[TFT444]

Summary

• Run npm audit fix --force in both frontend/ and website/ to clear all high and moderate JS vulnerabilities.
• frontend/: fixed brace-expansion HIGH, source-map-js HIGH, vite HIGH, postcss-selector-parser MODERATE, zod HIGH (0 vulnerabilities after fix)
• website/: fixed vite HIGH x2, vite MODERATE x2, zod HIGH (0 vulnerabilities after fix)

Test plan

• npm audit in frontend/ reports 0 vulnerabilities
• npm audit in website/ reports 0 vulnerabilities
• Frontend build (npm run build) succeeds without errors
• Website build succeeds without errors

[github-actions]

Dependency Review

The following issues were found:

• ✅ 0 vulnerable package(s)
• ✅ 0 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ✅ 0 package(s) with unknown licenses.
• ⚠️ 1 packages with OpenSSF Scorecard issues.

View full job summary

[parthrohit22]

Reviewed c3fb830. The frontend bumps are all minor versions and CI is green. Three changes, please:

The Python changes are identical to OWASP/openshield#401. Please rebase onto dev after OWASP/openshield#401 merges, so this PR only touches JS and matches its title.
npm audit fix --force pinned astro to exactly 7.4.1. Please change it to ^7.4.1.
The exact overrides vite: 8.3.5 and zod: 4.6.7 will hold back future astro updates. Please add a comment saying why they exist and when they can be removed.

Also, please tick the test-plan boxes once npm audit and the website build are confirmed.

[parthrohit22]

Re-checked c3fb830. CI is green, and the lockfile changes look fine: no major bumps on the frontend (the removed packages are optional wasm fallbacks), and the website's major bumps (devalue 6, es-module-lexer 3, obug 3, tinyclip 1, unifont 1) all come from astro 7.4.1 itself.

Still needed:

1. Please rebase onto dev. OWASP/openshield#401 has merged and the requirements files here are now identical to dev, so they'll drop out of the diff.
2. Change "astro": "7.4.1" back to "^7.4.1".
3. The vite and zod overrides look unnecessary now: astro 7.4.1 already requires vite ^8.3.4 and zod ^4.6.6. Please remove them and check that npm audit in website/ still shows 0. If it doesn't, keep them with a comment saying which advisory they're for.

Please also tick the test-plan boxes. Once this merges, OWASP/openshield#367 and OWASP/openshield#395 can be closed because this covers them.

[TFT444]

@parthrohit22 Both points addressed: astro is now ^7.4.1 and the vite/zod overrides have a comment explaining the reason and when to remove them.

[parthrohit22]

Re-checked f045efe. Thanks, astro is now ^7.4.1 and the test-plan boxes are ticked.

One thing left, the overrides. I think your last push crossed with my review from earlier today. Please remove the vite and zod overrides (and the "//" comment) instead of documenting them:

• astro 7.4.1 already depends on vite ^8.3.4 and zod ^4.6.6, so the overrides don't change what gets installed today.
• The comment's reasoning doesn't hold. vite is a direct dependency of astro, not a peer dependency, and CVE-2025-31486 looks like the vite 6.x dev-server issue, which doesn't affect vite 8.
• An exact pin like 8.3.5 would stop the next vite security patch from being picked up, which is the opposite of what this PR is for.

After removing them, please check that npm audit in website/ still reports 0. If it doesn't, keep the override as a range (for example "vite": "^8.3.5") and name the advisory it's for.

The requirements files still show in the diff because the branch is one commit behind dev. Their content matches dev, so there's no net change, but a rebase would tidy the diff.

[TFT444]

Thanks for the re-review. Addressed the last item: rebased onto dev so #401's merged requirement changes drop out, the diff is now just the three JS dependency files. The vite/zod overrides and the // comment are removed, astro stays on ^7.4.1, and npm audit in website/ is 0.

One note for transparency: frontend/ still shows 6 moderate advisories, all minimatch via the eslint dev-dependency chain (GHSA-g3hv-75wg-m249), no upstream fix and dev-tooling only. They're pre-existing on dev and untouched here, so out of scope for this PR.

Re-requesting review when you get a chance.