fix(ci): unblock audit and test gates

Patch vulnerable dependency paths (vitest, axios override, and react-router) and update Vitest 4 test mocks/assertions so lint, test, and audit checks pass in CI.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: olivrg

DEPENDENCIES.md

@@ -76,3 +76,7 @@ Action versions are pinned to major version tags (e.g., `@v4`). Dependabot propo
 ### pnpm overrides
 
 The `pnpm-workspace.yaml` file includes overrides to patch known vulnerabilities in transitive dependencies when upstream packages haven't released fixes yet.
+
+Current security-patch overrides include `axios` pinned at `1.17.0` to address NO_PROXY bypass and proxy gadget advisories inherited via `@slack/web-api`.
+
+Vitest is pinned at `4.1.8` across JS workspaces to stay above the `GHSA-5xrq-8626-4rwp` floor, and dashboard `react-router` is pinned at `7.16.0` to stay above current `GHSA-49rj-9fvp-4h2h` / `GHSA-8x6r-g9mw-2r78` fixes.

docs/deployment-sidecar.md

@@ -162,7 +162,7 @@ keep the upstream server off the network your dev container is attached to.
   "dockerComposeFile": "../compose.yaml",
   "service": "agent", // VS Code attaches to the agent service above
   "workspaceFolder": "/workspace",
-  "forwardPorts": [3100] // dashboard only; do not forward the upstream MCP port
+  "forwardPorts": [3100], // dashboard only; do not forward the upstream MCP port
 }
 ```
 

packages/dashboard/package.json

@@ -24,7 +24,7 @@
   "dependencies": {
     "react": "19.2.4",
     "react-dom": "19.2.4",
-    "react-router": "7.13.2",
+    "react-router": "7.16.0",
     "recharts": "3.8.1"
   },
   "devDependencies": {
@@ -38,6 +38,6 @@
     "tailwindcss": "4.2.2",
     "typescript": "5.9.3",
     "vite": "6.4.2",
-    "vitest": "3.2.4"
+    "vitest": "4.1.8"
   }
 }

packages/dashboard/src/components/ErrorBoundary.test.tsx

@@ -9,7 +9,6 @@ beforeEach(() => {
 })
 
 afterEach(() => {
-  consoleErrorSpy.mockRestore()
   vi.restoreAllMocks()
 })
 

packages/proxy/package.json

@@ -53,7 +53,7 @@
     "@types/picomatch": "4.0.2",
     "tsup": "8.5.1",
     "tsx": "4.21.0",
-    "vitest": "3.2.4"
+    "vitest": "4.1.8"
   },
   "dependencies": {
     "@hono/node-server": "1.19.13",

packages/proxy/src/approval/channels.test.ts

@@ -4,9 +4,11 @@ import { WebhookChannel } from './webhook.js'
 import { SlackChannel } from './slack.js'
 
 vi.mock('@slack/web-api', () => ({
-  WebClient: vi.fn().mockImplementation(() => ({
-    chat: { postMessage: vi.fn(), update: vi.fn() },
-  })),
+  WebClient: vi.fn(function MockWebClient() {
+    return {
+      chat: { postMessage: vi.fn(), update: vi.fn() },
+    }
+  }),
 }))
 
 describe('createChannels', () => {

packages/proxy/src/approval/slack-actions.test.ts

@@ -11,13 +11,17 @@ import type { ApprovalChannel } from './types.js'
 // Mock @slack/web-api
 // ---------------------------------------------------------------------------
 
-const mockPostMessage = vi.fn().mockResolvedValue({ ok: true, ts: '1234.5678' })
-const mockUpdate = vi.fn().mockResolvedValue({ ok: true })
+const { mockPostMessage, mockUpdate } = vi.hoisted(() => ({
+  mockPostMessage: vi.fn().mockResolvedValue({ ok: true, ts: '1234.5678' }),
+  mockUpdate: vi.fn().mockResolvedValue({ ok: true }),
+}))
 
 vi.mock('@slack/web-api', () => ({
-  WebClient: vi.fn().mockImplementation(() => ({
-    chat: { postMessage: mockPostMessage, update: mockUpdate },
-  })),
+  WebClient: vi.fn(function MockWebClient() {
+    return {
+      chat: { postMessage: mockPostMessage, update: mockUpdate },
+    }
+  }),
 }))
 
 // ---------------------------------------------------------------------------

packages/proxy/src/approval/slack.test.ts

@@ -9,13 +9,17 @@ import type { ApprovalChannel, ApprovalTicket } from './types.js'
 // Mock @slack/web-api
 // ---------------------------------------------------------------------------
 
-const mockPostMessage = vi.fn()
-const mockUpdate = vi.fn()
+const { mockPostMessage, mockUpdate } = vi.hoisted(() => ({
+  mockPostMessage: vi.fn(),
+  mockUpdate: vi.fn(),
+}))
 
 vi.mock('@slack/web-api', () => ({
-  WebClient: vi.fn().mockImplementation(() => ({
-    chat: { postMessage: mockPostMessage, update: mockUpdate },
-  })),
+  WebClient: vi.fn(function MockWebClient() {
+    return {
+      chat: { postMessage: mockPostMessage, update: mockUpdate },
+    }
+  }),
 }))
 
 // ---------------------------------------------------------------------------

packages/proxy/src/audit/store.test.ts

@@ -164,7 +164,7 @@ CREATE TABLE IF NOT EXISTS audit_records (
               includeResponses: true,
               cleanupIntervalMs: 0,
             }),
-        ).toThrowError(
+        ).toThrow(
           /Audit DB schema mismatch: missing required columns .*"block_reason".*Delete ".*audit\.db".*then restart Helio\./,
         )
       } finally {
@@ -217,7 +217,7 @@ CREATE TABLE IF NOT EXISTS audit_records (
               includeResponses: true,
               cleanupIntervalMs: 0,
             }),
-        ).toThrowError(
+        ).toThrow(
           /Audit DB schema mismatch: missing required columns .*"upstream_http_status".*Delete ".*audit\.db".*then restart Helio\./,
         )
       } finally {

packages/proxy/src/upstream/sse-forwarder.test.ts

@@ -267,7 +267,9 @@ describe('SseUpstreamForwarder', () => {
 
     const originalFetch = globalThis.fetch
     globalThis.fetch = (input: string | URL | Request, init?: RequestInit): Promise<Response> => {
-      const method = (init?.method ?? (input instanceof Request ? input.method : 'GET')).toUpperCase()
+      const method = (
+        init?.method ?? (input instanceof Request ? input.method : 'GET')
+      ).toUpperCase()
       if (method === 'POST') {
         return Promise.reject(fetchFailed('ECONNREFUSED'))
       }
@@ -292,7 +294,9 @@ describe('SseUpstreamForwarder', () => {
 
     const originalFetch = globalThis.fetch
     globalThis.fetch = (input: string | URL | Request, init?: RequestInit): Promise<Response> => {
-      const method = (init?.method ?? (input instanceof Request ? input.method : 'GET')).toUpperCase()
+      const method = (
+        init?.method ?? (input instanceof Request ? input.method : 'GET')
+      ).toUpperCase()
       if (method === 'POST') {
         return Promise.reject(fetchFailed('ECONNREFUSED'))
       }