chore(audit): daily dependency scan and triage

- Generated artifacts/npm-audit.json, artifacts/npm-outdated.json, artifacts/deps-report.md - Attempted esbuild upgrade (0.27.2 -> 0.27.3) but reverted due to E2E environment failure (see issues/upgrade-esbuild.md) - Flagged nostr-tools for manual review (see issues/upgrade-nostr-tools.md) - Updated DECISIONS.md and TODO.md Co-authored-by: PR0M3TH3AN <[email protected]>
2026-11-09 06:12:56 +00:00 · 2026-02-12 14:49:04 +00:00
1 parent 68b583fb9b
commit 8a1d843c24
@@ -1,17 +1,23 @@
-# Upgrade esbuild
+# Upgrade Attempt: esbuild (v0.27.2 -> v0.27.3)

-## Status
- **Current:** `0.27.2`
- **Latest:** `0.27.3`
+**Status:** FAILED (Reverted)
+**Date:** 2026-02-17

 ## Details
-`esbuild` 0.x versions may have breaking changes between minor versions, but this is a patch.
-Used for build scripts (`scripts/build-dist.mjs`, `scripts/build-beacon.mjs`).
+Attempted to upgrade `esbuild` from `0.27.2` to `0.27.3`.

-## Plan
-1. Update `esbuild`.
-2. Run build scripts: `npm run build`, `npm run build:beacon`.
-3. Verify output bundles work correctly.
+## Test Results
+- `npm run build`: **PASSED**
+- `npm run test:unit`: **PASSED**
+- `npm run test:dm:integration`: **PASSED**
+- `npm run test:e2e`: **FAILED** (Environment Issue)

-## Guardrails
- Build tool upgrade.
+## Failure Analysis
+The E2E tests failed because the Playwright browser binaries were not found in the CI environment:
+```
+Error: browserType.launch: Executable doesn't exist at /home/jules/.cache/ms-playwright/chromium_headless_shell-1208/chrome-headless-shell-linux64/chrome-headless-shell
+```
+
+## Next Steps
+- Ensure the CI/Agent environment has `npx playwright install` run before attempting upgrades that require E2E verification.
+- Once browsers are available, retry the upgrade.
@@ -1,15 +1,34 @@
-# Upgrade nostr-tools
+# Upgrade Proposal: `nostr-tools` (v2.19.4 -> v2.23.0)

-**Package:** `nostr-tools`
-**Current Version:** `2.19.4`
-**Wanted Version:** `2.23.0`
-**Latest Version:** `2.23.0`
+**Status:** `REVIEW-REQUIRED` (Protocol Library)
+**Priority:** High (Security/Protocol Compliance)

-## Details
-This package was identified as a critical dependency (cryptographic/protocol library). Automatic upgrade was skipped.
+## Context
+`nostr-tools` is the core protocol library for bitvid. `AGENTS.md` explicitly forbids automatic upgrades for crypto/protocol libraries.
+
+## Version Changes
+- **Current:** `2.19.4`
+- **Target:** `2.23.0`
+- **Changelog:** [Link to nostr-tools releases](https://github.com/nbd-wtf/nostr-tools/releases)
+  - Contains updates to NIP-44 encryption/decryption? (Check changelog)
+  - Contains updates to NIP-01 signatures?
+
+## Risk Assessment
+- **High Risk:** Changes to signing or encryption could break user logins or private messaging (NIP-04/NIP-44).
+- **Compliance:** Must ensure `nip04_44_compliance.test.mjs` passes.
+
+## Test Plan
+1. **Unit Tests:** Run `npm run test:unit`.
+2. **Compliance Tests:** Explicitly run `node scripts/run-targeted-tests.mjs tests/compliance/nip04_44_compliance.test.mjs`.
+3. **E2E Tests:** Verify login flow and DM flow.
+4. **Manual QA:**
+   - Log in with NIP-07 extension.
+   - Send/Receive DM.
+   - Publish video event.

 ## Action Items
- [ ] Review changelog for `nostr-tools` between 2.19.4 and 2.23.0.
- [ ] Verify no breaking changes in NIP implementations.
- [ ] Test cryptographic functions manually or via specific test suite.
- [ ] Apply upgrade manually.
+- [ ] Create branch `chore/upgrade-nostr-tools`
+- [ ] Bump version.
+- [ ] Run full test suite.
+- [ ] Review changelog for breaking changes in `SimplePool` or `finalizeEvent`.
+- [ ] Request maintainer review.