9 Commits

Include renames

Author	SHA1	Message	Date
Lucas Berger	8154ba6f35	style(16): apply prettier formatting to satisfy CI format:check	2026-06-13 09:29:02 -04:00
Lucas Berger	bb1e97556d	fix(16): fail closed on unparseable audit-waiver expiry date	2026-06-13 08:51:53 -04:00
Lucas Berger	3e609b2550	fix(16): WR-04 relabel/clarify outdated advisory tier (no false promise) ... The AUDIT-ADVISORY tier cross-checks pnpm outdated (direct deps) against advisory module_names (mostly transitive), so it almost never fires. Relabel to OUTDATED-WITH-ADVISORY and document the limitation in the header, header text, and inline comment; point to check-audit.mjs as the authoritative advisory gate. No risky full-tree rewrite.	2026-06-13 08:43:54 -04:00
Lucas Berger	4bb205fe0f	fix(16): CR-01 enforce audit-waiver expiry; IN-01 realpath isMain ... Add isWaived() predicate: a waiver with a past 'expires' date is treated as absent so the High/Critical advisory re-blocks. Applied in both selectBlocking and partitionAdvisories. Add expired-waiver unit tests. isMain now compares fully-resolved real paths (mirrors index.ts).	2026-06-13 08:42:08 -04:00
Lucas Berger	bc83495946	chore(16-04): commit gitleaks full-history baseline ... - 613 commits scanned, ~23 MB of git history - Zero findings after allowlisting crypto.test.ts AES test fixture - Human-verified: single baseline finding (TEST_KEY) was a Vitest fixture, not a real credential - Baseline is empty JSON array [] — PR-diff scans in 16-05 start from clean known state	2026-06-13 08:14:54 -04:00
Lucas Berger	baf2e3ad1b	feat(16-02): add check-outdated.mjs advisory-only tiered report ... - Classifies outdated packages into four tiers: AUDIT-ADVISORY, MAJOR-BEHIND-INTENTIONAL, MAJOR-BEHIND-UNPINNED, ROUTINE-DRIFT - Reads outdated-pins.json for intentional pin reasons (eslint, @eslint/js, zod, @types/node) - Cross-checks pnpm audit --json to flag pinned versions with active advisories - Always exits 0 — never gates the build (D-06)	2026-06-13 05:19:06 -04:00
Lucas Berger	6eb51078e3	feat(16-02): add check-audit.mjs blocking wrapper + unit tests ... - Exports selectBlocking() and partitionAdvisories() as pure functions for unit testing - Main body guarded by import.meta.url check (only runs when invoked directly) - Uses pnpm audit --json (no --audit-level — Pitfall 1 honored) - Exits 1 on unwaived High/Critical; exits 0 with advisory report on moderate/low - All 5 unit tests pass (node --test)	2026-06-13 05:18:19 -04:00
Lucas Berger	7ac8b19a76	test(16-02): add failing tests for check-audit.mjs filter logic ... - Tests four behavioral cases: unwaived High → blocking, waived High → not blocking, moderate/low only → not blocking, no advisories → not blocking - Uses node:test + node:assert (no extra dependencies) - Fails at RED: check-audit.mjs does not yet exist	2026-06-13 05:17:36 -04:00
Lucas Berger	0f101bdd39	chore(16-02): seed audit allowlist (esbuild GHSA waiver) + outdated pin reasons ... - audit-allowlist.json: GHSA-gv7w-rqvm-qjhr waiver (esbuild dev transitive via drizzle-kit/vitest/vite; not in production runtime) - outdated-pins.json: intentional pin reasons for eslint, @eslint/js, zod, @types/node	2026-06-13 05:17:13 -04:00