luckberg/familysync
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(16): WR-04 relabel/clarify outdated advisory tier (no false promise)

Browse Source 
The AUDIT-ADVISORY tier cross-checks pnpm outdated (direct deps) against
advisory module_names (mostly transitive), so it almost never fires.
Relabel to OUTDATED-WITH-ADVISORY and document the limitation in the
header, header text, and inline comment; point to check-audit.mjs as the
authoritative advisory gate. No risky full-tree rewrite.
This commit is contained in:
Lucas Berger
2026-06-13 08:43:54 -04:00
parent 3daa351d70
commit 3e609b2550
1 changed files with 14 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/check-outdated.mjs
+14 -5
View File
@@ -2,7 +2,13 @@
* check-outdated.mjs — pnpm outdated advisory-only tiered report (D-06 / OQ-01).
*
* Classifies all outdated packages into four tiers in priority order:
* 1. AUDIT-ADVISORY — the package's current version carries a known advisory
* 1. OUTDATED-WITH-ADVISORY — an outdated DIRECT dep whose name also appears as
* an advisory subject. NOTE (WR-04): `pnpm outdated` lists only direct/top-
* level deps, while most advisories are on TRANSITIVE deps (e.g. esbuild), so
* the two sets rarely intersect and this tier usually reports "(none)". It is
* a best-effort flag for the case where a *direct* dependency you control is
* both outdated and carries an advisory — NOT a full advisory cross-check of
* the dependency tree. The authoritative advisory gate is check-audit.mjs.
* 2. MAJOR-BEHIND-INTENTIONAL — latest major > current major, pin reason exists in outdated-pins.json
* 3. MAJOR-BEHIND-UNPINNED — latest major > current major, no pin reason (potential liability)
* 4. ROUTINE-DRIFT — same major, minor/patch behind (low priority)
@@ -72,7 +78,7 @@ try {
}
} catch {
// Audit parse failure is non-fatal for the outdated report
console.warn('[check-outdated] Warning: could not parse pnpm audit output; AUDIT-ADVISORY cross-check skipped');
console.warn('[check-outdated] Warning: could not parse pnpm audit output; OUTDATED-WITH-ADVISORY cross-check skipped');
}
// ── Run pnpm outdated ────────────────────────────────────────────────────────
@@ -112,7 +118,9 @@ for (const [pkgName, info] of Object.entries(outdatedData)) {
dependentPackages: info.dependentPackages,
};
// Priority 1: the package has an active advisory on the pinned version
// Priority 1: this outdated DIRECT dep also appears as an advisory subject.
// Rarely fires — most advisories are on transitive deps (see WR-04 note in the
// file header); the authoritative advisory gate is check-audit.mjs.
if (hasAdvisory) {
tiers.auditAdvisory.push(entry);
// Priority 2: major behind + intentional pin
@@ -132,8 +140,9 @@ console.log('');
console.log('=== DEPENDENCY HEALTH REPORT ===');
console.log('');
// Tier 1: AUDIT-ADVISORY
console.log('[AUDIT-ADVISORY] Packages with active advisories on the pinned version:');
// Tier 1: OUTDATED-WITH-ADVISORY (direct deps only — see WR-04 note in header)
console.log('[OUTDATED-WITH-ADVISORY] Outdated direct deps that also appear as an advisory subject');
console.log(' (best-effort; most advisories are on transitive deps — authoritative gate is check-audit.mjs):');
if (tiers.auditAdvisory.length === 0) {
console.log(' (none)');
} else {