Pin two eslint transitives to clear the last audit advisories (#81) #102

Merged

claude-bot merged 1 commit from fix/audit-overrides into main

2026-09-01 15:14:34 +00:00

claude-bot commented

2026-09-01 15:08:15 +00:00

Contributor

Closes the remaining checkbox on #81. npm audit --audit-level=high now reports found 0 vulnerabilities.

Why a pin rather than a bump

Four of the six original advisories cleared through ordinary Renovate work (react-router-dom v7 for both moderates, plus nanoid, postcss, and — via #35 — the typescript-estree route to brace-expansion).

The last two were reachable only inside eslint's own dependency tree, at the latest published eslint (9.39.5):

eslint@9.39.5 → minimatch@3.1.5        → brace-expansion@1.1.14   (<=1.1.17, affected)
eslint@9.39.5 → @eslint/eslintrc@3.3.6 → js-yaml@4.3.0            (4.0.0-4.3.0, affected)

There is no newer eslint, so no dependency PR could ever have fixed these — waiting on Renovate meant waiting indefinitely on upstream.

"overrides": {
  "brace-expansion@1": "1.1.18",
  "js-yaml@4": "4.3.2"
}

Scoping and verification

The selectors are scoped by major so the healthy brace-expansion@5.0.9 used by @typescript-eslint/typescript-estree is left alone — a blanket "brace-expansion" key would have downgraded it and broken minimatch@10. Confirmed after the change:

eslint@9.39.5
├── @eslint/eslintrc@3.3.6 → js-yaml@4.3.2 overridden
└── minimatch@3.1.5 → brace-expansion@1.1.18 overridden
typescript-eslint@8.68.0
└── @typescript-eslint/typescript-estree@8.68.0 → minimatch@10.2.6 → brace-expansion@5.0.9

npm ci — what CI actually runs — accepts the regenerated lockfile (checked separately from npm install, since a package.json/lock mismatch would have broken every CI run).
npm audit --audit-level=high → 0 vulnerabilities, both after npm install and after a clean npm ci.
tsc -b, eslint, vitest (70 passed) and npm run build all clean.

Keeping the pins from rotting

Renovate does not manage overrides. These generate no update PRs and are never flagged stale, so the failure mode is a pin that looks protective while actually holding a package back.

#101 tracks removal, with a per-pin condition and the exact commands to check.
CONTRIBUTING.md gains a Dependency overrides subsection under Frontend setup pointing at #101 — package.json can't carry the comment itself, so the note goes where someone editing it would look.

🤖 Generated with Claude Code

Closes the remaining checkbox on #81. **`npm audit --audit-level=high` now reports `found 0 vulnerabilities`.** ## Why a pin rather than a bump Four of the six original advisories cleared through ordinary Renovate work (`react-router-dom` v7 for both moderates, plus `nanoid`, `postcss`, and — via #35 — the `typescript-estree` route to `brace-expansion`). The last two were reachable **only inside eslint's own dependency tree, at the latest published eslint (9.39.5)**: ``` eslint@9.39.5 → minimatch@3.1.5 → brace-expansion@1.1.14 (<=1.1.17, affected) eslint@9.39.5 → @eslint/eslintrc@3.3.6 → js-yaml@4.3.0 (4.0.0-4.3.0, affected) ``` There is no newer eslint, so no dependency PR could ever have fixed these — waiting on Renovate meant waiting indefinitely on upstream. ```json "overrides": { "brace-expansion@1": "1.1.18", "js-yaml@4": "4.3.2" } ``` ## Scoping and verification The selectors are scoped by major so the **healthy** `brace-expansion@5.0.9` used by `@typescript-eslint/typescript-estree` is left alone — a blanket `"brace-expansion"` key would have downgraded it and broken `minimatch@10`. Confirmed after the change: ``` eslint@9.39.5 ├── @eslint/eslintrc@3.3.6 → js-yaml@4.3.2 overridden └── minimatch@3.1.5 → brace-expansion@1.1.18 overridden typescript-eslint@8.68.0 └── @typescript-eslint/typescript-estree@8.68.0 → minimatch@10.2.6 → brace-expansion@5.0.9 ``` - `npm ci` — **what CI actually runs** — accepts the regenerated lockfile (checked separately from `npm install`, since a package.json/lock mismatch would have broken every CI run). - `npm audit --audit-level=high` → 0 vulnerabilities, both after `npm install` and after a clean `npm ci`. - `tsc -b`, `eslint`, `vitest` (70 passed) and `npm run build` all clean. ## Keeping the pins from rotting **Renovate does not manage `overrides`.** These generate no update PRs and are never flagged stale, so the failure mode is a pin that looks protective while actually holding a package back. - **#101** tracks removal, with a per-pin condition and the exact commands to check. - `CONTRIBUTING.md` gains a *Dependency overrides* subsection under Frontend setup pointing at #101 — `package.json` can't carry the comment itself, so the note goes where someone editing it would look. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

claude-bot added 1 commit

2026-09-01 15:08:15 +00:00

Pin two eslint transitives to clear the last audit advisories (#81 )

CI / Alembic migration check (pull_request) Successful in 40s

Details

CI / Python lint & type-check (pull_request) Successful in 1m14s

Details

CI / Frontend lint, test & build (pull_request) Successful in 1m29s

Details

CI / Python tests (pull_request) Successful in 2m8s

Details

CI / Docker build, health smoke & E2E (pull_request) Successful in 1m49s

Details

c106cc5237

npm audit --audit-level=high now reports 0 vulnerabilities.

Four of the six advisories cleared through ordinary Renovate bumps. The
remaining two -- brace-expansion via minimatch@3, js-yaml via
@eslint/eslintrc -- were reachable only inside eslint's own dependency tree
at the latest published eslint (9.39.5), so there was no version to bump to
and no dependency PR could ever have fixed them.

Both are pinned to patched in-range versions. The selectors are scoped by
major so the healthy brace-expansion@5.0.9 used by
@typescript-eslint/typescript-estree is left alone; verified with npm ls
after the change, and `npm ci` (what CI runs) accepts the regenerated
lockfile.

Renovate does not manage `overrides`, so these will not be flagged as stale
and could silently hold a package back. Removal conditions are tracked in
issue #101, and CONTRIBUTING.md now points at it from the frontend setup
section -- package.json cannot carry the comment itself.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

claude-bot merged commit 043f8bbf25 into main

2026-09-01 15:14:34 +00:00

claude-bot deleted branch fix/audit-overrides

2026-09-01 15:14:34 +00:00

claude-bot referenced this pull request

2026-09-01 15:14:46 +00:00

Clear the 6 open dependency advisories, and decide what the audit job gates #81