docs(deps): record advisory remediation

2026-08-10 00:42:41 +02:00
parent b55a592b2c
commit d7b556e494
6 changed files with 78 additions and 15 deletions
@@ -745,6 +745,24 @@ Ordering differences from the suggested list:
 - **Commit:** none.
 - **Remaining work:** create early and update per package; final sweep last.

+### DEP-001 — Frontend advisory deployment gate
+
+- **Source programme:** live deployment blocker reported 2026-08-10; audit supply-chain finding.
+- **Original requirement references:** user deployment failure report; JT-017.
+- **Related findings:** JT-017.
+- **Priority:** P0 release blocker.
+- **Dependencies:** none for repository remediation; CI/live access for final verification.
+- **Affected components:** `job-tracker-ui/package.json`, lockfile, RouterProvider compatibility and Jest jsdom setup.
+- **Acceptance criteria:** npm audit is clean without suppressing advisories; production build and route regressions pass; CI consumes the fixed lockfile; live deployment proceeds.
+- **Required tests:** resolved dependency tree, `npm audit`, focused router tests, full frontend tests and production build.
+- **Required browser verification:** route/navigation smoke after deployment; existing automated route coverage is required before push.
+- **Required production verification:** CI audit and live deployment from the fixed commit.
+- **Status:** `VERIFIED LOCALLY`.
+- **Blocker:** final deployment verification depends on the remote CI/live environment.
+- **Evidence:** `docs/verification/dep-001-frontend-advisories.md`; V-137; audit 0 vulnerabilities, focused 24/24, full 190/190 and production build pass.
+- **Commit:** `b55a592` (pushed).
+- **Remaining work:** observe CI/live deployment, run route smoke and update to `DONE` only after production verification.
+
 ### REL-001 — Production validation and remaining audit closure

 - **Source programme:** both final reports and production validation.