Skip to content

build: fold SCA dependency updates

Viet Tan Tran requested to merge feat/security-sca-updates into develop

Created by: ihsraham

Summary

  • Folds the open SCA dependency updates from Dependabot PRs #141, #142, #143, #144, and #145 into one branch based on fresh develop.
  • Updates package-lock.json for fast-xml-parser, fast-xml-builder, fast-uri, uuid, dompurify, and related transitive fixes.
  • Adds a package override so Next resolves to the patched root postcss version instead of retaining its vulnerable nested copy.
  • Regenerates the lockfile with CI's npm 10 behavior so npm ci accepts the optional peer dependency graph.

CI status

Local validation passes, but GitHub Actions currently fails before quality gates at npm ci because the runner cannot download @tetherto/docs-seo-schema from GitHub Packages on a cold npm cache. The workflow token has packages: read, but GitHub Packages returns 401 Unauthorized / read_package denial for the docs-seo package tarball. Recent docs PRs passed because they restored an existing npm cache; this lockfile-changing PR gets a new cache key and exposes the package access issue.

Package/repo access or a valid NPM_READ_TOKEN needs to be fixed for cold-cache CI to pass.

Validation

  • npx npm@10.9.8 ci
  • npx npm@10.9.8 audit --audit-level=moderate
  • npx npm@10.9.8 run quality

Merge request reports