Skip to content

chore(root): update audit expiries - #4576

Merged
GCHQ-Developer-847 merged 10 commits into
mi6:developfrom
evenstensberg:chore/august-audit
Jul 31, 2026
Merged

chore(root): update audit expiries#4576
GCHQ-Developer-847 merged 10 commits into
mi6:developfrom
evenstensberg:chore/august-audit

Conversation

@evenstensberg

Copy link
Copy Markdown
Contributor

Summary of the changes

Updates audits with one month. Notice if you run npm run audit there's new ghsa's that hasnt been added in the audit-ci.json, so CI will fail until those are added. Believe this work is best for the core team to tackle.

Related issue

N/A

Checklist

General

  • Changes to docs package checked and committed.
  • All acceptance criteria reviewed and met.

Testing

  • Relevant unit tests and visual regression tests added.
  • Visual testing against Figma component specification completed.
  • Playground stories in React Storybook up to date, with any prop changes and additions addressed.
  • Compare performance of modified components against develop using Performance addon in React Storybook.

Accessibility

  • Accessibility Insights FastPass performed.
  • A11y unit test added and yields no issues.
  • A11y plug-in on Storybook yields no issues.
  • Manual screen reader testing performed using NVDA and VoiceOver.
  • Manual keyboard testing for keyboard controls and logical focus order.
  • Correct roles used and ARIA attributes used correctly where required.
  • Logical heading structure is maintained, and the HTML elements used for headings can be changed to fit within the wider page structure.

Resize/zoom behaviour

  • Page can be zoomed to 400% with no loss of content.
  • Screen magnifier used with no issues.
  • Text resized to 200% with no loss of content.
  • Text spacing increased as per the WCAG 1.4.12 success criterion with no loss of content.

System modes

  • Browser setting 'prefers reduced motion' tested. No animations or motion visible whilst this setting is on.
  • Windows High Contrast mode tested with no loss of content.
  • System light and dark mode tested with no loss of content.
  • Browser support tested (Chrome, Safari, Firefox and Edge).

Testing content extremes

  • Min/max content examples tested with no loss of content or overflow.
  • All prop combinations work without issue.
  • Tested for FOUC (Flash of Unstyled Content) in both SSR (Server-Side Rendering) and SSG (Static Site Generation) settings.
  • Controlled and uncontrolled input components tested.
  • Props/slots can be updated after initial render.

@github-actions
github-actions Bot changed the base branch from main to develop July 27, 2026 14:22
@github-actions

Copy link
Copy Markdown
Contributor

Your PR was set to target main, PRs should be target develop
The base branch of this PR has been automatically changed to develop, please check that there are no merge conflicts

@evenstensberg

Copy link
Copy Markdown
Contributor Author

Added fix in last commit, I can rebase if you want to comb through these before a refined and reviewed option.

Comment thread audit-ci.json

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Had a look into some of the new vulnerabilities and I believe it might be possible to fix a few of them by updating the tar and js-yaml override versions in each of the packages' package.jsons

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Want me to add these lockfile changes to this PR?

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes that would be great, thanks :)

Comment thread audit-ci.json

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If possible, it would be good if the notes for the new vulnerabilities that have been added were more descriptive, e.g. which package is affected - to match the level of detail of the existing vulnerability notes

@evenstensberg

Copy link
Copy Markdown
Contributor Author

@GCHQ-Developer-847 PTAL! Did my best to split this work into chunks so you can follow the fix graph. I was unable to upgrade "js-yaml".

@GCHQ-Developer-847 GCHQ-Developer-847 left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good to me now - thank you for the contribution! :)

@GCHQ-Developer-847
GCHQ-Developer-847 merged commit 57e667e into mi6:develop Jul 31, 2026
6 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants