fix(security): patch runtime dependency advisories

2026-09-09 21:24:32 +00:00
parent 06cc3562f0
commit 693d841bec
5 changed files with 21 additions and 98 deletions
@@ -1,81 +0,0 @@
-name: F6.1 fix runtime dependencies
-
-on:
-  push:
-    branches:
-      - 'release/f6-1-presentation-ready'
-    paths:
-      - '.github/workflows/f6-1-fix-runtime-deps.yml'
-
-permissions:
-  contents: write
-
-jobs:
-  fix:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          ref: release/f6-1-presentation-ready
-          fetch-depth: 0
-
-      - uses: actions/setup-node@v4
-        with:
-          node-version: '24'
-
-      - name: Pin patched runtime dependency resolutions
-        run: |
-          set -Eeuo pipefail
-
-          cd api-v3
-          npm pkg set overrides.multer=2.3.0 overrides.qs=6.16.0
-          npm install --package-lock-only --ignore-scripts
-          npm audit --omit=dev --audit-level=high
-          cd ..
-
-          cd web-v2
-          npm pkg set dependencies.maplibre-gl=6.4.1
-          npm install --package-lock-only --ignore-scripts
-          npm audit --omit=dev --audit-level=high
-          cd ..
-
-      - name: Verify resolved patched versions
-        run: |
-          set -Eeuo pipefail
-          node <<'NODE'
-          const api = require('./api-v3/package-lock.json');
-          const web = require('./web-v2/package-lock.json');
-          const apiPackages = api.packages ?? {};
-          const webPackages = web.packages ?? {};
-
-          const versions = (packages, dependency) => Object.entries(packages)
-            .filter(([path]) => path.endsWith(`node_modules/${dependency}`))
-            .map(([, metadata]) => metadata.version);
-
-          const assertOnly = (dependency, actual, expected) => {
-            if (actual.length === 0 || actual.some((version) => version !== expected)) {
-              throw new Error(`${dependency}: expected only ${expected}, got ${JSON.stringify(actual)}`);
-            }
-            console.log(`${dependency}: ${actual.join(', ')}`);
-          };
-
-          assertOnly('multer', versions(apiPackages, 'multer'), '2.3.0');
-          assertOnly('qs', versions(apiPackages, 'qs'), '6.16.0');
-          assertOnly('maplibre-gl', versions(webPackages, 'maplibre-gl'), '6.4.1');
-
-          const webManifest = require('./web-v2/package.json');
-          if (webManifest.dependencies?.['maplibre-gl'] !== '6.4.1') {
-            throw new Error(`maplibre-gl manifest is ${webManifest.dependencies?.['maplibre-gl']}`);
-          }
-          NODE
-
-      - name: Commit patched dependency locks
-        run: |
-          set -Eeuo pipefail
-          rm .github/workflows/f6-1-fix-runtime-deps.yml
-          git config user.name 'github-actions[bot]'
-          git config user.email '41898282+github-actions[bot]@users.noreply.github.com'
-          git add api-v3/package.json api-v3/package-lock.json web-v2/package.json web-v2/package-lock.json .github/workflows/f6-1-fix-runtime-deps.yml
-          git diff --cached --check
-          git commit -m 'fix(security): patch runtime dependency advisories'
-          git push origin HEAD:release/f6-1-presentation-ready