Type: Dynamic Security Bug
Priority: P0
Found by: #54 at main 6d3eb1e
Blocks: Gate C and release candidate
Writable: package.json, apps/web/package.json, pnpm-lock.yaml, pnpm-workspace.yaml, dependency audit tests/docs only
Observed failure
ASDF_NODEJS_VERSION=22.23.1 pnpm audit --prod --audit-level=moderate exits 1 with 6 production advisories: 2 moderate and 4 high. Affected installed packages are sharp 0.34.5, postcss 8.4.31, and nanoid 3.3.16. Patched floors reported by the audit are sharp 0.35.0, postcss 8.5.23, and nanoid 3.3.17.
Acceptance
- production audit at moderate threshold exits 0
- no critical, high, or moderate production advisory remains
- direct and transitive package resolution uses maintained compatible versions
- lockfile and sharp build allowlist are deterministic and exact
- no unrelated framework, product, evidence, Clear402, or Moss boundary change
- full pnpm check passes
- Clear402 false and true builds, integration suites, and browser E2E pass
- production start and public health/demo smoke pass after merge
Do not suppress, ignore, or reclassify an advisory to pass the gate. Keep the dependency diff minimal.
Type: Dynamic Security Bug
Priority: P0
Found by: #54 at main 6d3eb1e
Blocks: Gate C and release candidate
Writable: package.json, apps/web/package.json, pnpm-lock.yaml, pnpm-workspace.yaml, dependency audit tests/docs only
Observed failure
ASDF_NODEJS_VERSION=22.23.1 pnpm audit --prod --audit-level=moderate exits 1 with 6 production advisories: 2 moderate and 4 high. Affected installed packages are sharp 0.34.5, postcss 8.4.31, and nanoid 3.3.16. Patched floors reported by the audit are sharp 0.35.0, postcss 8.5.23, and nanoid 3.3.17.
Acceptance
Do not suppress, ignore, or reclassify an advisory to pass the gate. Keep the dependency diff minimal.