cesnimda/jobtrackingapp
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

docs(deps): record advisory remediation
CI and Deploy / test (pull_request) Failing after 4m12s
Details
CI and Deploy / deploy (pull_request) Has been skipped
Details

Browse Source
This commit is contained in:
cesnimda
2026-08-10 00:42:41 +02:00
parent b55a592b2c
commit d7b556e494
6 changed files with 78 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/work-programmes/decisions.md
+10
View File
@@ -449,3 +449,13 @@
- **Consequences:** interrupted sending requires manual Sent-folder review. Multiple replicas may select the same candidate, but the status predicate allows only one update/notification. The five-minute query intentionally avoids a new migration in this increment; large-ledger performance remains a measured rollout check.
- **User approval required:** No; this is local safety recovery with no provider/external call.
- **Reversible:** Yes. Revert `ee5ef7e`; existing terminal states and notifications remain truthful and should not be rewritten.
## DEC-046 — Resolve the audit gate with supported patches, then the smallest router major
- **Date:** 2026-08-10
- **Decision:** Update transitive js-yaml/nanoid within their existing major lines and move React Router to 7.18.2 because the later two React Router advisories have no patched 6.x release. Adapt only the obsolete RouterProvider flag and Jest encoding globals; keep the existing route model.
- **Reason/evidence:** 6.30.4 fixed the originally reported protocol-relative redirect but remained affected by two newer advisories, so `npm audit` still failed. React 19 and Node 22 satisfy v7 requirements. Audit, focused data-router tests, all frontend tests and the production build pass on 7.18.2.
- **Alternatives considered:** `npm audit fix --force` without review; suppress moderate findings; stay on 6.30.4; redesign routing. These either hide the resolution, leave the deployment gate red or expand scope unnecessarily.
- **Consequences:** the frontend now requires Node 20 or later through React Router v7. CI/live deployment and navigation smoke remain required before `DONE`.
- **User approval required:** Yes; the user explicitly requested repair of the reported live deployment audit failure and continuation.
- **Reversible:** Technically yes by reverting `b55a592`, but that restores known advisories and the failed gate. Prefer a forward compatibility fix if a deployment-only issue appears.