pnpm audit reports 6 MODERATE CVEs (no HIGH/CRITICAL): (1) dompurify ≤ 3.3.3 — ADD_TAGS/FORBID_TAGS bypass (production-runtime). (2) vite ≤ 6.4.1 — path-traversal in dev-deps (dev-only). (3) esbuild ≤ 0.24.2 — dev-server CORS * (dev-only). (4) brace-expansion 1.1.12 / 2.0.0-2.0.2 — ReDoS (transitive via eslint, exceljs, vitest).
Evidence
pnpm audit --audit-level=high output
apps/web/package.json — direct dompurify dependency
Impact
Only dompurify is runtime. Stored XSS possible in project descriptions / estimate notes via sanitizer bypass.
Proposed Fix
(1) Upgrade dompurify to ≥ 3.3.4 (patch release). (2) Upgrade vitest/vite/esbuild to latest. (3) Add overrides in root package.json pinning brace-expansion to patched versions. (4) Integrate into CI as part of #28 (SAST/DAST).
Acceptance Criteria
pnpm audit --audit-level=high reports 0 HIGH/CRITICAL and ≤2 moderate
brace-expansion pinned to ^5.0.5 via pnpm.overrides in root package.json — all transitive call-sites now inherit the patched version.
esbuild pinned to >=0.25.0 via pnpm.overrides.
Remaining — single moderate CVE: vite@5.4.21 (transitive via vitest@2.1.9) — GHSA-4w7w-66w2-5vf9 (path-traversal in vite dev optimized-deps .map handling). Not exposed because vitest uses vite's transform pipeline only, never runs the dev server. Upgrading vite to >=6.4.2 requires vitest 3.x which is a breaking jump across the test suite (1900+ tests). Accepting the moderate as a documented dev-time risk; tracked for a future vitest-3 migration.
Nightly audit workflow → rolled into #28 (SAST/DAST CI integration) per the ticket's original proposal
docs/security-architecture.md dep section — to be updated in the #28 PR
Closing the core-dep part; CI-wiring tracked in #28.
Acceptance criteria met. `pnpm audit --audit-level=moderate` on main:
```
1 vulnerabilities found
Severity: 1 moderate
```
**Resolved upgrades** (main commit 534945f):
- `dompurify` → 3.3.4+ (runtime sanitizer bypass, GHSA-vhxf-7vqr-mrjg — patched).
- `brace-expansion` pinned to `^5.0.5` via `pnpm.overrides` in root `package.json` — all transitive call-sites now inherit the patched version.
- `esbuild` pinned to `>=0.25.0` via `pnpm.overrides`.
**Remaining** — single moderate CVE: `vite@5.4.21` (transitive via `vitest@2.1.9`) — GHSA-4w7w-66w2-5vf9 (path-traversal in `vite dev` optimized-deps `.map` handling). Not exposed because vitest uses vite's transform pipeline only, never runs the dev server. Upgrading vite to >=6.4.2 requires vitest 3.x which is a breaking jump across the test suite (1900+ tests). Accepting the moderate as a documented dev-time risk; tracked for a future vitest-3 migration.
Acceptance-criteria status:
- [x] `pnpm audit --audit-level=high` reports 0 HIGH/CRITICAL (verified)
- [x] ≤2 moderate (1 moderate, below threshold)
- [ ] Nightly audit workflow → rolled into #28 (SAST/DAST CI integration) per the ticket's original proposal
- [ ] `docs/security-architecture.md` dep section — to be updated in the #28 PR
Closing the core-dep part; CI-wiring tracked in #28.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Problem
pnpm auditreports 6 MODERATE CVEs (no HIGH/CRITICAL): (1) dompurify ≤ 3.3.3 — ADD_TAGS/FORBID_TAGS bypass (production-runtime). (2) vite ≤ 6.4.1 — path-traversal in dev-deps (dev-only). (3) esbuild ≤ 0.24.2 — dev-server CORS*(dev-only). (4) brace-expansion 1.1.12 / 2.0.0-2.0.2 — ReDoS (transitive via eslint, exceljs, vitest).Evidence
pnpm audit --audit-level=high outputapps/web/package.json — direct dompurify dependencyImpact
Only dompurify is runtime. Stored XSS possible in project descriptions / estimate notes via sanitizer bypass.
Proposed Fix
(1) Upgrade
dompurifyto ≥ 3.3.4 (patch release). (2) Upgradevitest/vite/esbuildto latest. (3) Addoverridesin rootpackage.jsonpinningbrace-expansionto patched versions. (4) Integrate into CI as part of #28 (SAST/DAST).Acceptance Criteria
pnpm audit --audit-level=highreports 0 HIGH/CRITICAL and ≤2 moderateParent Epic: #1
Source: Full-Codebase Security Audit 2026-04-16 (C-8)
Acceptance criteria met.
pnpm audit --audit-level=moderateon main:Resolved upgrades (main commit
534945f):dompurify→ 3.3.4+ (runtime sanitizer bypass, GHSA-vhxf-7vqr-mrjg — patched).brace-expansionpinned to^5.0.5viapnpm.overridesin rootpackage.json— all transitive call-sites now inherit the patched version.esbuildpinned to>=0.25.0viapnpm.overrides.Remaining — single moderate CVE:
vite@5.4.21(transitive viavitest@2.1.9) — GHSA-4w7w-66w2-5vf9 (path-traversal invite devoptimized-deps.maphandling). Not exposed because vitest uses vite's transform pipeline only, never runs the dev server. Upgrading vite to >=6.4.2 requires vitest 3.x which is a breaking jump across the test suite (1900+ tests). Accepting the moderate as a documented dev-time risk; tracked for a future vitest-3 migration.Acceptance-criteria status:
pnpm audit --audit-level=highreports 0 HIGH/CRITICAL (verified)docs/security-architecture.mddep section — to be updated in the #28 PRClosing the core-dep part; CI-wiring tracked in #28.