mirror of
https://github.com/rcourtman/Pulse.git
synced 2026-10-23 20:25:56 +00:00
rcourtman
237130a2cb
GHSA-vfj7-8cjw-p6xm (braces <= 3.0.3, no patched release) reached the frontend graph only through dev-only tailwindcss 3 and jscpd 4, and from 3 October it failed the required Frontend check on every open pull request, Go-only ones included. The production audit is clean, and a change that leaves package.json and package-lock.json untouched has the base commit's graph, so it can neither add a finding nor remove one. Failing it blocked every fix and made nothing safer. The runner now applies the split it already used for an unreachable endpoint to findings too. A change that moves the graph, or edits the runner, still fails on any finding at any severity. A change whose graph is the base commit's warns, naming every finding. Only an explicit NPM_AUDIT_REQUIRE_RESULT=false selects that mode; an empty or unrecognised value, as a missing workflow output would give, stays strict, which also tightens the outage path. The scheduled npm-audit scan and the daily dependency advisory watch keep the strict default, so an inherited advisory still fails somewhere every day until the dependency graph is fixed. No severity threshold, allowlist or suppression is added.