chore: remediate runtime HTTP dependency advisories#367
Conversation
bntvllnt
left a comment
bntvllnt
left a comment
There was a problem hiding this comment.
Review — 0 blocking findings (manual approval recommended)
BLOCKING
None.
WARN
- CI/merge-state warning:
Vercel – ui.vllnt.aiis failing because the deployment was canceled from the Vercel Dashboard. I did not find evidence this is caused by the dependency diff, andVercel – storybookplus the repo quality/security checks are green, but this status may still need a rerun/waiver before merge depending on branch protection.
VERIFIED CLEAN
- Reviewed current head
9ef8fb8fdd02e3b7656aaa747e1be654d3c269e1onchore/361-runtime-http-advisories. - PR body links
Fixes #361and matches the current two-file diff (package.json,pnpm-lock.yaml). - Scope stays within issue #361: root
pnpm.overridesplus lockfile resolution/snapshot updates forhono,@hono/node-server,express-rate-limit,axios,follow-redirects,fast-uri, andip-address. - No PostCSS remediation is included in the diff, and there is no shadcn/PostCSS diff churn from #355/#360.
- This does not repair, merge, or broaden superseded PR #359; #359 remains a separate broad Dependabot PR and this PR uses the scoped
chore/361-runtime-http-advisoriesbranch. - No source, generated registry output, release, security policy, or direct-main changes are included.
VALIDATION
- Locally ran
pnpm install --frozen-lockfileat the reviewed head: pass. - Locally ran
pnpm audit --json --audit-level moderateat the reviewed head: command exits 1 because unrelated default-branch advisories remain, but none of the #361 scoped runtime/HTTP packages remain in the advisory set. Audit metadata matches the PR body:low=1,moderate=12,high=13,critical=1,totalDependencies=1534. - Live GitHub checks observed: Quality Gates, CodeQL, Analyze (actions), Analyze (javascript-typescript), Enforce issue-linked PRs, Scan codebase health, Vercel Preview Comments, and Vercel Storybook are passing;
Vercel – ui.vllnt.aiis canceled/failing as noted above. - PR body explicitly documents the
pnpm check:circularblocker (madge: not found) and states no source import graph changed.
Approval is recommended, but final approval remains reserved for bntvllnt.
bntvllnt
left a comment
bntvllnt
left a comment
There was a problem hiding this comment.
@bntvllnt APPROVE — dependency/security review clean for the scoped runtime/HTTP remediation.
Evidence checked at head 9ef8fb8fdd02e3b7656aaa747e1be654d3c269e1:
- Diff is limited to
package.jsonandpnpm-lock.yaml; it pins the scoped runtime/HTTP packages (hono,@hono/node-server,express-rate-limit,axios,follow-redirects,fast-uri,ip-address) to the intended patched versions plus lockfile updates. pnpm install --frozen-lockfile --ignore-scriptspassed.pnpm audit --jsonstill exits 1 for unrelated advisories, but scoped targets are absent:hono: 0,@hono/node-server: 0,express-rate-limit: 0,axios: 0,follow-redirects: 0,fast-uri: 0,ip-address: 0.- PR body links
Fixes #361and documents remaining advisories as out of scope. - GitHub checks are green for Quality Gates, CodeQL, health scan, issue-link, JS/TS analysis, actions analysis, preview comments, and Storybook;
Vercel – ui.vllnt.airemains failed/canceled externally and needs human/Vercel handling before merge if the repo treats that preview as required.
No blocking source/dependency findings from this review.
|
Preview build failed apply failed: kubectl apply: exit status 1 (stderr: Error from server (Forbidden): error when retrieving current configuration of: InspectCheck deployer logs: kubectl logs -n vllnt-platform deploy/deployer |
bntvllnt
left a comment
bntvllnt
left a comment
There was a problem hiding this comment.
Review — 0 blocking findings, manual approval recommended
BLOCKING
None.
WARN / NOTES
- No merge-blocking issues found. One freshness note: a live
pnpm audit --json --audit-level moderatenow reports the scoped runtime/HTTP packages from #361 at 0 findings, but the unrelated residual audit metadata currently readslow=1,moderate=14,high=13,critical=1,totalDependencies=1534rather than the PR body's oldermoderate=12line. The scoped remediation claim is still correct; refresh that count if you want exact audit metadata current at merge time.
VERIFIED CLEAN
- Current PR head matches the routed review SHA:
a2496123a898e2714881376c6f9e56dd7f8e178b. - Changed-file coverage complete: reviewed
package.jsonandpnpm-lock.yaml; both files were marked viewed. - Scope matches #361: the diff is limited to root
pnpm.overridesand lockfile resolution/snapshot entries forhono,@hono/node-server,express-rate-limit,axios,follow-redirects,fast-uri, andip-address. - Lockfile/manifests are consistent:
pnpm install --frozen-lockfilesucceeds, and installed resolution paths show the scoped patched versions (hono@4.12.18,@hono/node-server@1.19.13,express-rate-limit@8.2.2,axios@1.15.2,follow-redirects@1.16.0,fast-uri@3.1.2,ip-address@10.1.1). - Live GitHub checks are acceptable: 8 passing checks, 1 neutral superseded preview check.
- Issue-link policy is satisfied: PR body contains
Fixes #361. - No generated files, source files, release artifacts, or policy/security docs are changed.
VALIDATION
Ran locally at this head:
pnpm install --frozen-lockfile✅pnpm audit --json --audit-level moderate✅ for scoped #361 packages: 0 findingspnpm -F @vllnt/ui lint✅pnpm -F @vllnt/ui exec tsc --noEmit --project tsconfig.build.json✅pnpm build✅ (existing Turbopack NFT warning observed; build succeeds)pnpm test:once✅ 216 files / 1215 tests passed, with existing jsdom/component warning noise
Manual approval remains the next action; I am not submitting an autonomous APPROVE.
1 participant
Summary
pnpm.overridesonly.hono,@hono/node-server,express-rate-limit,axios,follow-redirects,fast-uri,ip-address, andproxy-from-env(1.1.0 → 2.1.0, transitive via axios).pnpm-lock.yamlwithout shadcn canary/tooling drift; the diff is limited to root overrides and the selected dependency resolution/snapshot entries.Fixes #361
Validation
pnpm install --frozen-lockfile✅pnpm audit --json --audit-level moderate✅ selected runtime/HTTP findings:0low=1,moderate=12,high=13,critical=1,totalDependencies=1534pnpm -F @vllnt/ui lint✅pnpm -F @vllnt/ui exec tsc --noEmit --project tsconfig.build.json✅pnpm build✅apps/registry/next.config.mjsremains non-blocking.pnpm test:once✅ 216 files / 1215 tests passedpnpm check:circularmadgebinary in the current dependency graph (sh: 1: madge: not found). No source import graph was changed by this PR.Scope note
This intentionally does not address unrelated remaining advisories in the default branch audit; it only removes the runtime/HTTP package findings named in #361.
Branch freshness
mainon 2026-05-31T15:06:18Z.9e88ff54646846bdfa1686a232650ec0a5d86d74.7d14e563f349259d071634e02a8f489fedb6b0bd.UNSTABLE.