Merge pull request #2387 from PR0M3TH3AN/ai/audit-deps-2026-02-17-10555394609178643918

chore(audit): daily dependency scan and triage
2026-10-29 17:02:28 +00:00 · 2026-02-12 10:41:59 -05:00
commit ceed5652f0
@@ -1,20 +1,3 @@
-# Test Audit Context
-
-## Purpose
-This audit aims to verify the integrity and effectiveness of the bitvid test suite. The goal is to ensure tests actually test the behaviors they claim to, find fragile or missing tests, and propose small, high-confidence fixes to raise test quality and coverage.
-
-## Scope
-   **Focus Areas**: UX- and security-critical code paths including:
-    -   Login/Auth (`js/services/authService.js`)
-    -   Relay Management (`js/relayManager.js`)
-    -   Decryption (`js/nostr/dmDecryptWorker.js`)
-    -   Watch History (`js/nostr/watchHistory.js`)
-    -   Moderation (`js/userBlocks.js`)
-   **Exclusions**: Non-critical UI components, deprecated code.
-
-## Definition of Done
-   A daily audit report (`test-audit-report-YYYY-MM-DD.md`) is generated.
-   Failing and flaky tests are identified.
-   Coverage gaps for critical files are mapped.
-   At least one P0 test problem is fixed or tracked as an actionable issue.
-   All artifacts are committed.
+Node Version: v22.22.0
+NPM Version: 11.7.0
+Date: Thu Feb 12 14:32:45 UTC 2026
@@ -1 +1,25 @@
-# Decisions
+# Decisions Log
+
+## 2026-02-17: Dependency Audit & Upgrade
+
+### Context
+Ran a daily dependency audit. Found `esbuild` (0.27.2 -> 0.27.3) as a safe candidate and `nostr-tools` (2.19.4 -> 2.23.0) as a risky candidate.
+
+### Decision: Revert `esbuild` Upgrade
+- **Proposal:** Upgrade `esbuild` to 0.27.3.
+- **Outcome:** FAILED (Reverted).
+- **Reason:** While `npm run build` and `npm run test:unit` passed, `npm run test:e2e` failed immediately with "Executable doesn't exist" (missing Playwright browsers).
+- **Rationale:** Strict adherence to "If tests fail, do not open the PR".
+- **Action:** Reverted changes to `package.json` / `package-lock.json`. Created `issues/upgrade-esbuild.md` to document the environment blocker.
+
+### Decision: Do Not Auto-Upgrade `nostr-tools`
+- **Proposal:** Upgrade `nostr-tools`.
+- **Outcome:** BLOCKED (By Policy).
+- **Reason:** `AGENTS.md` explicitly forbids auto-upgrading protocol/crypto libraries.
+- **Action:** Created `issues/upgrade-nostr-tools.md` with a test plan for manual review.
+
+### Decision: Do Not Auto-Upgrade `tailwindcss` (v4)
+- **Proposal:** Upgrade `tailwindcss`.
+- **Outcome:** BLOCKED (Major Version).
+- **Reason:** Major version bump (v3 -> v4) carries significant risk of breaking changes.
+- **Action:** Existing issue `issues/upgrade-tailwindcss.md` is sufficient.
@@ -1 +1,11 @@
-# To Do
+# TODO: Dependency Management
+
+## Priority: High (Blockers)
+- [ ] Fix E2E test environment: `npx playwright install` must be run in the CI/Agent environment before running `npm run test:e2e` for upgrades. This blocked the `esbuild` upgrade.
+
+## Priority: Medium (Security/Compliance)
+- [ ] Review `nostr-tools` upgrade (v2.19.4 -> v2.23.0). See `issues/upgrade-nostr-tools.md`.
+- [ ] Review `tailwindcss` (v4). See `issues/upgrade-tailwindcss.md`.
+
+## Priority: Low (Maintenance)
+- [ ] Batch upgrade dev dependencies (`stylelint`, `postcss-import`).
@@ -1,17 +1,23 @@
-# Upgrade esbuild
+# Upgrade Attempt: esbuild (v0.27.2 -> v0.27.3)

-## Status
- **Current:** `0.27.2`
- **Latest:** `0.27.3`
+**Status:** FAILED (Reverted)
+**Date:** 2026-02-17

 ## Details
-`esbuild` 0.x versions may have breaking changes between minor versions, but this is a patch.
-Used for build scripts (`scripts/build-dist.mjs`, `scripts/build-beacon.mjs`).
+Attempted to upgrade `esbuild` from `0.27.2` to `0.27.3`.

-## Plan
-1. Update `esbuild`.
-2. Run build scripts: `npm run build`, `npm run build:beacon`.
-3. Verify output bundles work correctly.
+## Test Results
+- `npm run build`: **PASSED**
+- `npm run test:unit`: **PASSED**
+- `npm run test:dm:integration`: **PASSED**
+- `npm run test:e2e`: **FAILED** (Environment Issue)

-## Guardrails
- Build tool upgrade.
+## Failure Analysis
+The E2E tests failed because the Playwright browser binaries were not found in the CI environment:
+```
+Error: browserType.launch: Executable doesn't exist at /home/jules/.cache/ms-playwright/chromium_headless_shell-1208/chrome-headless-shell-linux64/chrome-headless-shell
+```
+
+## Next Steps
+- Ensure the CI/Agent environment has `npx playwright install` run before attempting upgrades that require E2E verification.
+- Once browsers are available, retry the upgrade.
@@ -1,15 +1,34 @@
-# Upgrade nostr-tools
+# Upgrade Proposal: `nostr-tools` (v2.19.4 -> v2.23.0)

-**Package:** `nostr-tools`
-**Current Version:** `2.19.4`
-**Wanted Version:** `2.23.0`
-**Latest Version:** `2.23.0`
+**Status:** `REVIEW-REQUIRED` (Protocol Library)
+**Priority:** High (Security/Protocol Compliance)

-## Details
-This package was identified as a critical dependency (cryptographic/protocol library). Automatic upgrade was skipped.
+## Context
+`nostr-tools` is the core protocol library for bitvid. `AGENTS.md` explicitly forbids automatic upgrades for crypto/protocol libraries.
+
+## Version Changes
+- **Current:** `2.19.4`
+- **Target:** `2.23.0`
+- **Changelog:** [Link to nostr-tools releases](https://github.com/nbd-wtf/nostr-tools/releases)
+  - Contains updates to NIP-44 encryption/decryption? (Check changelog)
+  - Contains updates to NIP-01 signatures?
+
+## Risk Assessment
+- **High Risk:** Changes to signing or encryption could break user logins or private messaging (NIP-04/NIP-44).
+- **Compliance:** Must ensure `nip04_44_compliance.test.mjs` passes.
+
+## Test Plan
+1. **Unit Tests:** Run `npm run test:unit`.
+2. **Compliance Tests:** Explicitly run `node scripts/run-targeted-tests.mjs tests/compliance/nip04_44_compliance.test.mjs`.
+3. **E2E Tests:** Verify login flow and DM flow.
+4. **Manual QA:**
+   - Log in with NIP-07 extension.
+   - Send/Receive DM.
+   - Publish video event.

 ## Action Items
- [ ] Review changelog for `nostr-tools` between 2.19.4 and 2.23.0.
- [ ] Verify no breaking changes in NIP implementations.
- [ ] Test cryptographic functions manually or via specific test suite.
- [ ] Apply upgrade manually.
+- [ ] Create branch `chore/upgrade-nostr-tools`
+- [ ] Bump version.
+- [ ] Run full test suite.
+- [ ] Review changelog for breaking changes in `SimplePool` or `finalizeEvent`.
+- [ ] Request maintainer review.