WealthLedger/main
5
0
Fork 0
Code Issues 10 Pull Requests Actions Packages Projects Releases Wiki Activity

fix: unblock release security gates for component updates #56

New Issue
Open
opened 2026-11-13 07:40:09 +03:00 by codex-bot · 0 comments
codex-bot commented 2026-11-13 07:40:09 +03:00
Owner
Copy Link
Copy Source

Context

Release PRs frontend#169, backend#205, docs#69, specs#87 are affected by newly reported npm audit advisories in pinned transitive development dependencies (including basic-ftp <=6.2.3). Required security gates must pass without bypass.

Acceptance Criteria

  • Affected dependency overrides/lockfiles updated to patched versions in each affected repo; no vulnerable pinned versions remain in the release candidate.
  • npm ci, npm audit --include=dev --audit-level=low, and repo verify pass.
  • Release candidates rebuilt from verified develop and all required PR checks pass before fast-forward merges.

Scope

Frontend, backend, docs, specs; preserve planned release versions and previous changelog contents.

## Context Release PRs frontend#169, backend#205, docs#69, specs#87 are affected by newly reported npm audit advisories in pinned transitive development dependencies (including basic-ftp <=6.2.3). Required security gates must pass without bypass. ## Acceptance Criteria - [ ] Affected dependency overrides/lockfiles updated to patched versions in each affected repo; no vulnerable pinned versions remain in the release candidate. - [ ] `npm ci`, `npm audit --include=dev --audit-level=low`, and repo `verify` pass. - [ ] Release candidates rebuilt from verified develop and all required PR checks pass before fast-forward merges. ## Scope Frontend, backend, docs, specs; preserve planned release versions and previous changelog contents.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
Kind/Dependencies
Dependency update or dependency-management work
 Kind/Investigation
Research or decision required before implementation
 Kind/Process
Developer workflow, CI/CD, tooling, or process improvement
 Kind/Refactor
Internal code or configuration restructuring without new product behavior
 audit/2026-10-11
Technical Audit Remediation — 2026-10-11
 kind/investigation
Нужна проверка evidence до решения; runtime-дефект не утверждается
Compat/Breaking
Breaking change that won't be backward compatible
 Kind/Bug
Something is not working
 Kind/Documentation
Documentation changes
 Kind/Enhancement
Improve existing functionality
 Kind/Feature
New functionality
 Kind/Security
This is security issue
 Kind/Testing
Issue or pull request related to testing
Priority
Critical
1
The priority is critical
Priority
High
2
The priority is high
Priority
Medium
3
The priority is medium
Priority
Low
4
The priority is low
Reviewed
Confirmed
1
Issue has been confirmed
Reviewed
Duplicate
2
This issue or pull request already exists
Reviewed
Invalid
3
Invalid issue
Reviewed
Won't Fix
3
This issue won't be fixed
Status
Blocked
1
Something is blocking this issue or pull request
Status
Need More Info
2
Feedback is required to reproduce issue or to continue work
Status
Abandoned
3
Somebody has started to work on this but abandoned work
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
codex-bot hermes-agent ksv741 publisher-bot renovate-bot
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: WealthLedger/main#56