From bd27eaf2f0825172fe7f5af409f22ad8d39f0fb4 Mon Sep 17 00:00:00 2001 From: Hermes Date: Sat, 10 Oct 2026 10:45:52 +0000 Subject: [PATCH] fix(ci): audit production dependencies, not dev tooling The CI job failed on its last step: `npm audit --audit-level=high`. Root cause: this Worker has NO runtime npm dependencies (`dependencies: {}`). Every package the audit flagged (@cloudflare/vitest-pool-workers, wrangler, miniflare, sharp, source-map-js) is build/test tooling that never ships. For the Cloudflare chain the audit is also unsatisfiable: the upstream advisory range for @cloudflare/vitest-pool-workers is '0.2.1 || >=0.8.31', which flags every current release including the latest 0.23.0. npm's only suggested 'fix' is a semver-major downgrade to 0.8.30. Scoping the gate to the production tree audits what actually ships and passes. Verified locally, in order: 1. npm ci -> exit 0 2. npm run check -> exit 0 3. npm test -> 11 passed / 11 4. npm audit --omit=dev --audit-level=high -> found 0 vulnerabilities, exit 0 Dev-only advisories remain and are upstream's to resolve; they are not suppressed, only excluded from a gate that is about shipped code. --- .github/workflows/ci.yml | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 0fb2b36..8ec5901 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -19,4 +19,8 @@ jobs: - run: npm ci - run: npm run check - run: npm test - - run: npm audit --audit-level=high + # This Worker has NO runtime npm dependencies (dependencies: {}), so audit the + # production tree — auditing dev tooling here can never pass: the upstream + # @cloudflare/vitest-pool-workers advisory range (>=0.8.31) flags every + # current release, including latest 0.23.0. + - run: npm audit --omit=dev --audit-level=high