WealthLedger/backend
5
0
Fork 0
Code Issues 7 Pull Requests 1 Actions 1 Packages Projects Releases Wiki Activity

ci: drop stale npm audit advisory ignore (WealthLedger/backend#158) #159

Merged
codex-bot merged 1 commits from chore/158-drop-stale-audit-ignore into develop 2026-11-03 12:04:10 +03:00
Conversation 0 Commits 1 Files Changed 1
+1 -1
codex-bot commented 2026-11-03 11:08:26 +03:00
Owner
Copy Link
Copy Source

Summary

Убран флаг --ignore-advisory=GHSA-hp3w-g68c-fv3c из dev-аудита в job security: advisory больше не присутствует в зависимостях, исключение устарело и не имело записанной причины.

Linked Issue

Closes WealthLedger/backend#158. Refs WealthLedger/main#5 (08.root).

Changes

  • .gitea/workflows/verify.yml: одна строка, dev-аудит npm audit --include=dev --audit-level=high без исключений. Пороги, Gitleaks, lock-файл не менялись.

Verification

  • Локально на develop aeb4647: npm audit --omit=dev --audit-level=low rc=0 (0 vulnerabilities), npm audit --include=dev --audit-level=high rc=0 без флага. Остаются 2 moderate advisory (glob GHSA-3g3m-2fjr-6pw4, minimatch GHSA-g3hv-75wg-m249) ниже порога high; на CI это не влияет.
  • git diff --check: OK. Результат CI security проверяю на этом PR.
  • Ограничения: dev-аудит с --audit-level=high не ловит moderate; их регулярное обновление отдельно (main#6).

Breaking Changes (если есть)

Нет.

## Summary Убран флаг `--ignore-advisory=GHSA-hp3w-g68c-fv3c` из dev-аудита в job `security`: advisory больше не присутствует в зависимостях, исключение устарело и не имело записанной причины. ## Linked Issue Closes WealthLedger/backend#158. Refs WealthLedger/main#5 (08.root). ## Changes - `.gitea/workflows/verify.yml`: одна строка, dev-аудит `npm audit --include=dev --audit-level=high` без исключений. Пороги, Gitleaks, lock-файл не менялись. ## Verification - Локально на develop `aeb4647`: `npm audit --omit=dev --audit-level=low` rc=0 (0 vulnerabilities), `npm audit --include=dev --audit-level=high` rc=0 без флага. Остаются 2 moderate advisory (`glob` GHSA-3g3m-2fjr-6pw4, `minimatch` GHSA-g3hv-75wg-m249) ниже порога high; на CI это не влияет. - `git diff --check`: OK. Результат CI `security` проверяю на этом PR. - Ограничения: dev-аудит с `--audit-level=high` не ловит moderate; их регулярное обновление отдельно (main#6). ## Breaking Changes (если есть) Нет.
codex-bot added 1 commit 2026-11-03 11:08:27 +03:00
ci: drop stale npm audit advisory ignore (WealthLedger/backend#158)
Backend verify / commits (pull_request) Successful in 1m21s
Details
Backend verify / security (pull_request) Successful in 1m7s
Details
Backend verify / verify (pull_request) Successful in 5m51s
Details
1919d766e6
codex-bot merged commit 1a5de9bebd into develop 2026-11-03 12:04:10 +03:00
codex-bot deleted branch chore/158-drop-stale-audit-ignore 2026-11-03 12:04:10 +03:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
Kind/Dependencies
Dependency update or dependency-management work
 Kind/Investigation
Research or decision required before implementation
 Kind/Process
Developer workflow, CI/CD, tooling, or process improvement
 Kind/Refactor
Internal code or configuration restructuring without new product behavior
 audit/2026-10-11
Technical Audit Remediation — 2026-10-11
 kind/investigation
Нужна проверка evidence до решения; runtime-дефект не утверждается
Compat/Breaking
Breaking change that won't be backward compatible
 Kind/Bug
Something is not working
 Kind/Documentation
Documentation changes
 Kind/Enhancement
Improve existing functionality
 Kind/Feature
New functionality
 Kind/Security
This is security issue
 Kind/Testing
Issue or pull request related to testing
Priority
Critical
1
The priority is critical
Priority
High
2
The priority is high
Priority
Medium
3
The priority is medium
Priority
Low
4
The priority is low
Reviewed
Confirmed
1
Issue has been confirmed
Reviewed
Duplicate
2
This issue or pull request already exists
Reviewed
Invalid
3
Invalid issue
Reviewed
Won't Fix
3
This issue won't be fixed
Status
Blocked
1
Something is blocking this issue or pull request
Status
Need More Info
2
Feedback is required to reproduce issue or to continue work
Status
Abandoned
3
Somebody has started to work on this but abandoned work
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
codex-bot hermes-agent ksv741 publisher-bot renovate-bot
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: WealthLedger/backend#159