Repository navigation
fix(frontend): patch follow-redirects and minimatch for npm audit - #3770
Conversation
Raise overrides so npm audit --omit=dev --audit-level=high passes without npm audit fix --force (which would downgrade @sentry/nextjs).
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
PR Blocker ChecklistHead SHA: Status: Ready
|
|
No actionable comments were generated in the recent review.
 |
| Check name | Status | Explanation |
|---|---|---|
| Title check |  |
The title clearly identifies the frontend dependency security fixes for follow-redirects and minimatch required by the npm audit. |
| Description check | |
The description clearly explains the security advisories, dependency changes, scope, verification results, and remaining moderate findings. It omits the template headings for Type of Change, Checklist… |
| Docstring Coverage | |
No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat… |
| Linked Issues check | |
Check skipped because no linked issues were found for this pull request. |
| Out of Scope Changes check | |
Check skipped because no linked issues were found for this pull request. |
Full details: Description check
-
Explanation
The description clearly explains the security advisories, dependency changes, scope, verification results, and remaining moderate findings. It omits the template headings for Type of Change, Checklist, and Related Issues, but the required change and test information is mostly complete.
Full details: Docstring Coverage
-
Explanation
No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)
Finishing Touches
-
Generate unit tests (beta)
-
- Commit to this branch
- Create a new PR
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
✅ Bundle Size Report
Bundle is within the 10.0MB limit. |
github-actions
Bot
added
dependencies
|
Vercel preview: https://regengine-9ioxgua0z-petrefiedthunders-projects.vercel.app Access is via Vercel login (Deployment Protection). |
PetrefiedThunder
left a comment
PetrefiedThunder
left a comment
There was a problem hiding this comment.
REVIEW: PASS deepseek e27a3f8
Scope
- Single commit by PetrefiedThunder/Christopher (Grok). No deepseek-authored commits.
- Diff is frontend-only:
package.jsonoverrides + regeneratedpackage-lock.json. - Lockfile version changes only:
follow-redirects1.16.1 → 1.16.2minimatch10.2.4 → 11.0.3- added
@isaacs/nonrecursive-glob-match@1.0.3(minimatch 11 dep)
@sentry/nextjsremains 11.8.0. No--force.
Verification (box worktree /tmp/dsrev-3770)
npm ci✅npm audit --omit=dev --audit-level=high✅ exit 0- Remaining 4 moderates: all GHSA-3g3m-2fjr-6pw4 (
globAbortSignal bypass) via@sentry/bundler-plugins→@sentry/nextjs/@sentry/node. Fix path isnpm audit fix --force→ Sentry 10.76.1 (forbidden downgrade). Acceptable: build-time Sentry plugin path, not a runtime user-request surface; out of scope here. - Minimatch override risk: tree was already on minimatch 10 under the old
>=3.1.3override (eslint/globdeclare^3/^10). Bump 10→11 keeps callableminimatch()API;globSyncsmoke OK; lint/build/tests green → no production-path break observed. npm run build(CI placeholder env) ✅ — Sentry instrumentation/config compiles; no plugin errorsnpm run lint✅ 0 errors (60 pre-existing warnings); design-lint cleannpm run test:run✅ 206 files / 1647 passed (1 expected fail, 2 skipped)
CI notes
- Frontend Security Audit ✅ and Production Readiness Gate ✅ (the jobs this PR unblocks)
- Build & Bundle Analysis ✅; Passwordless Auth E2E ✅ on this head
- Unrelated reds: backend
Security Audit */Dependency Audit(pip-auditpypdfin factory-local) — not introduced by this frontend lockfile change - Engine Review Pass was waiting on a non-author review for this SHA
No push/merge from this review.
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit e27a3f8. Configure here.
pip-audit flags seven CVEs against pypdf 6.21.2 in packages/factory-local/requirements.lock. Raise the pin to >=6.21.4,<7 (smallest fix for CVE-2026-119203/119204/119205; also covers CVE-2026-119206/119207/119208/119209 fixed in 6.21.3) and regenerate the factory-local and root hashed locks. Root lock also picks up pyasn1 0.6.5 (CVE-2026-119194/119195/119196/119197) so pip-audit stays clean once the check runs. Frontend overrides match #3770 so npm audit --audit-level=high does not fail the same Dependency Audit job. Signed-off-by: Christopher Sellers <1@christophersellers.com>
Bring in main so PR Gate / Dependency Audit / Security Audits can re-run against current tip. Resolve any lockfile conflicts by taking main's package-lock and re-applying npm overrides.
PetrefiedThunder
left a comment
PetrefiedThunder
left a comment
There was a problem hiding this comment.
REVIEW: PASS deepseek d661055
Delta review of no-ff merge of main onto earlier PASS e27a3f8.
Merge integrity:
- Parents: e27a3f8 (fix frontend audit) + 1d9c995 (current origin/main, #3756).
git merge-tree --write-tree e27a3f81 1d9c995==HEAD^{tree}(00f64465…).- Diff vs origin/main: only frontend/package.json and frontend/package-lock.json.
- Blobs for both files identical to e27a3f8; package.json patch vs parent identical (follow-redirects >=1.16.2, minimatch >=11.0.1).
CI: Dependency Audit / Security Audit graph red on this head are main-inherited pip-audit failures on pypdf==6.21.2 (7 CVEs) — not introduced by this frontend-only delta; cleared by #3773. Engine Review Pass / PR Blocker / Head SHA are gate-only awaiting this review. Frontend/other non-audit checks look green.
No content change beyond the merge sync; prior PASS findings on e27a3f8 still apply.
* fix(deps): bump pypdf to 6.21.4 for factory-local pip-audit pip-audit flags seven CVEs against pypdf 6.21.2 in packages/factory-local/requirements.lock. Raise the pin to >=6.21.4,<7 (smallest fix for CVE-2026-119203/119204/119205; also covers CVE-2026-119206/119207/119208/119209 fixed in 6.21.3) and regenerate the factory-local and root hashed locks. Root lock also picks up pyasn1 0.6.5 (CVE-2026-119194/119195/119196/119197) so pip-audit stays clean once the check runs. Frontend overrides match #3770 so npm audit --audit-level=high does not fail the same Dependency Audit job. Signed-off-by: Christopher Sellers <1@christophersellers.com> * fix(deps): recompile requirements.lock with Python 3.11 Dependency Lock Freshness runs pip-compile on 3.11; the prior lock header and typing-extensions via annotations were from 3.13. Signed-off-by: Christopher Sellers <1@christophersellers.com> --------- Signed-off-by: Christopher Sellers <1@christophersellers.com>
…3766) * test(admin): prove list_users stays tenant-scoped under sysadmin RLS Switch list_users to arm/disarm_global_admin_context (SET LOCAL) with a finally reset so the is_sysadmin GUC cannot leak across pooled checkouts. Add a two-tenant live-Postgres regression that seeds synthetic members, calls list_users under each tenant as regengine_sysadmin, and asserts only that tenant's emails are returned. Update unit mocks for the extra disarm execute. Signed-off-by: Christopher Sellers <1@christophersellers.com> * test(security): allowlist list_users arm_global_admin_context list_users now uses transaction-local arm/disarm for users_self_or_admin peer visibility. Register the single call in the closed inventory with classification tenant-scoped-directory so the exact-count gate matches. Signed-off-by: Christopher Sellers <1@christophersellers.com> * test(security): approve tenant-scoped-directory admin arm class list_users is classified as tenant-scoped-directory; add that class to the reviewed authority set so the allowlist closed-set check passes. Signed-off-by: Christopher Sellers <1@christophersellers.com> * fix(deps): bump pypdf to 6.21.4 for factory-local pip-audit pip-audit flags seven CVEs against pypdf 6.21.2 in packages/factory-local/requirements.lock. Raise the pin to >=6.21.4,<7 (smallest fix for CVE-2026-119203/119204/119205; also covers CVE-2026-119206/119207/119208/119209 fixed in 6.21.3) and regenerate the factory-local and root hashed locks. Root lock also picks up pyasn1 0.6.5 (CVE-2026-119194/119195/119196/119197) so pip-audit stays clean once the check runs. Frontend overrides match #3770 so npm audit --audit-level=high does not fail the same Dependency Audit job. Signed-off-by: Christopher Sellers <1@christophersellers.com> * fix(deps): recompile requirements.lock with Python 3.11 Dependency Lock Freshness runs pip-compile on 3.11; the prior lock header and typing-extensions via annotations were from 3.13. Signed-off-by: Christopher Sellers <1@christophersellers.com> --------- Signed-off-by: Christopher Sellers <1@christophersellers.com>
Signed-off-by: Christopher Sellers <1@christophersellers.com>
PetrefiedThunder
left a comment
PetrefiedThunder
left a comment
There was a problem hiding this comment.
REVIEW: PASS deepseek b3c5153
no-ff merge verified:
- parents: d661055 + f44dd01
- merge-tree --write-tree equals commit tree 4f478292c4eed5a5afb0802e8c559edbd21c0567 (== main parent tree)
- frontend/package.json + package-lock.json blobs identical to d661055 (and already identical on f44dd01 / current main — path filter saw 0 changed files; merge is content-noop vs main)
- Dependency Audit / Security Audit: not re-fired on this head (0 path delta). Equivalent blobs on main a67a778 Dependency Audit pass; d661 Frontend Security Audit (npm) pass. Ignore older d661 pip-audit Dependency Audit red (pre-#3773 pypdf).
Behind current main a67a778 by 1 commit (#3792 pr-guards.yml only). Does not touch this PR's files; Head SHA status check already green. Optional Lead update for gate hygiene, not required for content/CI green.
Summary
Unblocks the Frontend CI Security Audit and Production Readiness Gate jobs that run
npm audit --omit=dev --audit-level=high.Main was failing on a high
follow-redirectsadvisory (1.16.0–1.16.1 via axios). Moderates includedminimatch<11.0.1(GHSA-g3hv-75wg-m249) underglob→@sentry/bundler-plugins/@sentry/nextjs@11.8.0. The existing overrideminimatch: >=3.1.3was too low for that advisory.npm audit fix --forceis not used — it would downgrade@sentry/nextjsto 10.76.1.Changes
frontend/package.jsonoverrides:follow-redirects: >=1.16.2minimatch: >=3.1.3→>=11.0.1frontend/package-lock.json:follow-redirects1.16.1 → 1.16.2minimatch10.2.4 → 11.0.3 (satisfiesglob@13.0.6consumers via override)@isaacs/nonrecursive-glob-match@1.0.3(minimatch 11 dependency)@sentry/nextjsremains 11.8.0Verification
npm ci✅npm audit --omit=dev --audit-level=high✅ exit 0 (4 moderate remain:globAbortSignal via Sentry; fixing would require the forbidden Sentry downgrade)npm run lint✅ (0 errors)npx tsc --noEmit✅npm run test:run✅ 206 files / 1647 passednpm run build(CI placeholder env) ✅ — no Sentry plugin errorsNotes
Remaining moderates are expected and out of scope for this PR (would need a newer Sentry that pulls a fixed
glob, without--force).Note
Low Risk
Dependency override and lockfile-only changes with no app logic; remaining moderate advisories tied to Sentry/glob are explicitly accepted.
Overview
Unblocks CI Security Audit / Production Readiness Gate by tightening npm overrides so
npm audit --omit=dev --audit-level=highpasses withoutnpm audit fix --force(which would downgrade@sentry/nextjs).frontend/package.json: addsfollow-redirects: >=1.16.2(fixes high advisory on 1.16.0–1.16.1 via axios) and raisesminimatchfrom>=3.1.3to>=11.0.1(GHSA on older minimatch under Sentry’s glob chain).package-lock.json: regenerated so resolved versions include follow-redirects 1.16.2, minimatch 11.0.3, and related transitive updates (e.g.@isaacs/nonrecursive-glob-match);@sentry/nextjsstays 11.8.0.Reviewed by Cursor Bugbot for commit b3c5153. Bugbot is set up for automated code reviews on this repo. Configure here.