Harden deps: take the npm fixes that fit the current major versions - #5359
Conversation
`npm audit fix` (no --force) on frontend/, which resolves 4 of the 9 advisories without leaving the declared semver ranges. package.json is untouched; only the lockfile moves, all bumps patch-level. Fixed: postcss 8.5.14 -> 8.5.26 (high, path traversal via sourceMappingURL), nanoid 3.3.12 -> 3.3.18 (high, infinite loop on non-positive size), @babel/core 7.29.0 -> 7.29.7 (low, arbitrary file read), @remix-run/router 1.23.2 -> 1.23.4 with react-router(-dom) 6.30.3 -> 6.30.6 (moderate, open redirect). The remaining 5 all require a major upgrade -- vite 5 -> 8, i18next-http-backend 2 -> 4, react-router-dom 6 -> 7 -- and are left for a deliberate decision rather than folded in here. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016eYYxAxXQk6munsK57TfH9
✅ Drift Bot (ClawMetry): no drift detectedDrift Bot analyzed the changed files against this project's blueprints and requirements and found no drift. |
✅ Drift Bot (ClawMetry): no drift detectedDrift Bot analyzed the changed files against this project's blueprints and requirements and found no drift. |
|
✨ auto-fixed: merged main (14572bc) into branch to resolve BEHIND state Generated by Claude Code |
|
| Runner label | Outcome |
|---|---|
windows-latest |
API Tests ✅, pip install ✅ — both ran |
macos-latest |
API Tests ✅, pip install ✅ — both ran |
ubuntu-latest |
11 jobs queued 30+ min, never scheduled |
The gate's own hint — "a check stuck at 'not reported' usually means its workflow did not run for this commit" — points at a paths filter. That is not the cause here: these jobs exist in run 33275319604, they are simply unscheduled.
It is repo-wide, not this branch
Four full CI runs all started within 13 seconds of each other at 21:09 and were all still in_progress at 21:40 — this PR plus #5256, #5257 and #5354. The ubuntu-latest allowance is saturated by that pile-up.
A one-file package-lock.json change cannot influence runner scheduling, and the legs it would plausibly touch — Syntax & Lint, OSS golden path, PR build, the CodeQL javascript-typescript analysis — all ran and all passed on this exact head, along with drift-bot and the product-record gate.
What I am doing
Holding the single permitted re-run rather than spending it now. Re-running the gate while the ubuntu queue is still drained just starts another 1800s poll against jobs that still cannot get a runner, and burns the re-run for nothing. Once the queue clears and the legs report, I will re-run the gate once against completed legs.
No code change is warranted, and I am not pushing an empty commit to kick CI. The PR stays watched with a check-in scheduled until it is green.
Generated by Claude Code
✅ Drift Bot (ClawMetry): no drift detectedDrift Bot analyzed the changed files against this project's blueprints and requirements and found no drift. |
|
✨ auto-fixed: merged main into branch (was BEHIND at 14572bc) Generated by Claude Code |
Two findings on the new head — one about CI, one you should decide before merging this1. The CI run was cancelled repo-wide, not failed
The CI run for this head ( It was not this branch. Around 00:35–00:37 roughly twenty CI runs were cancelled across unrelated PRs — runs #9141–#9161, spanning dependabot branches,
The trigger looks like the ~00:09 batch that merged I have re-run CI for this head. No commit was pushed for it and no empty commit was used. For the record, this PR was fully green on the previous head 2. This PR overlaps four open Dependabot PRs — worth deciding before mergeSince #5252 put
I should have checked for these before opening this PR; my scan looked only for open It is a real choice, not automatically a reason to close this. Merging this one lands the four in-range fixes as a single internally-consistent Either way #5241 and #5247 stay open, and the major upgrades stay a separate decision. Generated by Claude Code |
Green, except one CodeQL leg I cannot retry — needs a click from youEverything actionable is now passing on
The one loose end
That 00:36:54 timestamp is the same repo-wide mass cancellation described above — CodeQL was a third casualty alongside CI and the gate. Nothing failed analysis; the I cannot clear this myself. CodeQL default-setup runs refuse an API retry: I re-ran CI and the E2E Gate, but that route is closed for this one, and I will not push an empty commit to force it. Two ways to clear it: re-run the CodeQL run from the Actions UI, or let it re-trigger on the next push to this branch. Worth doing rather than ignoring, even though it does not block merge: this is a security PR, and Generated by Claude Code |
✅ Drift Bot (ClawMetry): no drift detectedDrift Bot analyzed the changed files against this project's blueprints and requirements and found no drift. |
1 participant
Product record:
No-PRD: dependency-only security update. No product behaviour changes —
package.jsonis untouched, every bump is patch-level within the already-declared semver ranges, and the rebuilt bundle is equivalent in module count and size..github/dependabot.ymlgained itsnpmentries in #5252, sofrontend/is now watched — but Dependabot only opens PRs for future drift. The advisories that were already open when it was wired up still need one deliberate pass. This is that pass, restricted to what can be taken without a major upgrade.What changes
One file:
frontend/package-lock.json. The output ofnpm audit fix— without--force.package.jsonis not modified, so no declared range moves; all 27 lockfile bumps are patch-level resolutions inside the existing ranges.Advisory count on
frontend/: 9 → 5.postcssnanoid@babel/core@remix-run/routerreact-router/react-router-domThe other 21 changed entries are transitive
@babel/*andbrowserslist/caniuse-litedata packages pulled along by those four.Not in this batch, deliberately
The remaining 5 advisories have no in-range fix — each needs a major upgrade, which is an API-compatibility decision rather than a lockfile bump, and does not belong in a PR whose whole claim is "nothing changes":
vite(+ itsesbuild)react-router-domsrc/i18next-http-backendi18next^23Splitting each into its own PR, with the migration actually exercised, is the honest way to take them. Flagging rather than folding them in.
Test plan
npm cifrom the new lockfile resolves with no drift — the lockfile is internally consistent, not just editednpm run build(tsc -b && vite build) succeeds: 609 modules transformed, identical to the pre-change baselinenpm auditre-run: 9 → 5, and every survivor reportsisSemVerMajor: true— i.e. nothing in-range was left on the tableclawmetry/static/v2/dist/deliberately not committed;publish.ymlandrelease-on-merge.ymlboth rebuild the SPA from source, so the diff stays one filescripts/check_product_record.pyrun against this exact body —frontend/package-lock.jsonis outside the exempt paths, so theNo-PRD:line above is required. It must begin its own line:OPT_OUTis anchored^\s*No-PRD:, so prefixing it inline with the bold label (as this body first did) does not match and correctly fails the gate.