mirror of
https://github.com/PR0M3TH3AN/bitvid.git
synced 2026-11-02 10:52:27 +00:00
67 lines
2.1 KiB
Markdown
67 lines
2.1 KiB
Markdown
# Dependency Security Daily Report
|
|
|
|
_Date:_ 2026-02-13
|
|
_Agent:_ `deps-security-agent`
|
|
|
|
## Environment
|
|
|
|
- Package manager selected: **npm** (`package-lock.json` present)
|
|
- Node: `v20.19.6`
|
|
- npm: `11.4.2`
|
|
- Constraint: project engine requires Node `>=22`, so clean install and upgrade validation were blocked in this environment.
|
|
|
|
## Security Audit Summary (`artifacts/npm-audit.json`)
|
|
|
|
- Total vulnerabilities: **0**
|
|
- Critical: **0**
|
|
- High: **0**
|
|
- Moderate: **0**
|
|
- Low: **0**
|
|
|
|
### Immediate P0 Security Items
|
|
|
|
- **None identified** in this run.
|
|
|
|
## Outdated Dependencies (`artifacts/npm-outdated.json`)
|
|
|
|
Detected 12 outdated packages.
|
|
|
|
### Patch candidates (low risk, pending Node 22 runtime)
|
|
|
|
- `@playwright/test` `1.58.0 -> 1.58.2`
|
|
- `playwright` `1.58.0 -> 1.58.2`
|
|
- `autoprefixer` `10.4.23 -> 10.4.24`
|
|
|
|
### Minor candidates (review required)
|
|
|
|
- `esbuild` `0.25.12 -> 0.27.3`
|
|
- `nostr-tools` `2.20.0 -> 2.23.1` (**security-sensitive/protocol library — do not auto-upgrade**)
|
|
|
|
### Major candidates (issue-first path)
|
|
|
|
- `cross-env` `7.0.3 -> 10.1.0`
|
|
- `jsdom` `27.4.0 -> 28.0.0`
|
|
|
|
### Additional latest-only drift (outside wanted range)
|
|
|
|
- `pixelmatch` latest `7.1.0` (current/wanted `5.3.0`)
|
|
- `postcss-import` latest `16.1.1` (current/wanted `15.1.0`)
|
|
- `prettier-plugin-tailwindcss` latest `0.7.2` (current/wanted `0.6.14`)
|
|
- `stylelint` latest `17.2.0` (current/wanted `16.26.1`)
|
|
- `tailwindcss` latest `4.1.18` (current/wanted `3.4.19`)
|
|
|
|
## Triage Decisions
|
|
|
|
1. No vulnerability escalation needed (no CRITICAL/HIGH findings).
|
|
2. No auto-upgrade PRs attempted due to Node engine mismatch in runtime environment.
|
|
3. Next execution should run under Node 22+ and then:
|
|
- Apply patch bumps first (`playwright`, `@playwright/test`, `autoprefixer`).
|
|
- Re-run full validation matrix before any PR.
|
|
- Track `nostr-tools` as human-reviewed only.
|
|
|
|
## Recommended Follow-ups
|
|
|
|
- Re-run this agent in a Node 22 environment to enable `npm ci` and upgrade testing.
|
|
- If Node 22 runtime is available, create small PR(s) for the three patch updates listed above.
|
|
- Open issue(s) for major upgrades (`cross-env`, `jsdom`) with staged migration plans.
|