2740621fee
All checks were successful
PR Check — Frontend / frontend (pull_request) Successful in 1m37s
npm update postcss moves it 8.5.13 -> 8.5.23, clearing GHSA-r28c-9q8g-f849 (path traversal in previous-source-map auto-loading via a sourceMappingURL comment, arbitrary .map disclosure, 7.5 high). No overrides entry needed, unlike #241: vite declares postcss ^8.5.3 and 8.5.23 is published, so the existing range already permitted the fix and only the lockfile carried a stale resolution. nanoid 3.3.11 -> 3.3.16 comes along as postcss's own dependency, within its declared range. postcss IS the CSS pipeline, so a green build only proves compilation. The emitted stylesheet was diffed across the bump and is byte-for-byte identical (same content hash, same asset filename). The remaining react-router advisory (GHSA-qwww-vcr4-c8h2, RSC Mode CSRF bypass) is accepted rather than fixed. It targets React Server Components, which a Tauri desktop app never runs — App.tsx mounts a client-only BrowserRouter and src/ has no createStaticHandler, StaticRouter or server rendering. There is also nothing to move forward to: react-router-dom is frozen at 7.18.1 since v8 merged the package into react-router, so npm's proposed "fix" is a downgrade to 7.11.0, and leaving the affected range means migrating to react-router v8. Re-evaluation trigger tracked in #317. Unlike the Rust side, no CI gate is involved: check-frontend.yml runs no npm audit step, so nothing turns red. That expectation is now written down in docs/architecture.md and CLAUDE.md so the two permanent high findings do not read as a regression. npm audit: 3 findings -> 2 (high 3 -> 2), postcss cleared. npm ci + npm run build + 871 vitest green. Resolves #311 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| adr | ||
| archive | ||
| api-contract-prices.md | ||
| architecture.md | ||
| audit-bilan-2026-05.md | ||
| guide-utilisateur.md | ||
| qa-refonte-seed-categories-ipc.md | ||