cesnimda
39 lines
2.4 KiB
Markdown
39 lines
2.4 KiB
Markdown
# DEP-001 frontend advisory remediation
|
|
|
|
Updated: 2026-08-10
|
|
|
|
Status: `VERIFIED LOCALLY`. Remote pull-request run 609 passes the complete CI job, including dependency audit and browser smoke. Live deployment still requires an approved merge-to-main and production verification.
|
|
|
|
## Trigger
|
|
|
|
The live deployment pipeline failed its frontend dependency audit on five advisories: React Router/@remix-run/router, js-yaml and nanoid.
|
|
|
|
## Resolution
|
|
|
|
- Upgraded `react-router-dom` from the vulnerable 6.x line to `7.18.2`, covering the subsequently reported React Router advisories.
|
|
- Refreshed transitive `js-yaml` from `3.15.0` to `3.15.1` and `nanoid` from `3.3.16` to `3.3.18` through normal lockfile resolution.
|
|
- Removed the obsolete v6 `RouterProvider` future flag. Existing route definitions and URLs were not redesigned.
|
|
- Supplied Node's `TextEncoder`/`TextDecoder` to Jest's jsdom environment for React Router v7 module initialization.
|
|
- Did not run `npm audit fix --force`; the explicit upgrade and resolved lockfile were reviewed.
|
|
|
|
## Verification
|
|
|
|
- `npm.cmd audit`: PASS, zero vulnerabilities.
|
|
- Focused data-router regression: 6 suites, 24 tests passed.
|
|
- Full frontend regression: 49 suites, 190 tests passed.
|
|
- `npm.cmd run build`: PASS, production compilation, TypeScript and static generation.
|
|
- Resolved versions: `react-router-dom`/`react-router` `7.18.2`, `js-yaml` `3.15.1`, `nanoid` `3.3.18`.
|
|
- Commit: `b55a592` (pushed to `release-readiness`).
|
|
- Gitea pull-request run 608: `Audit frontend dependencies` PASS; the job advanced through frontend tests and failed later at `Test browser smoke flows` because `e2e/smoke.spec.ts` still expected intentionally removed page copy.
|
|
- Corrected smoke assertion: full local Playwright suite 4/4 passed against disposable local API/frontend data.
|
|
- Smoke correction commit: `75bf144` (pushed to `release-readiness`).
|
|
- Gitea replacement run 609: complete pull-request test job PASS in 4m20s. The deploy job was skipped by its intentional `push`/`main` condition.
|
|
|
|
## Remaining gate
|
|
|
|
Merge only when the full release-readiness branch is approved, then observe the `main` deploy and run production route smoke. No production access or deployment was performed in this session.
|
|
|
|
## Rollback
|
|
|
|
Reverting `b55a592` restores the previous router/test setup but also restores known vulnerable packages and the deployment-blocking audit result. Prefer fixing any v7 compatibility regression forward; do not suppress the audit without a reviewed exception.
|