Gate validation on severe tooling advisories

[georgeatparallel]

This package adds Parallel search, research Tasks and web monitoring to n8n workflows. CI and the npm release script share npm run validate, which checks the code and the installable package. Its security check used npm audit --omit=dev, so severe vulnerabilities in the tools used to build and validate the package could still pass. CI saved a full audit report, but that report did not block validation.

This adds npm audit --audit-level=high to the same command. It checks development dependencies too and exits with an error for high or critical findings. That fails CI and stops the release script before npm publish. The existing production audit stays in place, and moderate tooling findings remain visible in the output and saved JSON report. No dependency versions or runtime code change.

The contributor guide also records the remaining findings and the consumer checks behind them. The reviewed audit has zero production findings, zero high/critical findings, and ten affected development packages from four moderate advisories in uuid, qs and stream-json. Those tooling libraries are not bundled in this package’s tarball; the n8n host has its own dependency tree. The release owner still needs to accept the remaining exposure or wait for compatible fixes. Load tracing covered validation and release rehearsal, leaving ESM loads, interactive development and scaffolding unverified.

Both Node 22.22 and 24 CI jobs pass. Independent review confirmed the new audit command rejects a vulnerable baseline even when its production audit passes. The release rehearsal also passed all 21 tests, temporary package installation/loading and publish hooks on Node 24.18/npm 11.6.0. Only the final registry operation was a dry run; nothing was published.