forked from EduCraft/curriculum-project-hub
45 lines
2.1 KiB
Markdown
45 lines
2.1 KiB
Markdown
# Clear dependency advisories and gate releases
|
|
|
|
Type: task
|
|
Status: resolved
|
|
|
|
## Question
|
|
|
|
Remove every current `npm audit --omit=dev` high finding and every `cargo audit`
|
|
vulnerability/unsound finding through tested upgrades, compatible overrides or
|
|
upstream fixes—not ignores—and add reproducible Node and Rust security-audit
|
|
gates to CI and the production release evidence.
|
|
|
|
## Answer
|
|
|
|
All current production-high Node advisories and all Rust vulnerability/unsound
|
|
advisories are removed without advisory ignores:
|
|
|
|
- `@larksuiteoapi/node-sdk` 1.70.0 declares Axios `~1.13.3`, which prevented npm
|
|
from selecting a patched release. The Hub now has a targeted npm override to
|
|
Axios 1.18.1. The direct SDK stays current; the override is locked and the
|
|
full Hub type/build/test gate validates the resolved tree. A deterministic
|
|
local-HTTP smoke also drives the real SDK/Axios stack through tenant-token,
|
|
authenticated success and HTTP-error paths without external credentials.
|
|
- `memmap2` is upgraded to 0.9.11 and `crossbeam-epoch` to 0.9.20.
|
|
- `plist` is upgraded to 1.10.0, which moves its XML parser to `quick-xml`
|
|
0.41.0.
|
|
- crates.io `citationberg` 0.7.0 still pins vulnerable `quick-xml` 0.38.4.
|
|
Cargo now patches it to the exact upstream citationberg commit that adopts
|
|
`quick-xml` 0.41.0; the git revision is immutable in both manifest and lock.
|
|
|
|
`hub-check` runs the checked-in `npm run audit:production` command immediately
|
|
after `npm ci`. `checker-check` installs the pinned cargo-audit 0.22.2 release
|
|
with `--locked`, then runs `cargo audit --deny unsound`; vulnerabilities fail by
|
|
default and unsound warnings are promoted to failures.
|
|
|
|
Current evidence:
|
|
|
|
- `npm audit --omit=dev --audit-level=high`: 0 vulnerabilities.
|
|
- `cargo audit --deny unsound`: 0 vulnerabilities and 0 unsound warnings.
|
|
- Four Rust `unmaintained` informational warnings remain visible and are not
|
|
ignored; they are outside this issue's vulnerability/unsound acceptance
|
|
criterion and will continue to appear in CI output.
|
|
- Hub: type-check, build and 280 tests pass (10 environment-specific skips).
|
|
- Rust: fmt, clippy with warnings denied, and all 53 workspace tests pass.
|