Problem
The Verify Node 22 and Verify Node 24 jobs stop immediately in npm run audit, so no PR can reach typecheck, tests, lint, identity checks, or builds.
Observed while validating PR #1 on 2026-08-16: https://github.com/devswha/gajae-code-app/actions/runs/31960544884
Reproduction
npm ci
npm audit --audit-level=high
Result: exit code 1 with 16 vulnerabilities (6 moderate, 10 high).
High-severity chains currently include:
brace-expansion through ESLint / TypeScript ESLint / deslop-jsextract-zip through @puppeteer/browsers and @gajae-code/coding-agent (no fix currently reported)fast-uriip-addressjs-yamlnanoidundici directly and through release-it (force fix proposes breaking release-it@21)
Moderate findings also include DOMPurify, PostCSS, React Router, and node-tar.
Expected
npm run verify should reach the project checks on a clean checkout. Upgrade or override fixable transitive dependencies, make an explicit decision for the no-fix Puppeteer chain, and keep the audit gate meaningful rather than permanently red.
Problem
The
Verify Node 22andVerify Node 24jobs stop immediately innpm run audit, so no PR can reach typecheck, tests, lint, identity checks, or builds.Observed while validating PR #1 on 2026-08-16: https://github.com/devswha/gajae-code-app/actions/runs/31960544884
Reproduction
Result: exit code 1 with 16 vulnerabilities (6 moderate, 10 high).
High-severity chains currently include:
brace-expansionthrough ESLint / TypeScript ESLint / deslop-jsextract-zipthrough@puppeteer/browsersand@gajae-code/coding-agent(no fix currently reported)fast-uriip-addressjs-yamlnanoidundicidirectly and throughrelease-it(force fix proposes breakingrelease-it@21)Moderate findings also include DOMPurify, PostCSS, React Router, and node-tar.
Expected
npm run verifyshould reach the project checks on a clean checkout. Upgrade or override fixable transitive dependencies, make an explicit decision for the no-fix Puppeteer chain, and keep the audit gate meaningful rather than permanently red.