From 08e6236070d3677a542fcb7e7617d23ee6e0cb47 Mon Sep 17 00:00:00 2001 From: Farrel Augusta Dinata Date: Wed, 7 Oct 2026 00:28:46 +0700 Subject: [PATCH] fix(security): resolve frontend deploy audit failure and patch transitive vulnerabilities - Move @tailwindcss/vite and shadcn from client dependencies to devDependencies - Add pnpm overrides for proxy-addr, source-map-js, brace-expansion, @modelcontextprotocol/sdk, and shell-quote - Add auditConfig.ignoreGhsas for braces unfixable CVE (GHSA-vfj7-8cjw-p6xm) - Add --ignore-registry-errors to frontend deploy audit step --- .github/workflows/deploy-frontend.yml | 2 +- client/package.json | 4 +- pnpm-lock.yaml | 77 +++++++++++++++------------ pnpm-workspace.yaml | 11 +++- 4 files changed, 55 insertions(+), 39 deletions(-) diff --git a/.github/workflows/deploy-frontend.yml b/.github/workflows/deploy-frontend.yml index 6b8c1f2..2bdc9a4 100644 --- a/.github/workflows/deploy-frontend.yml +++ b/.github/workflows/deploy-frontend.yml @@ -39,7 +39,7 @@ jobs: run: pnpm install --frozen-lockfile - name: Audit production dependencies (high) - run: pnpm audit --prod --audit-level high + run: pnpm audit --prod --audit-level high --ignore-registry-errors - name: Setup Pages id: setup_pages diff --git a/client/package.json b/client/package.json index c6c173f..76af824 100644 --- a/client/package.json +++ b/client/package.json @@ -23,7 +23,6 @@ "@radix-ui/react-select": "^2.3.7", "@radix-ui/react-slot": "^1.3.3", "@radix-ui/react-toast": "^1.2.23", - "@tailwindcss/vite": "^4.3.3", "chart.js": "^4.5.1", "class-variance-authority": "^0.7.1", "clsx": "^2.1.1", @@ -38,7 +37,6 @@ "react-dom": "^19.2.7", "react-router": "^7.18.2", "recharts": "^3.10.1", - "shadcn": "^4.19.0", "tailwind-merge": "^3.6.0", "tw-animate-css": "^1.4.0", "zod": "^4.5.2", @@ -48,6 +46,7 @@ "@faker-js/faker": "^10.6.0", "@react-router/dev": "^7.18.2", "@react-router/node": "^7.18.2", + "@tailwindcss/vite": "^4.3.3", "@types/leaflet": "^1.9.22", "@types/node": "^24.0.0", "@types/react": "^19.2.17", @@ -56,6 +55,7 @@ "dependency-cruiser": "^18.0.0", "oxlint": "^1.71.0", "postcss": "^8.5.19", + "shadcn": "^4.19.0", "tailwindcss": "^4.3.3", "typescript": "^5.7.3", "vite": "^8.1.1", diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index bdca164..23611b9 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -268,6 +268,13 @@ overrides: serialize-javascript: ^7.0.3 undici: ^6.27.0 tmp: ^0.2.6 + proxy-addr: ^2.0.8 + source-map-js: ^1.2.2 + brace-expansion@1: ^1.1.21 + brace-expansion@2: ^2.1.7 + brace-expansion@5: ^5.0.12 + '@modelcontextprotocol/sdk': ^1.32.1 + shell-quote: ^1.12.0 importers: .: @@ -348,9 +355,6 @@ importers: '@radix-ui/react-toast': specifier: ^1.2.23 version: 1.2.23(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8) - '@tailwindcss/vite': - specifier: ^4.3.3 - version: 4.3.3(vite@8.2.1(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.49.2)(tsx@4.23.12)(yaml@2.9.0)) chart.js: specifier: ^4.5.1 version: 4.5.1 @@ -393,9 +397,6 @@ importers: recharts: specifier: ^3.10.1 version: 3.10.1(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react-is@19.2.8)(react@19.2.8)(redux@5.0.1) - shadcn: - specifier: ^4.19.0 - version: 4.19.0(supports-color@8.1.1)(typescript@5.9.3) tailwind-merge: specifier: ^3.6.0 version: 3.6.0 @@ -418,6 +419,9 @@ importers: '@react-router/node': specifier: ^7.18.2 version: 7.18.2(react-router@7.18.2(react-dom@19.2.8(react@19.2.8))(react@19.2.8))(typescript@5.9.3) + '@tailwindcss/vite': + specifier: ^4.3.3 + version: 4.3.3(vite@8.2.1(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.49.2)(tsx@4.23.12)(yaml@2.9.0)) '@types/leaflet': specifier: ^1.9.22 version: 1.9.22 @@ -442,6 +446,9 @@ importers: postcss: specifier: ^8.5.19 version: 8.5.26 + shadcn: + specifier: ^4.19.0 + version: 4.19.0(supports-color@8.1.1)(typescript@5.9.3) tailwindcss: specifier: ^4.3.3 version: 4.3.3 @@ -2090,10 +2097,10 @@ packages: integrity: sha512-EMlH1e30yzmTpGLQjlFmaDAjyOeZhng1/XCd7DExR8PNAnG/G1tyruZxEoUe11ClnwGhGrtsdnyyUx1frSzjng==, } - '@modelcontextprotocol/sdk@1.30.0': + '@modelcontextprotocol/sdk@1.32.1': resolution: { - integrity: sha512-xKd8OIzlqNzcqcNumGAa6g+PW2kjD5vrpcKOnfldAUPP3j7lnqMPwlTXQm8gF+UwH72z0lqaRbjr9hqGz0eITA==, + integrity: sha512-2DdE+SJDtzLEEWzY1ZjY7Q+VcPhcV1KisD3zI4u0XZyktsjHum1mwbMI+JaulUBi2OZk+KJAi2uPXzxichPkdw==, } engines: { node: '>=18' } peerDependencies: @@ -5928,22 +5935,22 @@ packages: } engines: { node: '>=10' } - brace-expansion@1.1.18: + brace-expansion@1.1.21: resolution: { - integrity: sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==, + integrity: sha512-9zeA+KLZNNzglF2TPKRQEDyx6Yby7daAkuy8MiPzpXPsYDWi/DRM8jmwUDxokQjYqBpv5DgPiwD4h4ZZSy1Ujw==, } - brace-expansion@2.1.4: + brace-expansion@2.1.7: resolution: { - integrity: sha512-hGfVzPxthbf3+2yjg/RBs60cB0FhqBS/zvdV/4wn4/BmN0bNMMHPc4V/BbFieqf1TKAGGAHnY4eSjajCl0f2Xg==, + integrity: sha512-uZbew1NqdmPDTMJ8ah1y+b+9QEJrfkXFk3RcTQw3X0jW/xRUvFKsg1CfQdSYGdTbXZWExtU3J3ccxtnfw1Fi0g==, } - brace-expansion@5.0.9: + brace-expansion@5.0.12: resolution: { - integrity: sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==, + integrity: sha512-YovQ3rzhaLMIrDjNDMkNS01tea93qhEhG5xy8f6+R0l+dw3Ki+5sCoIoI942iuLZTHWogWktgwVDhU09iNEimQ==, } engines: { node: 20 || >=22 } @@ -10332,10 +10339,10 @@ packages: integrity: sha512-TjNPblN4BwAWMXU8s9AEz4JmQxnD1NNL7bNOY/AKUzyamc379FWASUhc/K1pL2noVb+XmZKLL68cjzLsiOAMaA==, } - proxy-addr@2.0.7: + proxy-addr@2.0.8: resolution: { - integrity: sha512-llQsMLSUDUPT44jdrU/O37qlnifitDP+ZwrmmZcoSKyLKvtZxpyV0n2/bD/N4tBAAZ/gJEdZU7KMraoK1+XYAg==, + integrity: sha512-5nnx0yGyVUcY6t9RnWcARWtwT9F1D8O9rt08htPvnd49W1IgZtmLkhu9WfMzQj1cFxjHIO6connUNVW5k7AVyQ==, } engines: { node: '>= 0.10' } @@ -10900,10 +10907,10 @@ packages: } engines: { node: '>=8' } - shell-quote@1.9.0: + shell-quote@1.12.0: resolution: { - integrity: sha512-Iov+JwFv/2HcTpcwNMKd8+IWNb8tboQJNQTkAY/LLVK7gGH9jy+LGkVqPxfekHl+yMmiqXszdGWXgkfml7hjqA==, + integrity: sha512-PcByqNyT/38F2kDNi006HAMRJaULuBzq/FOsw3qdZvX/GA9W/jamDaRskgHjubHiftXK5sIFxLNkvrXUwcof6Q==, } engines: { node: '>= 0.4' } @@ -10989,10 +10996,10 @@ packages: engines: { node: '>=10.0.0' } hasBin: true - source-map-js@1.2.1: + source-map-js@1.2.2: resolution: { - integrity: sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA==, + integrity: sha512-KGj/8Y43x35aZVDtt+J4mK1hoLGHULMYfSkODJNQjNDC3oW1PqPoxMwo0pLUsWM/UEGzON/NxeHywEfNXNP3Vw==, } engines: { node: '>=0.10.0' } @@ -13462,7 +13469,7 @@ snapshots: '@mjackson/node-fetch-server@0.2.0': {} - '@modelcontextprotocol/sdk@1.30.0(supports-color@8.1.1)(zod@3.25.76)': + '@modelcontextprotocol/sdk@1.32.1(supports-color@8.1.1)(zod@3.25.76)': dependencies: '@hono/node-server': 2.1.1(hono@4.13.3) ajv: 8.20.0 @@ -15011,7 +15018,7 @@ snapshots: jiti: 2.7.0 lightningcss: 1.32.0 magic-string: 0.30.21 - source-map-js: 1.2.1 + source-map-js: 1.2.2 tailwindcss: 4.3.3 '@tailwindcss/oxide-android-arm64@4.3.3': @@ -16006,16 +16013,16 @@ snapshots: widest-line: 3.1.0 wrap-ansi: 7.0.0 - brace-expansion@1.1.18: + brace-expansion@1.1.21: dependencies: balanced-match: 1.0.2 concat-map: 0.0.1 - brace-expansion@2.1.4: + brace-expansion@2.1.7: dependencies: balanced-match: 1.0.2 - brace-expansion@5.0.9: + brace-expansion@5.0.12: dependencies: balanced-match: 4.0.4 @@ -16256,7 +16263,7 @@ snapshots: dependencies: chalk: 4.1.2 rxjs: 7.8.2 - shell-quote: 1.9.0 + shell-quote: 1.12.0 supports-color: 8.1.1 tree-kill: 1.2.2 yargs: 17.7.2 @@ -16845,7 +16852,7 @@ snapshots: on-finished: 2.4.1 once: 1.4.0 parseurl: 1.3.3 - proxy-addr: 2.0.7 + proxy-addr: 2.0.8 qs: 6.15.3 range-parser: 1.3.0 router: 2.2.0(supports-color@8.1.1) @@ -18174,15 +18181,15 @@ snapshots: minimatch@10.2.6: dependencies: - brace-expansion: 5.0.9 + brace-expansion: 5.0.12 minimatch@3.1.5: dependencies: - brace-expansion: 1.1.18 + brace-expansion: 1.1.21 minimatch@9.0.9: dependencies: - brace-expansion: 2.1.4 + brace-expansion: 2.1.7 minimist@1.2.8: {} @@ -18580,7 +18587,7 @@ snapshots: dependencies: nanoid: 3.3.18 picocolors: 1.1.1 - source-map-js: 1.2.1 + source-map-js: 1.2.2 postgres-array@2.0.0: {} @@ -18648,7 +18655,7 @@ snapshots: retry: 0.12.0 signal-exit: 3.0.7 - proxy-addr@2.0.7: + proxy-addr@2.0.8: dependencies: forwarded: 0.2.0 ipaddr.js: 1.9.1 @@ -19075,7 +19082,7 @@ snapshots: '@babel/plugin-transform-typescript': 7.29.7(@babel/core@7.29.7(supports-color@8.1.1))(supports-color@8.1.1) '@babel/preset-typescript': 7.29.7(@babel/core@7.29.7(supports-color@8.1.1))(supports-color@8.1.1) '@dotenvx/dotenvx': 1.75.1 - '@modelcontextprotocol/sdk': 1.30.0(supports-color@8.1.1)(zod@3.25.76) + '@modelcontextprotocol/sdk': 1.32.1(supports-color@8.1.1)(zod@3.25.76) '@types/validate-npm-package-name': 4.0.2 browserslist: 4.28.8 commander: 14.0.3 @@ -19115,7 +19122,7 @@ snapshots: shebang-regex@3.0.0: {} - shell-quote@1.9.0: {} + shell-quote@1.12.0: {} side-channel-list@1.0.1: dependencies: @@ -19174,7 +19181,7 @@ snapshots: transitivePeerDependencies: - debug - source-map-js@1.2.1: {} + source-map-js@1.2.2: {} source-map-support@0.5.13: dependencies: diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index 86f23c1..0723f93 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -12,7 +12,9 @@ allowBuilds: unrs-resolver: true onnxruntime-node: true core-js: false -auditConfig: { ignoreGhsas: null } +auditConfig: + ignoreGhsas: + - GHSA-vfj7-8cjw-p6xm engineStrict: true overrides: multer: ^2.3.0 @@ -25,3 +27,10 @@ overrides: serialize-javascript: ^7.0.3 undici: ^6.27.0 tmp: ^0.2.6 + proxy-addr: ^2.0.8 + source-map-js: ^1.2.2 + brace-expansion@1: ^1.1.21 + brace-expansion@2: ^2.1.7 + brace-expansion@5: ^5.0.12 + '@modelcontextprotocol/sdk': ^1.32.1 + shell-quote: ^1.12.0