chore(agents): run deps-security-agent daily task — baseline audit triage

2026-10-27 07:52:24 +00:00 · 2026-02-12 21:54:17 -05:00
1 parent 6395aaaa1a
commit c538517fec
@@ -1,34 +1,66 @@
-# Dependency Audit Report
+# Dependency Security Daily Report

-## 1. Vulnerability Summary
- Total Vulnerabilities: 0
- Critical: 0
- High: 0
- Moderate: 0
- Low: 0
+_Date:_ 2026-02-13  
+_Agent:_ `deps-security-agent`

-No vulnerabilities found.
+## Environment

-## 2. Outdated Packages
-### Safe Upgrades (Patch/Minor)
- **esbuild** (dependencies): 0.27.2 -> 0.27.3 (Latest: 0.27.3)
- **stylelint** (dependencies): 16.12.0 -> 16.26.1 (Latest: 17.2.0)
+- Package manager selected: **npm** (`package-lock.json` present)
+- Node: `v20.19.6`
+- npm: `11.4.2`
+- Constraint: project engine requires Node `>=22`, so clean install and upgrade validation were blocked in this environment.

-### Major Upgrades (Risky)
- **pixelmatch** (dependencies): 5.3.0 -> 7.1.0
- **postcss-import** (dependencies): 15.1.0 -> 16.1.1
- **prettier-plugin-tailwindcss** (dependencies): 0.6.14 -> 0.7.2
- **stylelint-config-standard** (dependencies): 36.0.1 -> 40.0.0
- **tailwindcss** (dependencies): 3.4.19 -> 4.1.18
+## Security Audit Summary (`artifacts/npm-audit.json`)

-### Security/Protocol Libraries (Manual Review Required)
- **nostr-tools** (dependencies): 2.19.4 -> 2.23.0 (Latest: 2.23.0)
+- Total vulnerabilities: **0**
+- Critical: **0**
+- High: **0**
+- Moderate: **0**
+- Low: **0**

-## 3. Recommendations
- **Action Item**: Attempt safe upgrade of `esbuild` from `0.27.2` to `0.27.3`.
+### Immediate P0 Security Items

-## 4. Remediation Actions Taken
- **Success**: Upgraded `esbuild` to `0.27.3`.
-  - Branch: `ai/deps-esbuild-v0.27.3`
-  - Verification: `npm run build` (Pass), `npm run lint` (Pass), `npm run test:unit` (Pass).
-  - Ready for PR.
+- **None identified** in this run.
+
+## Outdated Dependencies (`artifacts/npm-outdated.json`)
+
+Detected 12 outdated packages.
+
+### Patch candidates (low risk, pending Node 22 runtime)
+
+- `@playwright/test` `1.58.0 -> 1.58.2`
+- `playwright` `1.58.0 -> 1.58.2`
+- `autoprefixer` `10.4.23 -> 10.4.24`
+
+### Minor candidates (review required)
+
+- `esbuild` `0.25.12 -> 0.27.3`
+- `nostr-tools` `2.20.0 -> 2.23.1` (**security-sensitive/protocol library — do not auto-upgrade**)
+
+### Major candidates (issue-first path)
+
+- `cross-env` `7.0.3 -> 10.1.0`
+- `jsdom` `27.4.0 -> 28.0.0`
+
+### Additional latest-only drift (outside wanted range)
+
+- `pixelmatch` latest `7.1.0` (current/wanted `5.3.0`)
+- `postcss-import` latest `16.1.1` (current/wanted `15.1.0`)
+- `prettier-plugin-tailwindcss` latest `0.7.2` (current/wanted `0.6.14`)
+- `stylelint` latest `17.2.0` (current/wanted `16.26.1`)
+- `tailwindcss` latest `4.1.18` (current/wanted `3.4.19`)
+
+## Triage Decisions
+
+1. No vulnerability escalation needed (no CRITICAL/HIGH findings).
+2. No auto-upgrade PRs attempted due to Node engine mismatch in runtime environment.
+3. Next execution should run under Node 22+ and then:
+   - Apply patch bumps first (`playwright`, `@playwright/test`, `autoprefixer`).
+   - Re-run full validation matrix before any PR.
+   - Track `nostr-tools` as human-reviewed only.
+
+## Recommended Follow-ups
+
+- Re-run this agent in a Node 22 environment to enable `npm ci` and upgrade testing.
+- If Node 22 runtime is available, create small PR(s) for the three patch updates listed above.
+- Open issue(s) for major upgrades (`cross-env`, `jsdom`) with staged migration plans.
@@ -1,58 +1,86 @@
 {
+  "@playwright/test": {
+    "current": "1.58.0",
+    "wanted": "1.58.2",
+    "latest": "1.58.2",
+    "dependent": "bitvid",
+    "location": "/workspace/bitvid/node_modules/@playwright/test"
+  },
+  "autoprefixer": {
+    "current": "10.4.23",
+    "wanted": "10.4.24",
+    "latest": "10.4.24",
+    "dependent": "bitvid",
+    "location": "/workspace/bitvid/node_modules/autoprefixer"
+  },
+  "cross-env": {
+    "current": "7.0.3",
+    "wanted": "10.1.0",
+    "latest": "10.1.0",
+    "dependent": "bitvid",
+    "location": "/workspace/bitvid/node_modules/cross-env"
+  },
  "esbuild": {
-    "current": "0.27.2",
+    "current": "0.25.12",
    "wanted": "0.27.3",
    "latest": "0.27.3",
-    "dependent": "app",
-    "location": "/app/node_modules/esbuild"
+    "dependent": "bitvid",
+    "location": "/workspace/bitvid/node_modules/esbuild"
+  },
+  "jsdom": {
+    "current": "27.4.0",
+    "wanted": "28.0.0",
+    "latest": "28.0.0",
+    "dependent": "bitvid",
+    "location": "/workspace/bitvid/node_modules/jsdom"
  },
  "nostr-tools": {
-    "current": "2.19.4",
-    "wanted": "2.23.0",
-    "latest": "2.23.0",
-    "dependent": "app",
-    "location": "/app/node_modules/nostr-tools"
+    "current": "2.20.0",
+    "wanted": "2.23.1",
+    "latest": "2.23.1",
+    "dependent": "bitvid",
+    "location": "/workspace/bitvid/node_modules/nostr-tools"
  },
  "pixelmatch": {
    "current": "5.3.0",
    "wanted": "5.3.0",
    "latest": "7.1.0",
-    "dependent": "app",
-    "location": "/app/node_modules/pixelmatch"
+    "dependent": "bitvid",
+    "location": "/workspace/bitvid/node_modules/pixelmatch"
+  },
+  "playwright": {
+    "current": "1.58.0",
+    "wanted": "1.58.2",
+    "latest": "1.58.2",
+    "dependent": "bitvid",
+    "location": "/workspace/bitvid/node_modules/playwright"
  },
  "postcss-import": {
    "current": "15.1.0",
    "wanted": "15.1.0",
    "latest": "16.1.1",
-    "dependent": "app",
-    "location": "/app/node_modules/postcss-import"
+    "dependent": "bitvid",
+    "location": "/workspace/bitvid/node_modules/postcss-import"
  },
  "prettier-plugin-tailwindcss": {
    "current": "0.6.14",
    "wanted": "0.6.14",
    "latest": "0.7.2",
-    "dependent": "app",
-    "location": "/app/node_modules/prettier-plugin-tailwindcss"
+    "dependent": "bitvid",
+    "location": "/workspace/bitvid/node_modules/prettier-plugin-tailwindcss"
  },
  "stylelint": {
-    "current": "16.12.0",
+    "current": "16.26.1",
    "wanted": "16.26.1",
    "latest": "17.2.0",
-    "dependent": "app",
-    "location": "/app/node_modules/stylelint"
-  },
-  "stylelint-config-standard": {
-    "current": "36.0.1",
-    "wanted": "36.0.1",
-    "latest": "40.0.0",
-    "dependent": "app",
-    "location": "/app/node_modules/stylelint-config-standard"
+    "dependent": "bitvid",
+    "location": "/workspace/bitvid/node_modules/stylelint"
  },
  "tailwindcss": {
    "current": "3.4.19",
    "wanted": "3.4.19",
    "latest": "4.1.18",
-    "dependent": "app",
-    "location": "/app/node_modules/tailwindcss"
+    "dependent": "bitvid",
+    "location": "/workspace/bitvid/node_modules/tailwindcss"
  }
 }