGVsiUTr8w46tzaN4SnaTScSTI9NflcnZ4q+jq4Ustg==", + "dev": true, + "license": "MIT", + "dependencies": { + "@angular-devkit/core": "21.2.28", + "rxjs": "7.8.2" + }, + "bin": { + "architect": "bin/cli.js" + }, + "engines": { + "node": "^20.19.0 || ^22.12.0 || >=24.0.0", + "npm": "^6.11.0 || ^7.5.6 || >=8.0.0", + "yarn": ">= 1.13.0" + } + }, + "node_modules/@angular/build/node_modules/@angular-devkit/core": { + "version": "21.2.28", + "resolved": "https://registry.npmjs.org/@angular-devkit/core/-/core-21.2.28.tgz", + "integrity": "sha512-CAunrxW1j4/Ctr7vDDwc+00yn6wbjiJNsZtNxAyxCvWag2AtVmYlCPiOXa+lnvQpjTTXFySR3Oy02wX9PatBKw==", + "dev": true, + "license": "MIT", + "dependencies": { + "ajv": "8.18.0", + "ajv-formats": "3.0.1", + "jsonc-parser": "3.3.1", + "picomatch": "4.0.4", + "rxjs": "7.8.2", + "source-map": "0.7.6" + }, + "engines": { + "node": "^20.19.0 || ^22.12.0 || >=24.0.0", + "npm": "^6.11.0 || ^7.5.6 || >=8.0.0", + "yarn": ">= 1.13.0" + }, + "peerDependencies": { + "chokidar": "^5.0.0" + }, + "peerDependenciesMeta": { + "chokidar": { + "optional": true + } + } + }, "node_modules/@angular/cdk": { "version": "21.2.14", "resolved": "https://registry.npmjs.org/@angular/cdk/-/cdk-21.2.14.tgz", @@ -665,9 +712,9 @@ } }, "node_modules/@angular/ssr": { - "version": "21.2.27", - "resolved": "https://registry.npmjs.org/@angular/ssr/-/ssr-21.2.27.tgz", - "integrity": "sha512-akUsoIU29t6G5P3hCk6rM0uKa7zqCLvhxIGpDmCJINobr/UP92cCTbfTEpZHHyEF687nqvRlbfViWcgCx5ZF0A==", + "version": "21.2.28", + "resolved": "https://registry.npmjs.org/@angular/ssr/-/ssr-21.2.28.tgz", + "integrity": "sha512-5ipiZ04Ay/2eHjHXkjEXs37PCu+MiNvv+nd4Aa9qfZpl4lc9pY+oPmjmtz+MfQRt77d2ymhCnxnctu9y0U5Ucg==", "license": "MIT", "dependencies": { "tslib": "^2.3.0" @@ -4605,18 +4652,18 @@ } }, "node_modules/body-parser": { - "version": "2.3.0", - "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-2.3.0.tgz", - "integrity": "sha512-2cGmJupaNgg+QUwVLAucDuWuoMZ6EX9iHDRswZ5lsNYEmwPaRknMPCLZz07yTzVq/83p4o/wzbDZbBrTvGGTIw==", + "version": "2.4.0", + "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-2.4.0.tgz", + "integrity": "sha512-Ifk1KcLrxaGt1occQagQNFNNOqRt1LFuehEnHHzB8Z6cRgIxRU1TBaiIsUiCdA+gy5PL7Y1IX31DNKkRmxtXjQ==", "license": "MIT", "dependencies": { "bytes": "^3.1.2", - "content-type": "^2.0.0", + "content-type": "^2.1.0", "debug": "^4.4.3", "http-errors": "^2.0.1", - "iconv-lite": "^0.7.2", + "iconv-lite": "^0.7.3", "on-finished": "^2.4.1", - "qs": "^6.15.2", + "qs": "^6.16.1", "raw-body": "^3.0.2", "type-is": "^2.1.0" }, @@ -5680,9 +5727,9 @@ } }, "node_modules/fast-uri": { - "version": "3.1.8", - "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.8.tgz", - "integrity": "sha512-GZMtZUTNRpOVIECoXwLNZS5xUGE+mVNbTB8h/7Rwh2TFWcBQiPzTgyZi05BF9UMZKkLJv8XBRJTlU7zg8+ZfMg==", + "version": "3.1.9", + "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.9.tgz", + "integrity": "sha512-hS/0Wt3Ya043oKXs0sIxrMpKQITXhMLIrVAKKXi4gozGC9v7YRWVnXIZzjNPTO02M9BdxLCWqK1yRXgNziVyJQ==", "dev": true, "funding": [ { @@ -6175,9 +6222,9 @@ } }, "node_modules/ip-address": { - "version": "10.7.3", - "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.7.3.tgz", - "integrity": "sha512-A1kdq/tSb5QjvKvAMgIoEvDBIgL7qaqVP/jkvSwYYRZ9iEzvPpopxp2wQfu3SuZRHtpHNxMn8Fs0bS+gf5Xmwg==", + "version": "10.7.5", + "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.7.5.tgz", + "integrity": "sha512-t2v0rkILYv9WXmSL7TpAaU3HXgaFYOPUcH3QHgwQ++gpJuH3bqyMy4Fvt/DJCTKwzH3Cf+bAp5W/mFL39KPLzA==", "dev": true, "license": "MIT", "engines": { @@ -7251,9 +7298,9 @@ } }, "node_modules/node-gyp/node_modules/undici": { - "version": "6.29.0", - "resolved": "https://registry.npmjs.org/undici/-/undici-6.29.0.tgz", - "integrity": "sha512-R+RODBqp6i2pPflGdq+xIOUkl+RNfGgHwoinecKu/JCuf2uO06cOKoDbI2P7Dn6KcswdKwrczbU6IYJ6K8X+wg==", + "version": "6.29.1", + "resolved": "https://registry.npmjs.org/undici/-/undici-6.29.1.tgz", + "integrity": "sha512-EvRlUt/QqAEvXdQeRMYUfwOQsfzpDztykrG2owGEE/rBOBoYv9uF39ZzsNDh4lTFHhTr2XOZjKkYgueD12ZmGA==", "dev": true, "license": "MIT", "engines": { @@ -7923,20 +7970,6 @@ "postcss": "^8.2.14" } }, - "node_modules/postcss-nested/node_modules/postcss-selector-parser": { - "version": "6.1.4", - "resolved": "https://registry.npmjs.org/postcss-selector-parser/-/postcss-selector-parser-6.1.4.tgz", - "integrity": "sha512-bIoJLOmjCO1S9XdY/DcnR5hJxvrDir1PbGChrzXG3vw0/FOliy/fA3dmdhQ441kah4gKv+TwckGzex6wNS5cnQ==", - "dev": true, - "license": "MIT", - "dependencies": { - "cssesc": "^3.0.0", - "util-deprecate": "^1.0.2" - }, - "engines": { - "node": ">=4" - } - }, "node_modules/postcss-safe-parser": { "version": "7.1.0", "resolved": "https://registry.npmjs.org/postcss-safe-parser/-/postcss-safe-parser-7.1.0.tgz", @@ -7965,9 +7998,9 @@ } }, "node_modules/postcss-selector-parser": { - "version": "6.0.10", - "resolved": "https://registry.npmjs.org/postcss-selector-parser/-/postcss-selector-parser-6.0.10.tgz", - "integrity": "sha512-IQ7TZdoaqbT+LCpShg46jnZVlhWD2w6iQYAcYXfHARZ7X1t/UGhhceQDs5X0cGqKvYlHNOuv7Oa1xmb0oQuA3w==", + "version": "6.1.5", + "resolved": "https://registry.npmjs.org/postcss-selector-parser/-/postcss-selector-parser-6.1.5.tgz", + "integrity": "sha512-TEHFzb5KRDKaOgJ4TYE+0jyJtFbjLvkdVOu0fZ2b6MTWzoqZd4Le+61aEppWkvTlYePgOX4ATL1wsAIPMLTw6Q==", "dev": true, "license": "MIT", "dependencies": { @@ -8034,9 +8067,9 @@ } }, "node_modules/qs": { - "version": "6.16.0", - "resolved": "https://registry.npmjs.org/qs/-/qs-6.16.0.tgz", - "integrity": "sha512-h6fhOIaRrID2CbEY2fqs+7t+UXZo+MLAnU5gRIq85uFtdiUPCdsApMlHhXogKVM4HM2DVbIjGNTTYH2OcmP1vA==", + "version": "6.16.1", + "resolved": "https://registry.npmjs.org/qs/-/qs-6.16.1.tgz", + "integrity": "sha512-5Px6J7rfHBAGUhNQ3es4YzcOdBBw0SDcVtThJml4RdnKw4tKs2epA0kPZ+K8X+WiHktT93RHVcQ/3ym5aTCgtg==", "license": "BSD-3-Clause", "dependencies": { "es-define-property": "^1.0.1", @@ -8943,20 +8976,6 @@ "url": "https://github.com/sponsors/jonschlinkert" } }, - "node_modules/tailwindcss/node_modules/postcss-selector-parser": { - "version": "6.1.4", - "resolved": "https://registry.npmjs.org/postcss-selector-parser/-/postcss-selector-parser-6.1.4.tgz", - "integrity": "sha512-bIoJLOmjCO1S9XdY/DcnR5hJxvrDir1PbGChrzXG3vw0/FOliy/fA3dmdhQ441kah4gKv+TwckGzex6wNS5cnQ==", - "dev": true, - "license": "MIT", - "dependencies": { - "cssesc": "^3.0.0", - "util-deprecate": "^1.0.2" - }, - "engines": { - "node": ">=4" - } - }, "node_modules/tailwindcss/node_modules/readdirp": { "version": "3.6.0", "resolved": "https://registry.npmjs.org/readdirp/-/readdirp-3.6.0.tgz", @@ -9208,9 +9227,9 @@ } }, "node_modules/undici": { - "version": "7.29.1", - "resolved": "https://registry.npmjs.org/undici/-/undici-7.29.1.tgz", - "integrity": "sha512-RYONW2MeafgYlkVOKYKkA/Ag7BmXqgIWCa8t1m0JcxrQg9pI9lEqRhAOruOBCbAohOa/gkCF+iPi9hrgvTzu6Q==", + "version": "7.30.1", + "resolved": "https://registry.npmjs.org/undici/-/undici-7.30.1.tgz", + "integrity": "sha512-03KrMbjIFDWQR5RNPrSw3bd1r12JpyFQl9/yxjUbJtqkjmllqC5lFjZh6ujeuJCKr8EOQvRW872Oy/az+nLYxg==", "dev": true, "license": "MIT", "engines": { diff --git a/src/frontend/package.json b/src/frontend/package.json index 3f36720..9a39b9a 100644 --- a/src/frontend/package.json +++ b/src/frontend/package.json @@ -58,6 +58,10 @@ "overrides": { "@modelcontextprotocol/sdk": "1.32.1", "piscina": "5.3.2", - "vite": "7.3.7" + "vite": "7.3.7", + "@angular/build": { + "undici": "7.30.1" + }, + "postcss-selector-parser": "6.1.5" } } From a4b2a597a0fa7d9b31c3401a1050d4741962ba57 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Enes=20Ya=C4=9F=C4=B1z?= Date: Tue, 27 Oct 2026 01:55:54 +0300 Subject: [PATCH 2/2] chore(deps): drop the stale braces audit allowlist entry The braces advisory is no longer reported by npm audit (the full audit covers dev dependencies and finds nothing), so the exception is stale and the gate's stale-entry check requires removing it. Co-Authored-By: Claude Opus 4.8 --- src/frontend/audit-allowlist.json | 13 +------------ 1 file changed, 1 insertion(+), 12 deletions(-) diff --git a/src/frontend/audit-allowlist.json b/src/frontend/audit-allowlist.json index 32f77eb..59ffafc 100644 --- a/src/frontend/audit-allowlist.json +++ b/src/frontend/audit-allowlist.json @@ -1,15 +1,4 @@ { "reviewBy": "2026-11-03", - "exceptions": [ - { - "id": "GHSA-vfj7-8cjw-p6xm", - "package": "braces", - "severity": "high", - "scope": "dev", - "via": "tailwindcss@3.4.19 > chokidar@3.6.0 > braces@3.0.3; tailwindcss@3.4.19 > micromatch@4.0.8 > braces@3.0.3 (fast-glob inherits it through micromatch)", - "reason": "No patched braces release exists (advisory range <=3.0.3, latest is 3.0.3). It is reachable only through the tailwindcss 3.4 devDependency, runs at build time on glob patterns from this repository, and is not part of the nginx runtime image. The only fix npm offers is tailwindcss 4, a held major.", - "exitCondition": "Remove when braces ships a patched release that tailwindcss 3.4 accepts, or when the Tailwind 4 migration is done.", - "added": "2026-10-03" - } - ] + "exceptions": [] }