curriculum-project-hub/.scratch/saas-production-readiness/issues/21-clear-dependency-security-advisories.md

Clear dependency advisories and gate releases

Type: task Status: resolved

Question

Remove every current npm audit --omit=dev high finding and every cargo audit vulnerability/unsound finding through tested upgrades, compatible overrides or upstream fixes—not ignores—and add reproducible Node and Rust security-audit gates to CI and the production release evidence.

Answer

All current production-high Node advisories and all Rust vulnerability/unsound advisories are removed without advisory ignores:

• @larksuiteoapi/node-sdk 1.70.0 declares Axios ~1.13.3, which prevented npm from selecting a patched release. The Hub now has a targeted npm override to Axios 1.18.1. The direct SDK stays current; the override is locked and the full Hub type/build/test gate validates the resolved tree. A deterministic local-HTTP smoke also drives the real SDK/Axios stack through tenant-token, authenticated success and HTTP-error paths without external credentials.
• memmap2 is upgraded to 0.9.11 and crossbeam-epoch to 0.9.20.
• plist is upgraded to 1.10.0, which moves its XML parser to quick-xml 0.41.0.
• crates.io citationberg 0.7.0 still pins vulnerable quick-xml 0.38.4. Cargo now patches it to the exact upstream citationberg commit that adopts quick-xml 0.41.0; the git revision is immutable in both manifest and lock.

hub-check runs the checked-in npm run audit:production command immediately after npm ci. checker-check installs the pinned cargo-audit 0.22.2 release with --locked, then runs cargo audit --deny unsound; vulnerabilities fail by default and unsound warnings are promoted to failures.

Current evidence:

• npm audit --omit=dev --audit-level=high: 0 vulnerabilities.
• cargo audit --deny unsound: 0 vulnerabilities and 0 unsound warnings.
• Four Rust unmaintained informational warnings remain visible and are not ignored; they are outside this issue's vulnerability/unsound acceptance criterion and will continue to appear in CI output.
• Hub: type-check, build and 280 tests pass (10 environment-specific skips).
• Rust: fmt, clippy with warnings denied, and all 53 workspace tests pass.