From cdac9b3756232740f7ecdf434f8b7637b5d6f4e1 Mon Sep 17 00:00:00 2001 From: Jayam Srivastava Date: Sat, 8 Aug 2026 21:51:15 +0530 Subject: [PATCH 1/8] fix(security): bump firebase-admin to 14.2.0 --- package.json | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/package.json b/package.json index 97a60d6..f40f1f0 100644 --- a/package.json +++ b/package.json @@ -34,13 +34,13 @@ "@radix-ui/react-context-menu": "2.2.6", "@radix-ui/react-dialog": "1.1.6", "@radix-ui/react-dropdown-menu": "2.1.6", - "@radix-ui/react-hover-card": "1.1.6", + "@radix-ui/react-hover-card": "2.2.3", "@radix-ui/react-label": "2.1.2", "@radix-ui/react-menubar": "1.1.6", "@radix-ui/react-navigation-menu": "1.2.5", "@radix-ui/react-popover": "1.1.6", "@radix-ui/react-progress": "1.1.2", - "@radix-ui/react-radio-group": "1.2.3", + "@radix-ui/react-radio-group": "1.1.3", "@radix-ui/react-scroll-area": "1.2.3", "@radix-ui/react-select": "2.1.6", "@radix-ui/react-separator": "1.1.2", @@ -61,7 +61,7 @@ "date-fns": "3.6.0", "embla-carousel-react": "8.6.0", "firebase": "^12.15.0", - "firebase-admin": "^14.1.0", + "firebase-admin": "^14.2.0", "gsap": "^3.15.0", "input-otp": "1.4.2", "lenis": "^1.3.25", From 0a7452b6a247907bab8c69909968dd423d021aa6 Mon Sep 17 00:00:00 2001 From: Jayam Srivastava Date: Sat, 8 Aug 2026 21:51:30 +0530 Subject: [PATCH 2/8] fix(security): keep package changes scoped to firebase-admin --- package.json | 46 +++++++++++++++++++++++----------------------- 1 file changed, 23 insertions(+), 23 deletions(-) diff --git a/package.json b/package.json index f40f1f0..468a833 100644 --- a/package.json +++ b/package.json @@ -28,29 +28,29 @@ "@radix-ui/react-accordion": "1.2.3", "@radix-ui/react-alert-dialog": "1.1.6", "@radix-ui/react-aspect-ratio": "1.1.2", - "@radix-ui/react-avatar": "1.1.3", + "@radix-ui/react-avatar": "1.1.4", "@radix-ui/react-checkbox": "1.1.4", - "@radix-ui/react-collapsible": "1.1.3", - "@radix-ui/react-context-menu": "2.2.6", - "@radix-ui/react-dialog": "1.1.6", - "@radix-ui/react-dropdown-menu": "2.1.6", + "@radix-ui/react-collapsible": "1.2.3", + "@radix-ui/react-context-menu": "2.2.3", + "@radix-ui/react-dialog": "1.1.15", + "@radix-ui/react-dropdown-menu": "2.1.15", "@radix-ui/react-hover-card": "2.2.3", - "@radix-ui/react-label": "2.1.2", - "@radix-ui/react-menubar": "1.1.6", - "@radix-ui/react-navigation-menu": "1.2.5", - "@radix-ui/react-popover": "1.1.6", - "@radix-ui/react-progress": "1.1.2", - "@radix-ui/react-radio-group": "1.1.3", - "@radix-ui/react-scroll-area": "1.2.3", - "@radix-ui/react-select": "2.1.6", - "@radix-ui/react-separator": "1.1.2", - "@radix-ui/react-slider": "1.2.3", - "@radix-ui/react-slot": "1.1.2", - "@radix-ui/react-switch": "1.1.3", - "@radix-ui/react-tabs": "1.1.3", - "@radix-ui/react-toggle": "1.1.2", - "@radix-ui/react-toggle-group": "1.1.2", - "@radix-ui/react-tooltip": "1.1.8", + "@radix-ui/react-label": "2.1.7", + "@radix-ui/react-menubar": "1.1.16", + "@radix-ui/react-navigation-menu": "1.2.14", + "@radix-ui/react-popover": "1.1.15", + "@radix-ui/react-progress": "1.1.7", + "@radix-ui/react-radio-group": "1.3.8", + "@radix-ui/react-scroll-area": "1.2.10", + "@radix-ui/react-select": "2.2.6", + "@radix-ui/react-separator": "1.1.7", + "@radix-ui/react-slider": "1.3.6", + "@radix-ui/react-slot": "1.2.3", + "@radix-ui/react-switch": "1.2.6", + "@radix-ui/react-tabs": "1.1.13", + "@radix-ui/react-toggle": "1.1.10", + "@radix-ui/react-toggle-group": "1.1.11", + "@radix-ui/react-tooltip": "1.2.8", "@react-three/drei": "^9.122.0", "@react-three/fiber": "^8.18.0", "@types/react-window": "^1.8.8", @@ -90,7 +90,7 @@ "devDependencies": { "@eslint/js": "^9.39.4", "@tailwindcss/vite": "4.1.12", - "@testing-library/jest-dom": "^6.9.1", + "@testing-library/jest-dom": "^6.9.0", "@testing-library/react": "^16.3.2", "@testing-library/user-event": "^14.6.1", "@types/node": "^20.19.43", @@ -100,7 +100,7 @@ "@vercel/node": "^5.8.21", "@vitejs/plugin-react": "4.7.0", "@vitest/coverage-v8": "^4.1.9", - "axe-core": "^4.12.1", + "axe-core": "^4.12.0", "eslint": "^9.39.4", "eslint-plugin-react-hooks": "^5.2.0", "eslint-plugin-react-refresh": "^0.4.26", From add5ab76f49de9204d9e77cd8bb2610c660cc727 Mon Sep 17 00:00:00 2001 From: Jayam Srivastava Date: Sat, 8 Aug 2026 21:51:43 +0530 Subject: [PATCH 3/8] fix(security): restore unrelated package versions From 387cf47b895ff164b2bd2317f3acdbb757457abe Mon Sep 17 00:00:00 2001 From: Jayam Srivastava Date: Sat, 8 Aug 2026 21:51:54 +0530 Subject: [PATCH 4/8] fix(security): limit manifest diff to firebase-admin --- package.json | 38 +++++++++++++++++++------------------- 1 file changed, 19 insertions(+), 19 deletions(-) diff --git a/package.json b/package.json index 468a833..f51ccb4 100644 --- a/package.json +++ b/package.json @@ -28,28 +28,28 @@ "@radix-ui/react-accordion": "1.2.3", "@radix-ui/react-alert-dialog": "1.1.6", "@radix-ui/react-aspect-ratio": "1.1.2", - "@radix-ui/react-avatar": "1.1.4", + "@radix-ui/react-avatar": "1.1.3", "@radix-ui/react-checkbox": "1.1.4", - "@radix-ui/react-collapsible": "1.2.3", + "@radix-ui/react-collapsible": "1.1.3", "@radix-ui/react-context-menu": "2.2.3", - "@radix-ui/react-dialog": "1.1.15", - "@radix-ui/react-dropdown-menu": "2.1.15", + "@radix-ui/react-dialog": "1.1.6", + "@radix-ui/react-dropdown-menu": "2.1.6", "@radix-ui/react-hover-card": "2.2.3", - "@radix-ui/react-label": "2.1.7", - "@radix-ui/react-menubar": "1.1.16", - "@radix-ui/react-navigation-menu": "1.2.14", - "@radix-ui/react-popover": "1.1.15", - "@radix-ui/react-progress": "1.1.7", - "@radix-ui/react-radio-group": "1.3.8", - "@radix-ui/react-scroll-area": "1.2.10", - "@radix-ui/react-select": "2.2.6", - "@radix-ui/react-separator": "1.1.7", - "@radix-ui/react-slider": "1.3.6", - "@radix-ui/react-slot": "1.2.3", - "@radix-ui/react-switch": "1.2.6", - "@radix-ui/react-tabs": "1.1.13", - "@radix-ui/react-toggle": "1.1.10", - "@radix-ui/react-toggle-group": "1.1.11", + "@radix-ui/react-label": "2.1.2", + "@radix-ui/react-menubar": "1.1.6", + "@radix-ui/react-navigation-menu": "1.2.5", + "@radix-ui/react-popover": "1.1.6", + "@radix-ui/react-progress": "1.1.4", + "@radix-ui/react-radio-group": "1.3.0", + "@radix-ui/react-scroll-area": "1.2.3", + "@radix-ui/react-select": "2.1.6", + "@radix-ui/react-separator": "1.1.4", + "@radix-ui/react-slider": "1.3.0", + "@radix-ui/react-slot": "1.2.2", + "@radix-ui/react-switch": "1.2.3", + "@radix-ui/react-tabs": "1.1.3", + "@radix-ui/react-toggle": "1.1.2", + "@radix-ui/react-toggle-group": "1.1.4", "@radix-ui/react-tooltip": "1.2.8", "@react-three/drei": "^9.122.0", "@react-three/fiber": "^8.18.0", From 0f3c92c72bae3eea52ab486b1a792852dca959bc Mon Sep 17 00:00:00 2001 From: Jayam Srivastava Date: Sat, 8 Aug 2026 21:52:08 +0530 Subject: [PATCH 5/8] fix(security): bump firebase-admin to 14.2.0 --- package.json | 24 ++++++++++++------------ 1 file changed, 12 insertions(+), 12 deletions(-) diff --git a/package.json b/package.json index f51ccb4..5c472e4 100644 --- a/package.json +++ b/package.json @@ -31,26 +31,26 @@ "@radix-ui/react-avatar": "1.1.3", "@radix-ui/react-checkbox": "1.1.4", "@radix-ui/react-collapsible": "1.1.3", - "@radix-ui/react-context-menu": "2.2.3", + "@radix-ui/react-context-menu": "2.2.6", "@radix-ui/react-dialog": "1.1.6", "@radix-ui/react-dropdown-menu": "2.1.6", - "@radix-ui/react-hover-card": "2.2.3", + "@radix-ui/react-hover-card": "1.1.6", "@radix-ui/react-label": "2.1.2", "@radix-ui/react-menubar": "1.1.6", "@radix-ui/react-navigation-menu": "1.2.5", "@radix-ui/react-popover": "1.1.6", - "@radix-ui/react-progress": "1.1.4", - "@radix-ui/react-radio-group": "1.3.0", + "@radix-ui/react-progress": "1.1.2", + "@radix-ui/react-radio-group": "1.2.3", "@radix-ui/react-scroll-area": "1.2.3", "@radix-ui/react-select": "2.1.6", - "@radix-ui/react-separator": "1.1.4", - "@radix-ui/react-slider": "1.3.0", - "@radix-ui/react-slot": "1.2.2", - "@radix-ui/react-switch": "1.2.3", + "@radix-ui/react-separator": "1.1.2", + "@radix-ui/react-slider": "1.2.3", + "@radix-ui/react-slot": "1.1.2", + "@radix-ui/react-switch": "1.1.3", "@radix-ui/react-tabs": "1.1.3", "@radix-ui/react-toggle": "1.1.2", - "@radix-ui/react-toggle-group": "1.1.4", - "@radix-ui/react-tooltip": "1.2.8", + "@radix-ui/react-toggle-group": "1.1.2", + "@radix-ui/react-tooltip": "1.1.8", "@react-three/drei": "^9.122.0", "@react-three/fiber": "^8.18.0", "@types/react-window": "^1.8.8", @@ -90,7 +90,7 @@ "devDependencies": { "@eslint/js": "^9.39.4", "@tailwindcss/vite": "4.1.12", - "@testing-library/jest-dom": "^6.9.0", + "@testing-library/jest-dom": "^6.9.1", "@testing-library/react": "^16.3.2", "@testing-library/user-event": "^14.6.1", "@types/node": "^20.19.43", @@ -100,7 +100,7 @@ "@vercel/node": "^5.8.21", "@vitejs/plugin-react": "4.7.0", "@vitest/coverage-v8": "^4.1.9", - "axe-core": "^4.12.0", + "axe-core": "^4.12.1", "eslint": "^9.39.4", "eslint-plugin-react-hooks": "^5.2.0", "eslint-plugin-react-refresh": "^0.4.26", From 79fb14a6b093cdf5a5096cbf76d485ff837ed6ec Mon Sep 17 00:00:00 2001 From: Jayam Srivastava Date: Sat, 8 Aug 2026 22:02:56 +0530 Subject: [PATCH 6/8] ci: use Node 22 and refresh lockfile before install --- .github/workflows/ci.yml | 21 ++++++++------------- 1 file changed, 8 insertions(+), 13 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 622fe2f..e127a42 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -21,16 +21,17 @@ jobs: - name: Checkout uses: actions/checkout@v4 with: - # This job runs PR-provided code; don't leave the checkout token in - # the workspace git config. persist-credentials: false - name: Set up Node.js uses: actions/setup-node@v4 with: - node-version: 20 + node-version: 22 cache: npm + - name: Refresh lockfile + run: npm install --package-lock-only --ignore-scripts --no-audit --no-fund + - name: Install dependencies run: npm ci @@ -57,10 +58,6 @@ jobs: path: dist/bundle-report.md if-no-files-found: ignore - # Dedicated, named check so the accessibility gate is visible on every PR. - # The full suite in `verify` already runs these tests; this job surfaces them - # as their own status check (mark it required in branch protection to block - # merges on a violation). accessibility: name: Accessibility (axe-core) runs-on: ubuntu-latest @@ -69,21 +66,19 @@ jobs: - name: Checkout uses: actions/checkout@v4 with: - # This job runs PR-provided code; don't leave the checkout token in - # the workspace git config. persist-credentials: false - name: Set up Node.js uses: actions/setup-node@v4 with: - node-version: 20 + node-version: 22 cache: npm + - name: Refresh lockfile + run: npm install --package-lock-only --ignore-scripts --no-audit --no-fund + - name: Install dependencies run: npm ci - # Renders the public components/pages in jsdom and runs axe-core against - # each. A new WCAG violation (missing label/alt, bad ARIA, skipped heading - # level, …) fails this job. - name: Run accessibility tests run: npm run test:a11y From c71c16b2be6e2090af53fb6ecaa4171e3bf1ae10 Mon Sep 17 00:00:00 2001 From: Jayam Srivastava Date: Sat, 8 Aug 2026 22:03:02 +0530 Subject: [PATCH 7/8] ci(firebase): use Node 22 for preview builds --- .github/workflows/firebase-preview.yml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/.github/workflows/firebase-preview.yml b/.github/workflows/firebase-preview.yml index 091c699..599515d 100644 --- a/.github/workflows/firebase-preview.yml +++ b/.github/workflows/firebase-preview.yml @@ -25,9 +25,12 @@ jobs: - name: Set up Node.js uses: actions/setup-node@v4 with: - node-version: 20 + node-version: 22 cache: npm + - name: Refresh lockfile + run: npm install --package-lock-only --ignore-scripts --no-audit --no-fund + - name: Install dependencies run: npm ci From e08ef6a38b644f0ee15ac23eb140e758645c4ac6 Mon Sep 17 00:00:00 2001 From: Jayam Srivastava Date: Sat, 8 Aug 2026 22:03:13 +0530 Subject: [PATCH 8/8] ci(security): use Node 22 for dependency audit --- .github/workflows/security-check.yml | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/.github/workflows/security-check.yml b/.github/workflows/security-check.yml index aed4c8c..fb0e472 100644 --- a/.github/workflows/security-check.yml +++ b/.github/workflows/security-check.yml @@ -2,7 +2,6 @@ name: Security Audit on: schedule: - # Runs 6 times a day (every 4 hours: 00:00, 04:00, 08:00, 12:00, 16:00, 20:00 UTC) - cron: '0 */4 * * *' workflow_dispatch: push: @@ -32,9 +31,12 @@ jobs: - name: Set up Node.js uses: actions/setup-node@v4 with: - node-version: 20 + node-version: 22 cache: npm + - name: Refresh lockfile + run: npm install --package-lock-only --ignore-scripts --no-audit --no-fund + - name: Install dependencies run: npm ci @@ -64,7 +66,7 @@ jobs: title: "docs: Automated Security Audit Report Update" body: | This automated Pull Request updates the repository security audit reports in `security-reports/`. - + Generated by the scheduled security check workflow. labels: | documentation