Repository navigation
chore: remediate transitive dependency advisories #116
Description
Finding
The current lockfile fails the repository dependency check because transitive packages are below current patched releases: Undici 5.28.4 brought by @vercel/node, vulnerable brace-expansion 1.x/5.x, and vulnerable nanoid 3.x/5.x.
Remediation in progress
A clean origin/main worktree raises existing pnpm override targets to patched releases and moves the @vercel/node build-time Undici edge to 6.29.0. The app imports @vercel/node only for request/response types in two API handlers. Focused validation shows pnpm run quality:dependencies has zero high/unexpected advisories, pnpm audit --audit-level high reports 0 high/critical (remaining 11 low and 34 moderate), TypeScript passes, and all 977 unit tests pass. Full quality/CI remains required before merge.
Acceptance
- Confirm the lockfile records patched versions with no high advisories.
- Run the complete project quality suite and current-main CI.
- Keep learning issue docs: add Maelstrom echo learning unit #115 open until the curriculum route is deployed and verified.
- Do not suppress or reclassify advisories to bypass the repository baseline.
Activity
sarthakagrawal927 commentedon Oct 2, 2026
Update: the bounded override and lockfile remediation is now included in the existing PR #115 at commit
ebc5f80. It is no longer a separate PR. The dependency gate reports zero high/unexpected advisories, TypeScript passes, and all 977 unit tests pass. Localpnpm run qualitystopped at the build-env gate requiringVITE_GOOGLE_CLIENT_ID; I left environment files and values untouched. This issue remains open until #115 passes current-main CI and merges; learning/deployment acceptance remains tracked separately.sarthakagrawal927 commentedon Oct 2, 2026
The patched dependency remediation is merged in #115; exact-main CI passed at a250743 (run 37009169043). Dependency gate and audit evidence are recorded in the publication receipt. Closing the bounded advisory follow-up; the Maelstrom lesson delivery issue remains separate.