WealthLedger/frontend
5
0
Fork 0
Code Issues 3 Pull Requests Actions Packages Projects Releases Wiki Activity

chore: resolve dev dependency audit findings (WealthLedger/frontend#103) #104

Merged
codex-bot merged 2 commits from chore/audit-dev-deps into develop 2026-10-23 14:13:09 +03:00
Conversation 0 Commits 2 Files Changed 5
+291 -197
codex-bot commented 2026-10-23 09:31:20 +03:00
Owner
Copy Link
Copy Source

Closes #103

Изменения

  • storybook 10.6.0 → 10.6.3 (critical), vite 8.3.0 → 8.3.5 (high), vitest и @vitest/* 5.0.0 → 5.0.5 (moderate), ip-address → 10.7.4 (moderate).
  • Транзитивные @vitest/browser, @vitest/ui, @vitest/mocker закреплены через overrides на 5.0.5 (иначе peer-зависимости не сходились).
  • packages/ui и packages/icons выровнены по тем же версиям.
  • Только semver-патчи и minor, без major-обновлений и без изменений кода.

Проверки (Node 24.22.1)

  • npm audit --include=dev --audit-level=low: found 0 vulnerabilities (было 9).
  • npm run verify целиком зелёный (exit 0): 67/67 файлов, 461 тест, depcruise, knip, build, storybook build. Для этого на время проверки наложен #98 (дата-зависимый тест); в этом PR его нет и он не нужен для аудита.
  • commitlint --strict: OK.

Порядок merge

Этот PR можно мержить сразу. До него security в frontend падает, поэтому #99, #100 и #96 пока заблокированы.

Closes #103 ## Изменения - `storybook` 10.6.0 → 10.6.3 (critical), `vite` 8.3.0 → 8.3.5 (high), `vitest` и `@vitest/*` 5.0.0 → 5.0.5 (moderate), `ip-address` → 10.7.4 (moderate). - Транзитивные `@vitest/browser`, `@vitest/ui`, `@vitest/mocker` закреплены через `overrides` на 5.0.5 (иначе peer-зависимости не сходились). - `packages/ui` и `packages/icons` выровнены по тем же версиям. - Только semver-патчи и minor, без major-обновлений и без изменений кода. ## Проверки (Node 24.22.1) - `npm audit --include=dev --audit-level=low`: **found 0 vulnerabilities** (было 9). - `npm run verify` целиком зелёный (exit 0): 67/67 файлов, 461 тест, depcruise, knip, build, storybook build. Для этого на время проверки наложен #98 (дата-зависимый тест); в этом PR его нет и он не нужен для аудита. - commitlint --strict: OK. ## Порядок merge Этот PR можно мержить сразу. До него `security` в frontend падает, поэтому #99, #100 и #96 пока заблокированы.
codex-bot added the Kind/Bug label 2026-10-23 09:31:20 +03:00
codex-bot added 1 commit 2026-10-23 09:31:21 +03:00
chore: resolve dev dependency audit findings (WealthLedger/frontend#103)
Frontend verify / commits (pull_request) Successful in 35s
Details
Frontend verify / security (pull_request) Successful in 10s
Details
Frontend verify / verify (pull_request) Failing after 5m35s
Details
e1e9431e20 
Bump storybook, vite, vitest and @vitest/* to patched versions, pin
transitive @vitest/* via overrides, and bump ip-address. npm audit
--include=dev now reports 0 vulnerabilities; the security job passes.
ksv741 added 1 commit 2026-10-23 10:07:43 +03:00
test: pin date in account events date filter test (WealthLedger/frontend#98)
Frontend verify / commits (pull_request) Successful in 40s
Details
Frontend verify / security (pull_request) Successful in 10s
Details
Frontend verify / verify (pull_request) Successful in 6m47s
Details
5f66eba5f8 
The test clicked today + 10 days, which falls outside the Mantine
calendar grid for some real dates and made the suite fail depending
on the run date.
codex-bot merged commit 7b6f34c776 into develop 2026-10-23 14:13:09 +03:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
Kind/Dependencies
Dependency update or dependency-management work
 Kind/Investigation
Research or decision required before implementation
 Kind/Process
Developer workflow, CI/CD, tooling, or process improvement
 Kind/Refactor
Internal code or configuration restructuring without new product behavior
 audit/2026-10-11
Technical Audit Remediation — 2026-10-11
 kind/investigation
Нужна проверка evidence до решения; runtime-дефект не утверждается
Compat/Breaking
Breaking change that won't be backward compatible
 Kind/Bug
Something is not working
 Kind/Documentation
Documentation changes
 Kind/Enhancement
Improve existing functionality
 Kind/Feature
New functionality
 Kind/Security
This is security issue
 Kind/Testing
Issue or pull request related to testing
Priority
Critical
1
The priority is critical
Priority
High
2
The priority is high
Priority
Medium
3
The priority is medium
Priority
Low
4
The priority is low
Reviewed
Confirmed
1
Issue has been confirmed
Reviewed
Duplicate
2
This issue or pull request already exists
Reviewed
Invalid
3
Invalid issue
Reviewed
Won't Fix
3
This issue won't be fixed
Status
Blocked
1
Something is blocking this issue or pull request
Status
Need More Info
2
Feedback is required to reproduce issue or to continue work
Status
Abandoned
3
Somebody has started to work on this but abandoned work
No labels Kind/Bug
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
codex-bot hermes-agent ksv741 publisher-bot renovate-bot
No Assignees
2 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: WealthLedger/frontend#104