UID2-7548: standardize lockfiles (drop package-lock.json, pin yarn+registry, CI lockfile gate) - #199
Closed
mcollins-ttd wants to merge 5 commits into
Closed
UID2-7548: standardize lockfiles (drop package-lock.json, pin yarn+registry, CI lockfile gate)#199mcollins-ttd wants to merge 5 commits into
mcollins-ttd wants to merge 5 commits into
Conversation
Fixes trivy HIGH findings flagged by the scheduled vulnerability scan: - GHSA-gcfj-64vw-6mp9: axios Node HTTP adapter proxy inheritance (direct dep) - CVE-2026-13149: brace-expansion ReDoS (transitive; pinned via npm overrides + yarn resolutions) Both package-lock.json and yarn.lock regenerated. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The initial commit forced a global brace-expansion 5.0.7 override, which broke eslint-plugin-import's minimatch@3 (a brace-expansion v1 API consumer) with 'expand is not a function' during yarn lint. Fix: pin brace-expansion per major instead (v1->1.1.16, v2->2.1.2, v5->5.0.7) via npm major-scoped overrides, and regenerate yarn.lock with within-range upgrades so each major keeps its own fixed patch. Also bump js-yaml v3->3.15.0 (CVE-2026-59869). Verified locally: yarn lint passes and both lockfiles are scan-clean. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…m-bumps # Conflicts: # package-lock.json # yarn.lock
…egistry, CI lockfile gate - Delete unused package-lock.json (CI is yarn-only; halves trivy scan surface, ends npm/yarn drift) - Pin packageManager: yarn@1.22.22 (deterministic serialization) - Add .yarnrc pinning registry to https://registry.npmjs.org - Normalize all yarn.lock resolved URLs to registry.npmjs.org (host-only; integrity unchanged, no version changes) - CI: yarn install --frozen-lockfile + lockfile-lint (--allowed-hosts npm --validate-https) Verified locally: frozen-lockfile stable, lockfile-lint clean, yarn lint passes, CVE fix versions unchanged. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…dize-lockfiles # Conflicts: # package-lock.json # yarn.lock
Contributor
Author
|
Superseded by a clean single-commit PR on top of main (no merge commit): #200 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up to #198 (now merged). Standardizes lockfile management so the registry-host churn seen in #198 can't recur:
package-lock.json— CI is yarn-only; the file was unused and only doubled the trivy scan surface (and could drift fromyarn.lock).packageManager: yarn@1.22.22— deterministic serialization across devs/CI..yarnrc→registry.npmjs.org; allyarn.lockresolvedURLs normalized to that single host (host-only change, integrity hashes unchanged, no dependency-version changes).build-and-test.yaml:yarn install --frozen-lockfile+lockfile-lint --allowed-hosts npm --validate-https(fails on a stray registry host or an out-of-sync lockfile).Verified locally:
yarn install --frozen-lockfilestable,lockfile-lintclean,yarn lintpasses, CVE-fix versions unchanged.Jira: UID2-7548. Note: the
--frozen-lockfileCI line overlaps UID2-7296 — de-dupe at merge.