scripte/nexarch
1
0 Fork 0
Code Issues 1 Pull Requests 21 Actions 71 Packages Projects Releases Wiki Activity

fix(web): npm audit — vitest/vite/esbuild + canvas/tar/jsdom RCE-Ketten schließen #131

Closed
patrick wants to merge 0 commits from fix/npm-audit-vitest-vite-esbuild-devserver into integration/gesamtprojekt
pull from: fix/npm-audit-vitest-vite-esbuild-devserver
merge into: scripte:integration/gesamtprojekt
Conversation 0 Commits - Files Changed -
patrick commented 2026-09-22 20:20:28 +02:00
Owner
Copy link
Copy source

Schließt den seit PR #117 (OPS-11) offen dokumentierten Punkt: vorbestehende kritische npm audit-Funde in 6 Web-Apps (dms-browser, dms-upload, kennzahlen-dashboard, mail-search, retention-admin, pdf-viewer) durch die vitest/vite/esbuild-Entwicklungsserver-RCE-Kette, bei pdf-viewer zusätzlich canvas/tar über eine alte jsdom-Version. shl (CI-Matrix) zusätzlich mitgefixt, hatte dieselbe Kette.

Prüfungen (alle Apps, Details in docs/NPM-AUDIT-FIX-PRUEFPROTOKOLL.md):

  • npm audit: 4–10 Funde je App vorher, 0 nachher (alle 7 Pakete)
  • vitest run: keine Testregression, Zahlen unverändert oder höher
  • tsc --noEmit: sauber
  • next build: sauber (außer shl, reine Bibliothek ohne Build)

Nur Entwicklungsabhängigkeiten betroffen, kein Produktions- oder Build-Risiko.

Kein Merge, keine Freigabe zum Zusammenführen.

🤖 Generated with Claude Code

Schließt den seit PR #117 (OPS-11) offen dokumentierten Punkt: vorbestehende kritische `npm audit`-Funde in 6 Web-Apps (`dms-browser`, `dms-upload`, `kennzahlen-dashboard`, `mail-search`, `retention-admin`, `pdf-viewer`) durch die vitest/vite/esbuild-Entwicklungsserver-RCE-Kette, bei `pdf-viewer` zusätzlich `canvas`/`tar` über eine alte `jsdom`-Version. `shl` (CI-Matrix) zusätzlich mitgefixt, hatte dieselbe Kette. **Prüfungen (alle Apps, Details in `docs/NPM-AUDIT-FIX-PRUEFPROTOKOLL.md`):** - `npm audit`: 4–10 Funde je App vorher, 0 nachher (alle 7 Pakete) - `vitest run`: keine Testregression, Zahlen unverändert oder höher - `tsc --noEmit`: sauber - `next build`: sauber (außer `shl`, reine Bibliothek ohne Build) Nur Entwicklungsabhängigkeiten betroffen, kein Produktions- oder Build-Risiko. Kein Merge, keine Freigabe zum Zusammenführen. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
patrick added 2 commits 2026-09-22 20:20:28 +02:00
fix(web): npm audit — vitest/vite/esbuild + canvas/tar/jsdom RCE-Ketten schließen c043f340d1 
vitest 2.0.5 -> 5.0.1 in allen betroffenen Apps (dms-browser, dms-upload,
kennzahlen-dashboard, mail-search, retention-admin, pdf-viewer) sowie shl
(CI-Matrix). pdf-viewer zusaetzlich jsdom 24 -> 29 (entfernt canvas/tar-Kette).
@types/node auf 22 gehoben (vitest-5-Peer-Dependency), @testing-library/jest-dom
auf 7.0.1 (vitest-5-Typaugmentierung), esbuild.jsx-Workaround in vitest.config.ts
entfernt (von Vite/esbuild-Option-Konflikt, ueberfluessig seit tsconfig jsx
bereits react-jsx setzt). Neue vitest.d.ts in dms-browser/pdf-viewer fuer
jest-axe-Matcher-Typisierung (@types/jest-axe augmentiert Jest-Namespace,
nicht Vitest 5s Assertion-Interface).

0 verbleibende npm-audit-Funde in allen 7 Paketen (vorher 4-10 je App).
Nur Entwicklungsabhaengigkeiten betroffen, kein Produktionsrisiko.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
docs: Prüfprotokoll npm-audit-Fix (vitest/vite/esbuild, canvas/tar/jsdom)
CI / Web-Barrierefreiheitspruefung (axe, Tastatur, Reflow, Textabstaende) (push) Canceled after 0s
Details
CI / Web-Barrierefreiheitspruefung (axe, Tastatur, Reflow, Textabstaende) (pull_request) Canceled after 0s
Details
CI / Core-Modul (Build/Vet/Test) (push) Canceled after 0s
Details
CI / DMS Security-Test-Gate (AC5, Merge-Gate) (push) Canceled after 0s
Details
CI / DMS-Modul Supply-Chain-Scan (govulncheck) (push) Canceled after 0s
Details
CI / Web (dms-browser) (push) Canceled after 0s
Details
CI / Web (pdf-viewer) (push) Canceled after 0s
Details
CI / Web (shl) (push) Canceled after 0s
Details
CI / Core-Modul (Build/Vet/Test) (pull_request) Canceled after 0s
Details
CI / DMS Security-Test-Gate (AC5, Merge-Gate) (pull_request) Canceled after 0s
Details
Supply-Chain-Scan (Go) / govulncheck (pull_request) Canceled after 0s
Details
CI / DMS-Modul Supply-Chain-Scan (govulncheck) (pull_request) Canceled after 0s
Details
CI / Web (dms-browser) (pull_request) Canceled after 0s
Details
CI / Web (pdf-viewer) (pull_request) Canceled after 0s
Details
CI / Web (shl) (pull_request) Canceled after 0s
Details
Core-Schnittstellen-Vertragstests / contract-tests (pull_request) Canceled after 0s
Details
Supply-Chain-Scan (npm) / npm-audit (pull_request) Canceled after 0s
Details
Core-Pflichttest-Gate / pflichttest-gate (pull_request) Canceled after 0s
Details
RBAC-Rollenhierarchie-Pflichtgate / rbac-policy-invariant (pull_request) Canceled after 0s
Details
CI / DMS-Modul (Lint/Build/Test/Coverage/Artefakt) (push) Canceled after 0s
Details
CI / DMS-Modul (Lint/Build/Test/Coverage/Artefakt) (pull_request) Canceled after 0s
Details
10ad87dec6 
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
patrick closed this pull request 2026-09-25 23:30:28 +02:00

Pull request closed

This pull request cannot be reopened because the branch was deleted.
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
patrick
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: scripte/nexarch#131