fix(deps): restore backend security gate #45

Merged

ksv741 merged 3 commits from codex/release-readiness-fixes into develop 2026-10-07 15:35:50 +03:00

Conversation 0 Commits 3 Files Changed 4

+23 -12

codex-bot commented 2026-10-07 15:20:57 +03:00

Owner

Copy Link

Copy Source

Release-readiness fix:

• pin patched runtime proxy-addr@2.0.8, removing GHSA-jqcg-44mw-7w3h;
• audit every runtime advisory and high/critical findings in the full dev tree;
• document the currently unfixable dev-only moderate sprintf-js finding;
• merge origin/main with preserved history so develop again contains main.

The previous zero-diff PR #44 was closed because its head was the stale main commit, so CI never saw these fixes.

Local verification: npm ci; runtime audit; full-tree high audit; npm run verify; npm run test:e2e; git diff --check.

Release-readiness fix: - pin patched runtime `proxy-addr@2.0.8`, removing GHSA-jqcg-44mw-7w3h; - audit every runtime advisory and high/critical findings in the full dev tree; - document the currently unfixable dev-only moderate `sprintf-js` finding; - merge `origin/main` with preserved history so `develop` again contains main. The previous zero-diff PR #44 was closed because its head was the stale `main` commit, so CI never saw these fixes. Local verification: `npm ci`; runtime audit; full-tree high audit; `npm run verify`; `npm run test:e2e`; `git diff --check`.

codex-bot added 3 commits 2026-10-07 15:20:58 +03:00

Merge branch 'develop' into main 51f345bdc5

fix(deps): restore backend security gate 30e96e51e2

chore: synchronize main history into develop 5a33fb6dec

ksv741 merged commit 30e96e51e2 into develop 2026-10-07 15:35:50 +03:00

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

Clear labels

Kind/Dependencies

Dependency update or dependency-management work

Kind/Investigation

Research or decision required before implementation

Kind/Process

Developer workflow, CI/CD, tooling, or process improvement

Kind/Refactor

Internal code or configuration restructuring without new product behavior

audit/2026-10-11

Technical Audit Remediation — 2026-10-11

kind/investigation

Нужна проверка evidence до решения; runtime-дефект не утверждается

Compat/Breaking

Breaking change that won't be backward compatible

Kind/Bug

Something is not working

Kind/Documentation

Documentation changes

Kind/Enhancement

Improve existing functionality

Kind/Feature

New functionality

Kind/Security

This is security issue

Kind/Testing

Issue or pull request related to testing

Priority

Critical

1

The priority is critical

Priority

High

2

The priority is high

Priority

Medium

3

The priority is medium

Priority

Low

4

The priority is low

Reviewed

Confirmed

1

Issue has been confirmed

Reviewed

Duplicate

2

This issue or pull request already exists

Reviewed

Invalid

3

Invalid issue

Reviewed

Won't Fix

3

This issue won't be fixed

Status

Blocked

1

Something is blocking this issue or pull request

Status

Need More Info

2

Feedback is required to reproduce issue or to continue work

Status

Abandoned

3

Somebody has started to work on this but abandoned work

No labels

Milestone

No items

No Milestone

Projects

Clear projects

No projects

Assignees

Clear assignees

codex-bot hermes-agent ksv741 publisher-bot renovate-bot

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: WealthLedger/backend#45