fix: refresh lockfiles so npm audit passes again (#236)

[blippip69]

PR #10 → open-stellar-passport #236

Título

fix: refrescar lockfiles para que npm audit vuelva a pasar (#236)

Cuerpo del PR (ES)

Problema

Tres avisos high vivían en los lockfiles commiteados — brace-expansion (DoS, GHSA-3jxr-9vmj-r5cp), nanoid (bucle infinito, GHSA-28wg-ghj8-5hjv) y postcss (lectura arbitraria de .map, GHSA-fxqj-rqcc-2cmp) — así que los nueve PRs de Dependabot heredaban un check rojo aunque no tocaran nada relacionado.

Arreglo

npm audit fix por workspace (raíz, frontend/, sdk/) — los tres avisos tienen fixAvailable no-major, así que solo cambian los tres package-lock.json. Ninguna entrada de package.json se toca, ningún paquete de producción cambia de major, y no se usó ningún overrides ni bajada de --audit-level.

Verificación

workspace	antes	después
raíz	Severity: high	found 0 vulnerabilities
frontend	Severity: high	found 0 vulnerabilities
sdk	Severity: high	found 0 vulnerabilities

• npm test (raíz): verify-vk ✔
• frontend npm run build: ✔ (warning de chunk preexistente)
• sdk npm run build + typecheck: ✔
• Nota: sdk npm test sale con "No test files found" también en main (no hay *.test.ts commiteados); no es efecto de este cambio.

Desbloquea el rebase de los Dependabot (#226–#234).

Fixes #236

---

PR body (EN fallback)

Three high advisories lived in committed lockfiles so all nine Dependabot PRs inherited a red security check. Per-workspace npm audit fix refreshed the three transitive build-tooling deps to patched versions — zero package.json changes, zero major bumps, no overrides. Audit now clean at low level everywhere; verify-vk, frontend production build, sdk build and typecheck all green (sdk's empty vitest suite is pre-existing). Unblocks #226–#234 rebases. Fixes #236

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[gitar-bot]

⚠️ Quality: Lockfile refresh silently bumps production @stellar/stellar-sdk

The PR description states only the three security-advisory build-tooling transitives (brace-expansion, nanoid, postcss) changed and that no production package moved, but all three lockfiles also bump the runtime dependency @stellar/stellar-sdk 16.0.1→16.2.0 along with its deps axios 1.16.1→1.18.0 and bignumber.js. These are legal within the package.json ^16.0.1 range but are unrelated to the audited advisories and change actual runtime behavior for both frontend and sdk. Since the sdk has no committed tests, this incidental upgrade ships unvetted. Verify the stellar-sdk/axios bump is intended, or split it into a separate reviewable change; at minimum call it out in the PR body so it isn't merged as a pure lockfile-hygiene chore.

_{Was this helpful? React with 👍 / 👎}

[gitar-bot]

CI failed: The npm audit check failed because high-severity security vulnerabilities were found in project dependencies.

Overview

1 log analyzed showing a failure in the npm audit workflow due to remaining vulnerabilities above the configured threshold.

Failures

npm audit failure (confidence: high)

• Type: dependency
• Affected jobs: 98057940858
• Related to change: yes
• Root cause: Vulnerabilities (including a high-severity one) are present in the dependencies, causing npm audit --audit-level=high to fail with exit code 1.
• Suggested fix: Review and update the vulnerable dependencies or refresh the lockfiles to resolve the security issues.

Summary

• Change-related failures: 1 dependency audit failure
• Infrastructure/flaky failures: None
• Recommended action: Update the lockfile or patch the affected package dependencies so that npm audit passes successfully.

Code Review ⚠️ Changes requested 0 resolved / 1 findings

Refreshes the workspace lockfiles to resolve three high-severity security advisories, but silently bumps production dependency @stellar/stellar-sdk contrary to the PR description.

⚠️ Quality: Lockfile refresh silently bumps production @stellar/stellar-sdk

📄 frontend/package-lock.json:3260-3270 📄 frontend/package-lock.json:4159-4161 📄 sdk/package-lock.json:432-442 📄 sdk/package-lock.json:1003-1005

The PR description states only the three security-advisory build-tooling transitives (brace-expansion, nanoid, postcss) changed and that no production package moved, but all three lockfiles also bump the runtime dependency @stellar/stellar-sdk 16.0.1→16.2.0 along with its deps axios 1.16.1→1.18.0 and bignumber.js. These are legal within the package.json ^16.0.1 range but are unrelated to the audited advisories and change actual runtime behavior for both frontend and sdk. Since the sdk has no committed tests, this incidental upgrade ships unvetted. Verify the stellar-sdk/axios bump is intended, or split it into a separate reviewable change; at minimum call it out in the PR body so it isn't merged as a pure lockfile-hygiene chore.

🤖 Prompt for agents

Code Review: Refreshes the workspace lockfiles to resolve three high-severity security advisories, but silently bumps production dependency @stellar/stellar-sdk contrary to the PR description.

1. ⚠️ Quality: Lockfile refresh silently bumps production @stellar/stellar-sdk
   Files: frontend/package-lock.json:3260-3270, frontend/package-lock.json:4159-4161, sdk/package-lock.json:432-442, sdk/package-lock.json:1003-1005

   The PR description states only the three security-advisory build-tooling transitives (brace-expansion, nanoid, postcss) changed and that no production package moved, but all three lockfiles also bump the runtime dependency @stellar/stellar-sdk 16.0.1→16.2.0 along with its deps axios 1.16.1→1.18.0 and bignumber.js. These are legal within the package.json ^16.0.1 range but are unrelated to the audited advisories and change actual runtime behavior for both frontend and sdk. Since the sdk has no committed tests, this incidental upgrade ships unvetted. Verify the stellar-sdk/axios bump is intended, or split it into a separate reviewable change; at minimum call it out in the PR body so it isn't merged as a pure lockfile-hygiene chore.

Tip

Comment Gitar fix CI or enable auto-apply: gitar auto-apply:on

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing less information.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

---

Important

Your trial ends in 6 days — upgrade now to keep code review, CI analysis, auto-apply, custom automations, and more.

_{Was this helpful? React with 👍 / 👎 | Gitar}