Run root audit and dependency update pass #249

New issue

Closed

opened 2026-06-03 10:16:14 +00:00 by steve · 0 comments

steve commented

2026-06-03 10:16:14 +00:00

Owner

Run a repo-root security and dependency-maintenance pass that starts from pnpm audit, updates outdated dependencies conservatively, and finishes with the app validation path required for runtime-affecting changes.

Problem

Root and workspace dependencies drift over time. Security advisories and stale package versions can accumulate outside normal feature work, and runtime packages in this repo have enough shared build/test surface that ad hoc upgrades are risky without a tracked validation pass.

Goal

Run pnpm audit from the repo root and fix actionable issues.
Review outdated dependencies from the repo root and update packages that can be moved safely in this pass.
Validate the resulting dependency set with the repo-required checks, including smoke because workspace, web, or desktop runtime behavior may change.

Scope

Repo-root dependency audit and outdated-package review.
Targeted dependency updates in package.json, workspace package manifests, lockfile, and any directly affected config or compatibility code.
Spec updates only if package/runtime behavior or validation expectations change because of the dependency work.
Required validation for the changed dependency surface.

Non-goals

Unbounded major-version churn across the whole monorepo when a package is unrelated to the audit findings or obviously high-risk for this pass.
Product-feature work unrelated to dependency/security maintenance.
Rewriting package architecture or plugin/runtime boundaries unless a dependency update forces a narrowly scoped compatibility fix.

Acceptance Criteria

pnpm audit has been run at the repo root and the resulting actionable issues are either fixed or explicitly documented in this issue if they cannot be resolved safely in this pass.
Outdated dependencies have been reviewed with a bias toward the latest compatible version that keeps the repo green.
Any compatibility edits needed for updated dependencies are implemented and covered by the narrowest reasonable tests.
Required validation passes for the final change set, including repo-root pnpm check:all and pnpm test:smoke.
If behavior/spec truth changes, the relevant spec/src/** pages are updated in the same change and pass make spec-lint plus mdbook build spec when practical.

Implementation Notes

Start with pnpm audit and pnpm outdated from the repo root to separate security-driven updates from general stale-package maintenance.
Prefer package-manager-native upgrades (pnpm up) and keep the update set small enough that failures can be attributed.
Escalate to broader updates only when a narrower change leaves unresolved audit findings.
Re-run focused checks while iterating if a single package clearly owns a breakage, then finish with repo-root validation.
Record unresolved advisories, blocked majors, or follow-up candidates back into this issue body before closing if they remain.

Suggested Files or Specs To Inspect

package.json
pnpm-lock.yaml
spec/src/80-maintenance/monorepo-scripts.md
spec/src/20-packages/workspace/index.md
spec/src/20-packages/web/index.md
spec/src/20-packages/desktop-electron/index.md
Any package-local manifests or specs touched by dependency updates

Validation Commands

pnpm audit
pnpm outdated
Focused package checks as needed while iterating
pnpm check:all
pnpm test:smoke
make spec-lint and mdbook build spec if spec/** changes

None yet.

Follow-up Tasks

Split blocked major-version upgrades or unresolved advisories into follow-up backlog items instead of hiding them in chat.

Implementation Summary

Ran the root audit, updated vulnerable and compatible dependencies, fixed upgrade fallout across docs/API/plugins/notebook, and validated with check:all plus full smoke.

Run a repo-root security and dependency-maintenance pass that starts from `pnpm audit`, updates outdated dependencies conservatively, and finishes with the app validation path required for runtime-affecting changes. ## Problem Root and workspace dependencies drift over time. Security advisories and stale package versions can accumulate outside normal feature work, and runtime packages in this repo have enough shared build/test surface that ad hoc upgrades are risky without a tracked validation pass. ## Goal 1. Run `pnpm audit` from the repo root and fix actionable issues. 2. Review outdated dependencies from the repo root and update packages that can be moved safely in this pass. 3. Validate the resulting dependency set with the repo-required checks, including smoke because workspace, web, or desktop runtime behavior may change. ## Scope - Repo-root dependency audit and outdated-package review. - Targeted dependency updates in `package.json`, workspace package manifests, lockfile, and any directly affected config or compatibility code. - Spec updates only if package/runtime behavior or validation expectations change because of the dependency work. - Required validation for the changed dependency surface. ## Non-goals - Unbounded major-version churn across the whole monorepo when a package is unrelated to the audit findings or obviously high-risk for this pass. - Product-feature work unrelated to dependency/security maintenance. - Rewriting package architecture or plugin/runtime boundaries unless a dependency update forces a narrowly scoped compatibility fix. ## Acceptance Criteria - `pnpm audit` has been run at the repo root and the resulting actionable issues are either fixed or explicitly documented in this issue if they cannot be resolved safely in this pass. - Outdated dependencies have been reviewed with a bias toward the latest compatible version that keeps the repo green. - Any compatibility edits needed for updated dependencies are implemented and covered by the narrowest reasonable tests. - Required validation passes for the final change set, including repo-root `pnpm check:all` and `pnpm test:smoke`. - If behavior/spec truth changes, the relevant `spec/src/**` pages are updated in the same change and pass `make spec-lint` plus `mdbook build spec` when practical. ## Implementation Notes - Start with `pnpm audit` and `pnpm outdated` from the repo root to separate security-driven updates from general stale-package maintenance. - Prefer package-manager-native upgrades (`pnpm up`) and keep the update set small enough that failures can be attributed. - Escalate to broader updates only when a narrower change leaves unresolved audit findings. - Re-run focused checks while iterating if a single package clearly owns a breakage, then finish with repo-root validation. - Record unresolved advisories, blocked majors, or follow-up candidates back into this issue body before closing if they remain. ## Suggested Files or Specs To Inspect - `package.json` - `pnpm-lock.yaml` - `spec/src/80-maintenance/monorepo-scripts.md` - `spec/src/20-packages/workspace/index.md` - `spec/src/20-packages/web/index.md` - `spec/src/20-packages/desktop-electron/index.md` - Any package-local manifests or specs touched by dependency updates ## Validation Commands - `pnpm audit` - `pnpm outdated` - Focused package checks as needed while iterating - `pnpm check:all` - `pnpm test:smoke` - `make spec-lint` and `mdbook build spec` if `spec/**` changes ## Related Issues None yet. ## Follow-up Tasks - Split blocked major-version upgrades or unresolved advisories into follow-up backlog items instead of hiding them in chat. ## Implementation Summary Ran the root audit, updated vulnerable and compatible dependencies, fixed upgrade fallout across docs/API/plugins/notebook, and validated with check:all plus full smoke.

steve

2026-06-03 10:16:14 +00:00