c095fa6d

build(web): the dependency advisories are answered

a73x   2026-08-11 11:58

build(web): the dependency advisories are answered

`npm audit` in web/ reported seven, and the useful question about each is not
its severity but whether its code can run here. The console is a static SPA:
`ssr = false`, `prerender = false`, adapter-static, and the Go server embeds
the client bundle and serves it as files. No Node process handles a request.
devDependencies are a build-time toolchain, and nothing in the tree below vite
or openapi-typescript reaches a browser — the built `build/` tree contains no
reference to any package named below.

Six clear with patch bumps inside the ranges package.json already declares, so
only package-lock.json moves:

  @sveltejs/kit    2.65.0  -> 2.70.2   moderate; GHSA-866w-xmhq-wj7x,
    GHSA-wqjv-9729-c5q2, GHSA-29g2-3rmr-qm68 — all in the server runtime
    (remote-function form handling, Accept-header negotiation) we never run.
  postcss          8.5.15  -> 8.5.26   high; GHSA-r28c-9q8g-f849,
    GHSA-fxqj-rqcc-2cmp — vite's CSS pipeline at build time, reading
    sourceMappingURL out of our own stylesheets.
  nanoid           3.3.12  -> 3.3.18   high; GHSA-28wg-ghj8-5hjv,
    GHSA-2v37-7h3g-55p8 — under postcss, same build-time reach.
  js-yaml          4.2.0   -> 4.3.1    high; GHSA-52cp-r559-cp3m,
    GHSA-5p4m-2wfm-xmqj — under openapi-typescript, parsing the spec `make
    api` hands it, which this repo generates.
  @redocly/openapi-core  1.34.17 -> 1.34.19  high, by way of js-yaml above.
  brace-expansion  2.1.2   -> 2.1.4    high; GHSA-mh99-v99m-4gvg,
    GHSA-rgw5-rvv9-x895 — minimatch, same openapi-typescript branch.

The seventh is accepted and recorded: cookie <0.7.0, GHSA-pxg6-pf52-xh8x, low,
CVSS 0 — out-of-bounds characters accepted in a cookie name. It arrives under
@sveltejs/kit, and kit@2.70.2, the newest 2.x there is, still declares
`cookie: ^0.6.0`; upstream has not moved. npm's offered fix is a downgrade to
@sveltejs/kit@0.0.30, which is not a fix. The parser lives in kit's
request-handling half and never executes in a build that serves no requests,
so the honest answer is to leave it and say why rather than to force a version
nothing here was tested against.

No major bumps were taken. None was needed: no advisory reaches production
code, so none of them buys the risk of moving vite, svelte or kit a major.
docs/assumptions.md records the claim that carries this — the console ships no
server runtime — along with what would make it false, because if anything ever
runs node against this app the accepted advisory goes live and the list has to
be read again.

`npm ci` from the new lockfile, `npm run build`, `npm run check`, `npm test`
and `make ci` all pass; api-check confirms the bumped generator still writes
the same api-types.ts, byte for byte.