docs(deps): record advisory remediation

2026-08-10 00:42:41 +02:00
parent b55a592b2c
commit d7b556e494
6 changed files with 78 additions and 15 deletions
@@ -168,3 +168,4 @@ Output was reduced to filenames and commit counts. The token artifact appears un
 | V-134 | Focused `EmailSendControllerTests|EmailSendAttemptStoreTests|EmailControllerTests`; full backend; staged diff/secret-name/whitespace review | Repository root | Verify explicit confirmation, bounded input, owner isolation, canonical idempotency, rate-limited provider admission, correspondence/audit transaction and failed/uncertain behavior | PASS — focused 12/12; full backend 619/619; no whitespace errors or secret values. Provider called once across duplicate requests; cross-tenant/unconfirmed/malformed requests never reserve or deliver | SQLite and fake provider only. No real provider/email/network/browser/production execution. Crash-abandoned `sending` reconciliation remains | External provider/runtime limitation |
 | V-135 | Focused correspondence-inbox Jest; full frontend Jest; `npm.cmd run build`; `git diff --check` | `job-tracker-ui` / repository root | Verify editable provider-bound reply, visible review fields, confirmation/cancel, one UUID, sent/uncertain duplicate safety, responsive TypeScript/build and regression hygiene | PASS — focused 7/7; full 49/49 suites and 190/190 tests; production build; no whitespace errors | JSDOM and mocked API/provider data only; no running browser/provider/email. Full Jest took 75.632s and retained the existing force-exit/open-handle notice | Browser/provider/production limitation |
 | V-136 | Focused `EmailSendAttemptStoreTests|EmailSendControllerTests`; full backend; provider-dependency search; `git diff --check` | Repository root | Verify restart recovery, stale/fresh boundary, pending-failed versus sending-uncertain classification, two-owner notification isolation, idempotency and absence of provider retries | PASS — focused 10/10; full backend 620/620; repeated recovery 0/0; each owner sees one content-free notification; recovery code has no provider/SMTP dependency; no whitespace errors | Real SQLite and manual clock; no process kill, MariaDB, provider, email or production runtime. Five-minute scan performance is unmeasured on a large ledger | Runtime/performance limitation |
+| V-137 | `npm.cmd ls react-router-dom react-router js-yaml nanoid --all --depth=4`; `npm.cmd audit`; six focused router suites; full `npm.cmd test -- --runInBand`; `npm.cmd run build`; staged diff review | `job-tracker-ui` / repository root | Resolve the frontend advisory gate without an unreviewed forced update and verify the React Router v7 compatibility path | PASS — audit reports 0 vulnerabilities; focused 6/6 suites and 24/24 tests; full 49/49 suites and 190/190 tests; production build/TypeScript/static generation pass; `b55a592` pushed | CI/live deployment has not yet consumed the pushed commit; no deployment or production access occurred | Deployment verification pending |