Remediate llm-fe npm audit critical/high vulnerabilities #69

2026-07-29T17:39:04-07:00

westfarn commented

2026-07-29 17:39:04 -07:00

Summary

Closes Reduce npm deprecations and remediate npm audit vulnerabilities (#53)
npm audit in llm-fe: 103 → 4 (0 critical, 0 high; 4 moderate remain)
Applied npm audit fix, bumped direct floors (axios, react-router-dom), pinned styled-components@6.1.15 for CRA typecheck stability
Added npm overrides for vulnerable transitive leaves (tar, postcss, svgo, sharp, ws, flatted, etc.)
Vendored CRA-compatible brace-expansion@5.0.8 shim (v1 default-export API + GHSA-mh99 DoS limits)

Remaining (documented)

moderate: react-router/react-router-dom — needs v7 (breaking)
moderate: webpack-dev-server via react-scripts — CRA incompatible with patched WDS 5.2.6+; needs CRA → Vite (or similar) follow-up
Deprecation warnings from CRA/eslint@8/old glob tooling still present until toolchain migrate

Test plan

npm ci in llm-fe
npm audit → 0 critical / 0 high
npm run build
npm run test:ci → 25 suites / 112 tests passed

## Summary - Closes #53 - `npm audit` in `llm-fe`: **103 → 4** (0 critical, 0 high; 4 moderate remain) - Applied `npm audit fix`, bumped direct floors (`axios`, `react-router-dom`), pinned `styled-components@6.1.15` for CRA typecheck stability - Added npm `overrides` for vulnerable transitive leaves (`tar`, `postcss`, `svgo`, `sharp`, `ws`, `flatted`, etc.) - Vendored CRA-compatible `brace-expansion@5.0.8` shim (v1 default-export API + GHSA-mh99 DoS limits) ## Remaining (documented) - **moderate:** `react-router`/`react-router-dom` — needs v7 (breaking) - **moderate:** `webpack-dev-server` via `react-scripts` — CRA incompatible with patched WDS 5.2.6+; needs CRA → Vite (or similar) follow-up - Deprecation warnings from CRA/`eslint@8`/old `glob` tooling still present until toolchain migrate ## Test plan - [x] `npm ci` in `llm-fe` - [x] `npm audit` → 0 critical / 0 high - [x] `npm run build` - [x] `npm run test:ci` → 25 suites / 112 tests passed

westfarn added 1 commit 2026-07-29 17:39:04 -07:00

Remediate llm-fe npm audit critical/high vulns (#53 )

Unit Tests / test (pull_request) Successful in 12s

Details

ffb5a46f30

Bring dependency tree from 103 vulns (4 critical / 71 high) down to 4 moderate via npm audit fix, locked transitive overrides, and a CRA-compatible brace-expansion shim. Remaining moderates need react-router v7 and leaving Create React App.

westfarn merged commit 44f412fffa into master

2026-07-29 17:41:01 -07:00

westfarn deleted branch issue-53-npm-fix

2026-07-29 17:41:01 -07:00

westfarn referenced this pull request

2026-07-30 11:04:31 -07:00

Fix brace-expansion lock for npm 10 beta deploy #70

westfarn referenced this issue from a commit

2026-07-30 16:57:19 -07:00

Fix brace-expansion lock for npm 10 beta deploy (#70)

Sign in to join this conversation.