58 lines
3.1 KiB
Markdown
58 lines
3.1 KiB
Markdown
# yedir-ai Dependency Risk Register
|
|
|
|
Last local audit snapshot: 2026-05-27.
|
|
|
|
This register tracks dependency security debt that cannot safely be fixed as an incidental change. It exists so commercial delivery and open-source review do not rely on hidden tribal knowledge.
|
|
|
|
## Audit Command
|
|
|
|
Use the official npm registry for audit checks:
|
|
|
|
```bash
|
|
pnpm audit:security
|
|
pnpm audit:security:json
|
|
pnpm --silent audit:security:json > audit-security.json
|
|
```
|
|
|
|
The explicit registry is intentional. Some mirrors do not implement the npm audit endpoint, which makes audit fail for infrastructure reasons rather than project reasons.
|
|
Use `pnpm --silent audit:security:json` when another script needs machine-readable JSON without pnpm's script header.
|
|
|
|
## Current Snapshot
|
|
|
|
`pnpm audit --registry=https://registry.npmjs.org --audit-level high --json` currently reports:
|
|
|
|
- Critical: 2 advisories.
|
|
- High: about 30 advisories.
|
|
- Moderate/low advisories also exist but are lower priority for the first remediation pass.
|
|
|
|
## Priority Remediation Buckets
|
|
|
|
- `next`: multiple high advisories affecting the currently resolved Next.js version. Upgrade Next.js in a dedicated framework update branch and run the full quality gate, route smoke tests, and focused homepage/settings/canvas checks.
|
|
- `fast-xml-parser`: critical/high advisories through AWS SDK XML parsing. Prefer upgrading AWS SDK packages or adding a targeted override only after confirming the lockfile resolves to patched `fast-xml-parser`.
|
|
- `protobufjs`: critical/high advisories through `@xenova/transformers -> onnxruntime-web -> onnx-proto`. Treat as high priority because code generation and parser dependencies are sensitive.
|
|
- `drizzle-orm`: high advisory affecting SQL identifier escaping. Upgrade in a dedicated data-access branch and run route/helper tests plus migration checks.
|
|
- `xlsx`: high advisories with no patched version reported by npm audit. Plan a replacement or isolation strategy rather than pretending a patch exists.
|
|
- `@vercel/blob` / `undici`: high advisories through the Blob client dependency chain. Upgrade storage dependencies and verify upload/download flows.
|
|
- `ultracite` transitive dev tooling chain: advisories in Vite/Rollup/Picomatch/tRPC via lint/test tooling. Keep pinned execution, then upgrade tooling in a separate CI-focused branch.
|
|
|
|
## Release Policy
|
|
|
|
- Do not add `pnpm audit:security` to `pnpm check:quality` until the critical/high baseline is remediated or a documented exception policy exists.
|
|
- New direct dependencies should be checked with `pnpm audit:security` before merging.
|
|
- Critical advisories in runtime dependencies should block production release unless they are proven unreachable and documented here.
|
|
- High advisories should have either a remediation PR or an explicit risk acceptance note before commercial deployment.
|
|
|
|
## Verification After Remediation
|
|
|
|
After each dependency remediation batch:
|
|
|
|
```bash
|
|
pnpm install --frozen-lockfile
|
|
pnpm check:quality
|
|
pnpm audit:security
|
|
AUTH_TRUST_HOST=true PORT=3001 pnpm dev
|
|
SMOKE_BASE_URL=http://127.0.0.1:3001 pnpm smoke:routes
|
|
```
|
|
|
|
Record the remaining critical/high count in this file until the audit baseline reaches zero or only accepted exceptions remain.
|