https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40778 --- Comment #1 from Paul Derscheid <paul.derscheid@lmscloud.de> --- Created attachment 189192 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=189192&action=edit Bug 40778: Pin Node.js dependencies to exact resolved versions - Replace all caret ranges (^) in package.json with exact versions - 37 dependencies pinned to exact versions - 32 devDependencies pinned to exact versions - 2 resolutions updated to exact versions - This ensures reproducible builds by locking dependencies to their currently resolved versions from yarn.lock - This also ensures that we don't update to a compromised package by accident just by running `yarn install` without `--frozen-lockfile` -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40778 --- Comment #3 from Paul Derscheid <paul.derscheid@lmscloud.de> --- Created attachment 189194 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=189194&action=edit Bug 40778: Introduce modular Node.js dependency auditing framework - Add a complete Node.js dependency management and audit framework under Koha/Devel/Node/, supporting npm and Yarn via a strategy-based design - Unified command-line tools for outdated, audit, SBOM, and Bugzilla reports - Extensible package manager abstraction (Npm, Yarn) - Structured JSON output and CycloneDX-like SBOM generation - Compromise detection for quick checks if security breaches are announced - Integrated CI helper To test: 1. Run `./misc/devel/node_audit_dependencies.pl --help` to verify tool availability. 2. Execute `--outdated` and `--audit` modes to ensure JSON output and summary files are generated. 3. Generate reports: - `--sbom` → creates `node_modules_sbom.xml` - `--bugzilla` → creates `dependency_bugzilla_report.md` 4. Optionally test compromise detection: `./misc/devel/node_audit_compromise.pl --inline "lodash@4.17.21"` 5. Sign off. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40778 --- Comment #5 from Paul Derscheid <paul.derscheid@lmscloud.de> --- I am also not sure yet, whether the template for the bugzilla report makes sense as it is. I thought about splitting this by severity. But on the other hand, we probably don't want to scatter dozens of bugs that all just address a single dependency update. So keeping this in one bug "per run" with findings and updating with patches per finding is probably cleaner. Not sure yet, whether this should be automated, or if it's better if a person (me for example :)) just takes the report and manually creates a bug after the run and only creates a new one if new findings pop up. In summary, I am not sure yet about the actual workflow based on this, but would recommend: - CI runs: - Audit lists - Vulnerable packages - Outdated packages - Report is generated - Is translated into a Bug - Then start fixing by severity what is easily fixable (no major version upgrades) - Create targeted bugs for vulnerable packages that need a major upgrade - Then start fixing the outdated ones in the same manner - Every action depends a bit on whether the dependency is actually in the production build or just a devDependency (we need to maybe review if these are sorted into the right bins right now) - Production dependencies need to be prioritized - Dev dependencies can be evaluated after - Once we did the initial cleanup, this will surface a lot less issues but I am not sure how long this will take - We already have some deps, where we are 3 major versions behind - This then also requires the dev to review upstream what actually happened - If we depend on something outdated that requires a big refactor and it's not vulnerable in a way that's actually exploitable, it's debatable of whether it's worth the effort to upgrade -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.