fix(deploy): patch audited frontend dependencies

2026-10-17 21:02:45 +02:00
parent e7dba9a2f7
commit 2278473763
7 changed files with 329 additions and 184 deletions
@@ -0,0 +1,37 @@
+# 17 October 2026 release repair
+
+The owner authorized promotion of completed `e7dba9a` to main despite existing production NO-GO qualifications, then requested deployment first, `qwen3.5:9b-q4_K_M` on Ollama second, and continued Phase 7 work afterward. Unfinished Settings/import/company changes remain outside this release repair.
+
+## Deployment findings
+
+Gitea run 820 initially failed during parser dependency installation: one attempt segfaulted and subsequent downloads failed locked hashes. An unchanged-release retry failed during Git checkout with a corrupt pack. A later attempt passed these stages and the backend checks, then failed the frontend audit with 19 moderate, 9 high and 1 critical findings.
+
+The NumPy lock hash was already correct. Independent Windows verification and three fresh downloads on the supplied runner host matched the published SHA-256 and passed ZIP CRC checks. The host had rebooted between the earlier failures and these checks; the underlying integrity incident is not diagnosed or declared repaired. Hash enforcement and all ordinary test gates remain enabled.
+
+Server source edits were preserved privately at `/home/pi/.local/state/jobjakt/pre-release-source-20261017T185504Z`. The only content change was `GOMAXPROCS=1` for bundled Ollama, which this repair retains. The deploy script's executable bit is already restored by the deployment workflow. No database, volume or user data was reset.
+
+## Bounded dependency changes
+
+| Dependency | Locked before | Locked after |
+|---|---|---|
+| Next.js and matching ESLint/SWC packages | 16.3.4 | 16.3.8 |
+| Axios | 1.19.0 | 1.20.0 |
+| brace-expansion | 2.1.4 | 2.1.7 |
+| sharp and its matching platform payloads | 0.35.4 | 0.35.5 |
+| source-map-js | 1.2.1 | 1.2.2 |
+
+React, MUI, routing, application data owners and PDF geometry are unchanged. The production-only audit reports zero vulnerabilities.
+
+## Explicit temporary development exception
+
+The owner separately approved **GHSA-vfj7-8cjw-p6xm** in dev-only `braces` through **31 October 2026 UTC**. [The upstream advisory](https://github.com/advisories/GHSA-vfj7-8cjw-p6xm) lists no patched version. Its five linked audit nodes are `braces`, `micromatch`, `fast-glob`, `@next/eslint-plugin-next` and `eslint-config-next`; this is one advisory, not five independent accepted vulnerabilities.
+
+The audit checker accepts only that high-severity origin, the explicit existing chain, `braces` 3.0.3, and lockfile nodes marked development-only. Production copies, another advisory, critical severity, missing data/nodes, cyclic origins and expiry fail closed. Full audit JSON is saved and printed in CI. All other high/critical findings remain blocking; the existing moderate threshold is retained. The raw full audit still reports the accepted development findings; they are not described as fixed.
+
+Nine ordinary policy tests cover the exception and its rejection boundaries. The previous strict policy was captured failing the approved exception, and a critical-origin edge case was separately reproduced and repaired. The exception must be removed when upstream supplies a fix or explicitly reviewed before expiry; it does not authorize a future blanket bypass.
+
+## Verification and remaining work
+
+Application TypeScript, lint, production build, backend Release compilation, production audit, policy tests and supply-chain/ingress tests pass. Settings persistence, authentication/account isolation and ordinary P2-D01 browser journeys pass (16 cases, zero skipped/flaky).
+
+Fresh full frontend execution passed 824 tests across 95 suites, with zero skipped or pending cases (18:49-18:58 UTC). The nine separate audit-policy cases also pass. Supply-chain and ingress checks each passed three cases; whitespace and the tracked-secret scan passed. No existing test counts were reduced. Evidence is retained in the local release-20261017 artifact directory. CI and deployed runtime identity must be checked after promotion. Existing ingress, complete backup/restore, rollback, human accessibility/device and production-output qualifications remain open; deployment authorization does not convert them to verified GO. P5-13 stays withheld and no model qualification or Phase 8 work is enabled.