fix(deps): patch frontend audit security floors - #1623
Conversation
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
📝 WalkthroughWalkthroughThe frontend updates Next.js, eslint-config-next, Vitest, js-yaml, and sharp versions. New tests validate manifest values, workspace overrides, lockfile consistency, and dependency security floors. ChangesFrontend security floor enforcement
Priority: ➖ Normal Estimated code review effort: 3 (Moderate) | ~20 minutes Merge Risk: 🟡 Moderate · up to The frontend dependency update raises Vitest security floors, but its validation can still accept a mismatched root lockfile resolution or missing referenced snapshot. This can allow future dependency drift to bypass the intended security-floor contract and should be corrected before merge. 🚥 Pre-merge checks | ✅ 4✅ Passed checks (4 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
@codex review Please review only the current exact head |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: d76f7b4508
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review Please review exact head |
|
Codex Review: Didn't find any major issues. Nice work! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
exact-head validation receiptHead:
Visual Inspection: directly inspected the production build in a real browser at 1280×720, locale |
Exact-head dependency repair — 2026-09-09Current head: The prior clean audit became stale when GitHub published new
Exact-head local evidence:
The lockfile-generation commands that emitted deprecation or peer warnings are retained as failed investigative evidence and are not counted as verification. Required hosted Checks and a fresh current-head independent review still govern merge. |
|
@codex review Please review only current exact head |
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
Preserve the repository-entry guidance delta as first-parent history while adopting #1623's current Vitest importer-contract repair. Signed-off-by: Seongho Bae <me@seonghobae.me>
|
@coderabbitai review 현재 exact head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
expected='17a7618eda2b212b691f08fa936e042b34258fc9'
printf 'HEAD=%s\n' "$(git rev-parse HEAD)"
git show -s --format='commit=%H%nparents=%P%nsubject=%s' "$expected"
printf '\nChanged files in exact commit:\n'
git diff-tree --no-commit-id --name-status -r "$expected"
printf '\nSecurity-test outline:\n'
ast-grep outline backend/tests/test_frontend_framework_security_floor.py --items all || true
ast-grep outline backend/tests/test_js_yaml_dependency_security.py --items all || true
printf '\nExact security-test patch:\n'
git diff --no-ext-diff --unified=100 "${expected}^" "$expected" -- \
backend/tests/test_frontend_framework_security_floor.py \
backend/tests/test_js_yaml_dependency_security.py
printf '\nRelevant security-test code:\n'
rg -n -C5 'vitest|coverage-v8|importers|snapshots|specifier|resolved|next|sharp|js-yaml|override' \
backend/tests/test_frontend_framework_security_floor.py \
backend/tests/test_js_yaml_dependency_security.py
printf '\nManifest/workspace values:\n'
rg -n -C2 '"(?:next|eslint-config-next|vitest|`@vitest/coverage-v8`)"|(?:sharp|js-yaml):' \
frontend/package.json frontend/pnpm-workspace.yaml
printf '\nParsed lockfile contract and resolution floor scan:\n'
python3 - <<'PY'
from pathlib import Path
import re
import yaml
root = Path("frontend")
manifest = yaml.safe_load((root / "package.json").read_text()) # JSON is valid YAML
workspace = yaml.safe_load((root / "pnpm-workspace.yaml").read_text())
lock = yaml.safe_load((root / "pnpm-lock.yaml").read_text())
print("lockVersion:", lock.get("lockfileVersion"))
print("workspace overrides:", {k: workspace.get("overrides", {}).get(k) for k in ("sharp", "js-yaml")})
imp = lock["importers"]["."]["devDependencies"]
snapshots = lock["snapshots"]
for package in ("vitest", "`@vitest/coverage-v8`"):
entry = imp.get(package)
print(f"importer {package}: {entry!r}")
if isinstance(entry, dict):
version = str(entry.get("version"))
print(" manifest:", manifest.get("devDependencies", {}).get(package))
print(" exact snapshot:", f"{package}@{version}", f"{package}@{version}" in snapshots)
floors = {"next": (16,3,3), "sharp": (0,35,4), "js-yaml": (4,3,2),
"vitest": (4,1,11), "`@vitest/coverage-v8`": (4,1,11)}
for section in ("packages", "snapshots"):
found = {p: [] for p in floors}
for key in lock.get(section, {}):
normalized = str(key).strip("'\"")
for package, floor in floors.items():
match = re.match(rf"^{re.escape(package)}@(\d+(?:\.\d+){{1,2}}(?:[-+][^(\s]+)?)", normalized)
if match:
raw = match.group(1)
nums = tuple(map(int, re.match(r"(\d+)\.(\d+)\.(\d+)", raw).groups()))
found[package].append((normalized, nums, nums < floor))
print(section)
for package, entries in found.items():
print(" ", package, "count=", len(entries), "below=", [key for key, _, bad in entries if bad])
PYLength of output: 48089 I need one additional read-only inspection because the previous lockfile parser could not load PyYAML. 🧠 Learnings usedYou are interacting with an AI system. |
|
@codex review Please review only current exact head |
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
1 participant
Current authority — 2026-09-10
develop@042b0c70531b229af3acbd0421a2f23098d848b317a7618eda2b212b691f08fa936e042b34258fc9dc33619263b554650a5d4cd4718a8f72480afea6frontend/package.json,frontend/pnpm-workspace.yaml, generatedfrontend/pnpm-lock.yaml, and the Naruon security-floor regression tests. Descendant product lanes consume this ancestry rather than copying dependency source.Reality RED → causal repair succession
The predecessor Vitest missing-resolution repair remains valid: RED
a6715c9c845ed5ad48929fd3261bb07ce4b802e5proved the test could pass vacuously when allvitestor@vitest/coverage-v8keys disappeared from a lock section; GREEN21897d8ccd11ee4a2d7a3df5551db12c92c9ec71requires matching keys to be non-empty before checking every resolution against the floor.A later CodeRabbit finding was also valid: the Vitest check still did not bind the root pnpm importer to
package.jsonor prove that the importer-referenced peer-qualified snapshot exists. Reality RED15fecaaeabe6faaedf7e4c3f8991eb3add1dd0c5added specifier/version drift and missing-snapshot regressions for bothvitestand@vitest/coverage-v8; Application CI34399983768failed on that new contract. Current repair17a7618...bindsimporters["."]["devDependencies"]specifier and resolved version to the manifest and requires the exact peer-qualified snapshot key. The review thread is resolved and non-outdated.The separate js-yaml security test already fails closed on missing
js-yaml@resolutions in bothpackagesandsnapshotsand binds workspace/lock overrides plus the ESLint consumer, so no duplicate repair was added.Exact-head evidence
Current
17a7618...has terminal GREEN repository/direct evidence for Application CI34400279071, Bandit34400279107, Security Scan34400279125, Semgrep34400279105, Docker34400279411, direct GHAS CodeQL, Required OpenCode, coverage-source-tree, coverage-evidence, and Required Noema (noema-reviewjob102630634220).Central required
CodeQL PR34400279027is RED: compatibility jobs Python102630567766, JavaScript/TypeScript102630567259, and Actions102630567189all failed enforcement, while dispatcher102631310883subsequently succeeded. The same exact head has direct CodeQL GREEN, so this is a fresh central publication/wake ordering reproduction, not a Naruon leaf-source defect. It is already recorded on canonical.github#1929as comment5608208285; no dummy requeue, synthetic status, copied workflow, or gate exception was added.Required Strix run
34400277194/ job102630455606is now terminal FAILURE on this exact head. Admission, exact-head materialization, contextual-orchestrator sidecar provisioning, Strix installation and report upload all succeeded;Run Strix (quick)executed for about five hours before failing. Artifact10132525908(strix-reports, SHA-256199d0d51031727ce9732d3093b46235d48546a29c6be4cdf707e2da8db7e9e53) records a failed Strix run after 298 LLM requests / 25,238,305 input tokens / 62,911 output tokens. Caido bootstrap attempts 1–4 failed but recovered before the scan (Caido project selected), so this is not a terminal sandbox-bootstrap failure. The terminal request throughorchestrator/freereachedmeta/llama-3.2-11b-vision-instruct/nvidia_nim_meta_llama_3_2_11b_vision_instructand received HTTP 400invalid_request_error, request idf335dc663fe0451b84a1585bedb91cf4,retryable=false,transport=passthrough; the gate failed closed asSTRIX_PROVIDER_UNAVAILABLE. SARIF has zero results, but a failed partial scan is not clean-security evidence. Fresh owner evidence is recorded oncontextual-orchestrator#1106as comment5611406984; do not add a Naruon retry, model/provider pin, paid fallback, guessed timeout or leaf capability heuristic.Review state: all currently surfaced inline findings are resolved; the latest CodeRabbit activity confirms the importer-contract fix but there is still no qualifying post-last-push
APPROVEDreview bound to exact17a7618....Merge boundary
Keep Draft until every live required context on the exact head is terminal-success, current-head review has no valid unresolved findings and a qualifying independent approval exists. Central CodeQL and Strix are currently terminal RED. After this owner is actually integrated, descendants must ordinary-restack on the integrated security owner and must not inherit predecessor checks/reviews as current-head evidence.