76 lines
4.7 KiB
Markdown
76 lines
4.7 KiB
Markdown
# yedir-ai Dependency Risk Register
|
|
|
|
Last local audit snapshot: 2026-05-27.
|
|
|
|
This register tracks dependency security debt that cannot safely be fixed as an incidental change. It exists so commercial delivery and open-source review do not rely on hidden tribal knowledge.
|
|
|
|
## Audit Command
|
|
|
|
Use the official npm registry for audit checks:
|
|
|
|
```bash
|
|
pnpm audit:security
|
|
pnpm audit:security:json
|
|
pnpm --silent audit:security:json > audit-security.json
|
|
```
|
|
|
|
The explicit registry is intentional. Some mirrors do not implement the npm audit endpoint, which makes audit fail for infrastructure reasons rather than project reasons.
|
|
Use `pnpm --silent audit:security:json` when another script needs machine-readable JSON without pnpm's script header.
|
|
|
|
GitHub Actions also runs `.github/workflows/dependency-audit.yml` on push, pull request, weekly schedule and manual dispatch. Keep that workflow independent from the fast quality gate so registry or network issues do not hide lint/typecheck feedback.
|
|
|
|
## Current Snapshot
|
|
|
|
`pnpm --silent audit:security:json` currently reports:
|
|
|
|
- Critical: 0 advisories.
|
|
- High: 0 advisories.
|
|
- Moderate: 44 advisories.
|
|
- Low: 1 advisory.
|
|
|
|
The previous local baseline was Critical: 2 / High: 31. The remediation batches upgraded direct dependencies, patched transitive packages via `pnpm.overrides`, and removed the vulnerable `xlsx` parser dependency.
|
|
|
|
## Remaining Moderate / Low Buckets
|
|
|
|
The current non-blocking advisories are still tracked because they may matter for specific feature surfaces:
|
|
|
|
- `dompurify`: moderate XSS / sanitization bypass advisories from transitive rich-rendering dependencies. Treat any user-authored HTML rendering path as sensitive and prefer explicit server-side sanitization plus output escaping.
|
|
- `mermaid`: moderate XSS / CSS injection / DoS advisories from diagram rendering dependencies. Avoid enabling untrusted Mermaid diagram rendering without sandboxing and version review.
|
|
- `postcss`, `esbuild`, `brace-expansion`, `yaml`: moderate parser/dev-tooling advisories. These are primarily build-time or tooling-chain risks; keep production build and dependency audit workflows active.
|
|
- `markdown-it`, `mdast-util-to-hast`, `prismjs`: moderate Markdown/syntax-rendering advisories. Treat user-provided Markdown as untrusted and keep renderer usage behind existing sanitization boundaries.
|
|
- `uuid`, `ws`: moderate runtime/transitive advisories. Prefer patched transitive versions when upstream packages allow it; do not introduce new direct dependency pins that downgrade these packages.
|
|
- `ai`: low filetype whitelist bypass advisory currently appears in audit output even though the direct dependency is on a patched line. Keep `pnpm audit:security` as the blocking high/critical gate and revisit if severity changes.
|
|
|
|
These buckets do not currently block release because the enforced gate is high/critical zero. They should be revisited during dependency maintenance, public Markdown/diagram feature changes, or before changing the project to a fully public repository.
|
|
|
|
## Priority Remediation Buckets
|
|
|
|
- `xlsx`: remediated by replacing spreadsheet import parsing with the existing `exceljs` dependency and dropping legacy `.xls` upload support from affected import paths.
|
|
- `next`: remediated by resolving Next.js to `16.2.6`; keep route smoke tests in the verification path.
|
|
- `fast-xml-parser`: remediated through a transitive override resolving to `5.8.0`.
|
|
- `protobufjs`: remediated through a transitive override resolving to `7.5.6`.
|
|
- `drizzle-orm`: remediated by upgrading to `0.45.2`; keep migration and route checks in future data-access changes.
|
|
- `@vercel/blob` / `undici`: remediated through a transitive override resolving `undici` to a patched 6.x line.
|
|
- `ultracite` transitive dev tooling chain: remediated through targeted transitive overrides for Vite/Rollup/Picomatch/tRPC/Lodash.
|
|
|
|
## Release Policy
|
|
|
|
- Keep `pnpm audit:security` in the independent Dependency Audit workflow and as a pre-release review command rather than embedding it in `pnpm check:quality`; the registry-backed audit endpoint can fail for network or mirror reasons.
|
|
- New direct dependencies should be checked with `pnpm audit:security` before merging.
|
|
- Critical advisories in runtime dependencies should block production release unless they are proven unreachable and documented here.
|
|
- High advisories should have either a remediation PR or an explicit risk acceptance note before commercial deployment.
|
|
|
|
## Verification After Remediation
|
|
|
|
After each dependency remediation batch:
|
|
|
|
```bash
|
|
pnpm install --frozen-lockfile
|
|
pnpm check:quality
|
|
pnpm audit:security
|
|
AUTH_TRUST_HOST=true PORT=3001 pnpm dev
|
|
SMOKE_BASE_URL=http://127.0.0.1:3001 pnpm smoke:routes
|
|
```
|
|
|
|
Record the remaining critical/high count in this file until the audit baseline reaches zero or only accepted exceptions remain.
|