thanhnvandClaude Opus 4.8
36a4812ef3
Standard production layout: the OKR app (was nested under AINative_OKR_CASAN5/) is now
the repository root. No more wrapper directory.
- Promote AINative_OKR_CASAN5/* -> repo root (backend/ frontend/ packages/ apps/
.specify/ docs/ infra/ nginx/ scripts/ + configs). Merge tool dirs: .gitea (kept the
active deploy ci.yml, added harness-ci.yml + runbooks), .claude (agents/commands +
launch.json), .github moved up.
- Remove redundant: 00_SUBMISSION_PACKAGE, scattered root notes (FPT_CASAN_Full.md,
tu-tuong-casan.md, casan-tu-sinh..., casan_harness_assessment.md, source-review...,
README_CASAN5_REFINED.md), casan-next-plans/ and optimize-docs/ (competition/planning
artifacts — roadmap + design history preserved in git log / commit messages).
- Update all references to the old layout:
- .gitea/workflows/{ci,harness-ci}.yml, .github/workflows/{ci,deploy}.yml:
working-directory .; drop AINative_OKR_CASAN5/ prefix; .specify/{tests,scripts}
-> packages/casan-harness/... (.specify/logs state kept)
- .claude/launch.json, .gitea/*-runbook.md: path prefixes
- CLAUDE.md, README.md: docs/input -> apps/okr/domain/input
- policy-bundle.yaml: 8 policy paths -> packages/casan-harness/...; manifest re-signed
- secrets-scan.sh: fixture excludes -> new package/domain paths.
Full gate from the new root: PASS=64 FAIL=0 SKIP=3.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
83 lines
4.3 KiB
Plaintext
83 lines
4.3 KiB
Plaintext
# npm audit report
|
|
|
|
@nestjs/core <=11.1.17
|
|
Severity: moderate
|
|
@nestjs/core Improperly Neutralizes Special Elements in Output Used by a Downstream Component ('Injection') - https://github.com/advisories/GHSA-36xv-jgw5-4q75
|
|
fix available via `npm audit fix --force`
|
|
Will install @nestjs/core@11.1.27, which is a breaking change
|
|
node_modules/@nestjs/core
|
|
|
|
esbuild <=0.24.2
|
|
Severity: moderate
|
|
esbuild enables any website to send any requests to the development server and read the response - https://github.com/advisories/GHSA-67mh-4wv8-2f99
|
|
fix available via `npm audit fix --force`
|
|
Will install vite@8.1.1, which is a breaking change
|
|
node_modules/vite/node_modules/esbuild
|
|
vite <=6.4.2
|
|
Depends on vulnerable versions of esbuild
|
|
node_modules/vite
|
|
|
|
file-type 13.0.0 - 21.3.1
|
|
Severity: moderate
|
|
file-type affected by infinite loop in ASF parser on malformed input with zero-size sub-header - https://github.com/advisories/GHSA-5v7r-6r5c-r473
|
|
file-type: ZIP Decompression Bomb DoS via [Content_Types].xml entry - https://github.com/advisories/GHSA-j47w-4g3g-c36v
|
|
fix available via `npm audit fix --force`
|
|
Will install @nestjs/common@11.1.27, which is a breaking change
|
|
node_modules/file-type
|
|
@nestjs/common 10.4.16 - 10.4.22 || 11.0.16 - 11.1.16 || 12.0.0-alpha.0 - 12.0.0-alpha.2
|
|
Depends on vulnerable versions of file-type
|
|
node_modules/@nestjs/common
|
|
|
|
multer <=2.1.1
|
|
Severity: high
|
|
Multer vulnerable to Denial of Service via incomplete cleanup - https://github.com/advisories/GHSA-xf7r-hgr6-v32p
|
|
Multer vulnerable to Denial of Service via resource exhaustion - https://github.com/advisories/GHSA-v52c-386h-88mc
|
|
Multer Vulnerable to Denial of Service via Uncontrolled Recursion - https://github.com/advisories/GHSA-5528-5vmv-3xc2
|
|
Multer vulnerable to Denial of Service via deeply nested field names - https://github.com/advisories/GHSA-72gw-mp4g-v24j
|
|
Multer vulnerable to Denial of Service via incomplete cleanup of aborted uploads - https://github.com/advisories/GHSA-3p4h-7m6x-2hcm
|
|
fix available via `npm audit fix --force`
|
|
Will install @nestjs/platform-express@11.1.27, which is a breaking change
|
|
node_modules/multer
|
|
@nestjs/platform-express <=11.1.14 || 12.0.0-alpha.0 - 12.0.0-alpha.2
|
|
Depends on vulnerable versions of body-parser
|
|
Depends on vulnerable versions of express
|
|
Depends on vulnerable versions of multer
|
|
node_modules/@nestjs/platform-express
|
|
|
|
qs 6.11.1 - 6.15.1
|
|
Severity: moderate
|
|
qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/undefined entries in comma-format arrays when encodeValuesOnly is set - https://github.com/advisories/GHSA-q8mj-m7cp-5q26
|
|
fix available via `npm audit fix --force`
|
|
Will install @nestjs/platform-express@11.1.27, which is a breaking change
|
|
node_modules/qs
|
|
body-parser 1.20.3 - 1.20.4 || 2.0.0-beta.1 - 2.0.2
|
|
Depends on vulnerable versions of qs
|
|
node_modules/body-parser
|
|
express 4.21.0 - 4.22.1 || 5.0.0-alpha.1 - 5.0.1
|
|
Depends on vulnerable versions of qs
|
|
node_modules/express
|
|
|
|
tar <=7.5.15
|
|
Severity: high
|
|
node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal - https://github.com/advisories/GHSA-34x7-hfp2-rc4v
|
|
node-tar is Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization - https://github.com/advisories/GHSA-8qq5-rm4j-mr97
|
|
Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in node-tar Extraction - https://github.com/advisories/GHSA-83g3-92jg-28cx
|
|
tar has Hardlink Path Traversal via Drive-Relative Linkpath - https://github.com/advisories/GHSA-qffp-2rhf-9h96
|
|
node-tar Symlink Path Traversal via Drive-Relative Linkpath - https://github.com/advisories/GHSA-9ppj-qmqm-q256
|
|
Race Condition in node-tar Path Reservations via Unicode Ligature Collisions on macOS APFS - https://github.com/advisories/GHSA-r6q2-hw4h-h46w
|
|
node-tar applies PAX size override to intermediary GNU long-name/long-link headers, causing tar parser interpretation differential (file smuggling) - https://github.com/advisories/GHSA-vmf3-w455-68vh
|
|
fix available via `npm audit fix`
|
|
node_modules/tar
|
|
@mapbox/node-pre-gyp <=1.0.11
|
|
Depends on vulnerable versions of tar
|
|
node_modules/@mapbox/node-pre-gyp
|
|
|
|
|
|
12 vulnerabilities (7 moderate, 5 high)
|
|
|
|
To address issues that do not require attention, run:
|
|
npm audit fix
|
|
|
|
To address all issues (including breaking changes), run:
|
|
npm audit fix --force
|