chore(security): raise CI npm audit to high and fix high-severity advisories

[luluiz]

Summary

Raises the CI npm audit gate from moderate to high severity and fixes every high-severity advisory currently reported by yarn npm audit --all --recursive --severity high.

Changes

• CI (.github/workflows/ci.yml): audit step now runs with --severity high.
• minimatch 7.4.7/9.0.6 → 7.4.9/9.0.9 — in-range lockfile refresh (yarn up -R). ReDoS (GHSA-7r86-cg39-jmmj, GHSA-23c5-xmqv-rm74).
• path-to-regexp 0.1.12 → 0.1.13 — in-range lockfile refresh. ReDoS (GHSA-37ch-88jc-xwx2).
• ws 8.19.0 → 8.21.0 — corrected a stale resolution selector (ws@8.20.0 never matched the real ^8.18.0 descriptor) to ws@^8.18.0. DoS (GHSA-96hv-2xvq-fx4p).
• serialize-javascript 6.0.2 → 7.0.3 — resolutions override. RCE (GHSA-5c6j-r48x-rmvq).

Workaround note: serialize-javascript

All 6.x are vulnerable; the first patched release is 7.0.3 (a major bump). terser-webpack-plugin@5.3.16 still pins serialize-javascript@^6.0.2 and upstream has not published a release depending on 7.x, so an in-range fix is not possible. The resolutions override forces the patched major. Compatibility validated by:

• a successful yarn web:build:prod (exercises terser minification), and
• copy-webpack-plugin@14 already using serialize-javascript@7 in the same dependency tree.

When terser-webpack-plugin ships a release depending on serialize-javascript@^7, this override becomes stale and can be removed.

Validation

• yarn npm audit --all --recursive --severity high → clean (No audit suggestions, exit 0).
• yarn web:build:prod → success.

Summary by CodeRabbit

• Chores
  • Tightened the security check threshold in CI: builds now fail on higher-severity audit findings.
  • Updated dependency resolution settings to improve compatibility while still keeping the targeted WebSocket library locked to the intended version.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: ffb7f3cb-8e29-4fa6-b604-d2431d39390f

📥 Commits

Reviewing files that changed from the base of the PR and between 771af76 and 92e4a15.

⛔ Files ignored due to path filters (1)

• yarn.lock is excluded by !**/yarn.lock, !**/*.lock, !yarn.lock

📒 Files selected for processing (1)

• package.json

💤 Files with no reviewable changes (1)

• package.json

---

Walkthrough

The CI workflow now fails npm audit only for high-severity vulnerabilities. The Yarn resolutions entry for ws now targets ^8.18.0 while still pinning 8.21.0.

Changes

CI and Dependency Resolution Updates

Layer / File(s)	Summary
Audit severity and ws resolution .github/workflows/ci.yml, package.json	CI's npm audit threshold changes to high, and the ws resolution selector changes to ^8.18.0 while keeping 8.21.0 as the resolved version.

Estimated code review effort: 1 (Trivial) | ~3 minutes

Possibly related PRs

• lichtblick-suite/lichtblick#1166: Related CI and dependency-resolution work around audit findings and package version handling.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately summarizes the main change: raising the CI audit threshold and addressing high-severity advisories.
Description check	✅ Passed	The description is detailed and covers summary, changes, workaround, and validation, though it does not follow the template headings exactly.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch bugfix/audit-high-severity-fixes

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🧹 Nitpick comments (1)

.github/workflows/ci.yml (1)

25-25: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick win

Moderate vulnerabilities will no longer fail CI.

Raising the threshold from moderate to high is a deliberate security posture reduction — new moderate-severity advisories will silently pass CI. Consider adding a separate non-blocking audit step (e.g., yarn npm audit --all --recursive --severity moderate --json || true) to keep visibility without gating the build, or document the rationale for future maintainers.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/ci.yml at line 25, The CI audit threshold in the workflow
is being relaxed so moderate vulnerabilities no longer fail builds. Update the
workflow step that runs the npm audit command to preserve visibility for
moderate issues without blocking CI, ideally by adding a separate non-blocking
audit step alongside the existing high-severity gate, and keep the change
localized to the audit command entry in the workflow.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@package.json`:
- Line 89: The override for serialize-javascript is forcing version 7.0.3 even
though terser-webpack-plugin@5.3.16 expects a 6.x release. Update
terser-webpack-plugin to 5.3.17 or later if you want to keep the override, or
change/remove the override in package.json so it stays on a compatible 6.x
version; use the serialize-javascript override entry and terser-webpack-plugin
dependency as the anchor points.

---

Nitpick comments:
In @.github/workflows/ci.yml:
- Line 25: The CI audit threshold in the workflow is being relaxed so moderate
vulnerabilities no longer fail builds. Update the workflow step that runs the
npm audit command to preserve visibility for moderate issues without blocking
CI, ideally by adding a separate non-blocking audit step alongside the existing
high-severity gate, and keep the change localized to the audit command entry in
the workflow.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: a14e64f0-b6e0-4623-aadd-a4a6e45b0525

📥 Commits

Reviewing files that changed from the base of the PR and between 9c2b8d2 and 771af76.

⛔ Files ignored due to path filters (1)

• yarn.lock is excluded by !**/yarn.lock, !**/*.lock, !yarn.lock

📒 Files selected for processing (2)

• .github/workflows/ci.yml
• package.json

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud