v3.4.1
A security release, and an honest one.
What was wrong
Nothing had ever scanned this project's dependencies. pnpm audit cannot run here at all — it exhausts memory and is killed even with an 8 GB heap, so the failure was never a Node version problem; the dependency graph is simply too large for it. Dependabot was off. The state was unknown rather than clean.
Scanning the lockfile directly found 264 known vulnerabilities across 75 packages. One was checked before acting on the number: GHSA-35jp-ww65-95wh, a full man-in-the-middle via prototype pollution in axios, affecting every 1.x up to 1.16.0. We were on 1.14.0.
What this release fixes
59 closed, including all 28 in axios and all 18 in undici, plus dompurify, postcss, ws, brace-expansion, form-data and follow-redirects. Seven packages are pinned to single patched versions, because a direct bump was not enough on its own — axios moved to 1.19.0 while an older transitive copy stayed behind.
The scan now runs in CI, on every lockfile change and weekly, because a lockfile that has not moved still becomes vulnerable the day an advisory lands against something in it. It fails on findings that are new, not on the ones already known and recorded with a reason.
What is not fixed, and why
205 remain. tar needs 7.x and multer 2.x, both major upgrades; lodash's advisory names a version its own consumers will not accept. Each is a change with its own risk and will be judged on its own rather than swept through in a batch. The full list, with reasons, is in .github/osv-known.txt.
A note on how this went
The first attempt at this release closed 170 rather than 59 — and stopped the backend from starting. It was deployed, the API answered 502, and it was rolled back within three minutes. No users exist yet, so nobody was affected.
The cause was a dependency moving 36 minor versions inside its own caret range and landing on an incompatible peer. The reason it got through was simpler: all three applications were built and typechecked, and not one of them was run.
This release was verified by booting the actual container image on the production host before deploying it.
Full diff: v3.4.0...v3.4.1