Address vulnerabilities and update CI to handle acceptable vulnerabilities

Author: rashmithachamikara

.github/workflows/portal-frontend-ci.yml

@@ -41,7 +41,7 @@ jobs:
         run: pnpm install --frozen-lockfile
 
       - name: Audit production dependencies
-        run: pnpm audit --prod --audit-level high
+        run: pnpm security:audit
 
       - name: Lint
         run: pnpm lint

portal/frontend/docs/acceptable-dependency-risks.md

@@ -0,0 +1,48 @@
+# Frontend dependency risk acceptance
+
+Recorded: 2026-07-29  
+Review by: 2026-10-27
+
+## Current audit status
+
+After upgrading all safely compatible patched dependencies:
+
+- `pnpm audit` reports three high-severity vulnerability instances across two advisories.
+- `pnpm audit --prod` reports one high-severity advisory.
+- No critical, moderate, or low-severity findings remain.
+
+## GHSA-qwww-vcr4-c8h2 — React Router RSC CSRF
+
+- Affected dependency: `react-router@7.18.2`, through `react-router-dom@7.18.2`.
+- Available remediation: `react-router@8.3.0`.
+- Applicability: Not applicable to the current application architecture. The advisory states that
+  it affects applications using unstable React Server Components APIs. This frontend is a
+  client-rendered Vite SPA and does not use React Server Components or React Router server actions.
+- Reason upgrade is deferred: A matching stable `react-router-dom@8.3.0` release is not currently
+  published. Overriding its internal `react-router` dependency across a major version is not a
+  supported or safe remediation.
+- Remediation trigger: Upgrade the React Router packages together when compatible stable releases
+  are available, or reassess immediately if the application adopts RSC APIs or server actions.
+- CI enforcement: `pnpm security:audit` accepts only this advisory on the exact
+  `react-router-dom > react-router` dependency path and continues to fail for every other high or
+  critical production advisory.
+
+## GHSA-mh99-v99m-4gvg / CVE-2026-14257 — brace-expansion memory exhaustion
+
+- Affected dependencies: `brace-expansion@1.1.16` through ESLint tooling and
+  `brace-expansion@2.1.2` through Vitest coverage tooling.
+- Available remediation: `brace-expansion@5.0.8`.
+- Exposure: These paths originate from declared development tools and are absent from
+  `pnpm audit --prod`. They are not included in the production browser application.
+- Reason upgrade is deferred: The patched release is an ESM-only major version. Forcing it into
+  consumers that require the 1.x or 2.x APIs may break linting and test tooling.
+- Compensating control: Do not pass attacker-controlled glob or brace patterns to lint, test, or
+  coverage commands.
+- Remediation trigger: Remove this exception when ESLint, Vitest, or their transitive dependencies
+  adopt a compatible patched release.
+
+## Review requirements
+
+Re-run `pnpm audit` and `pnpm audit --prod` during dependency updates and at the review date above.
+Reassess this acceptance earlier if dependency paths, application rendering architecture, or CI
+input trust boundaries change.

portal/frontend/package.json

@@ -15,6 +15,7 @@
     "test:coverage": "vitest run --coverage",
     "format": "prettier . --write",
     "format:check": "prettier . --check",
+    "security:audit": "node scripts/audit-production-dependencies.mjs",
     "security:verify": "node scripts/verify-production-security.mjs",
     "preview": "vite preview"
   },
@@ -26,7 +27,7 @@
     "react": "19.2.4",
     "react-dom": "19.2.4",
     "react-i18next": "16.6.2",
-    "react-router-dom": "7.15.1"
+    "react-router-dom": "7.18.2"
   },
   "devDependencies": {
     "@eslint/eslintrc": "3.3.5",
@@ -58,12 +59,13 @@
   "pnpm": {
     "overrides": {
       "yaml@>=1.0.0 <1.10.3": "1.10.3",
-      "brace-expansion@<1.1.13": "1.1.13",
-      "brace-expansion@>=2.0.0 <2.0.3": "2.0.3",
+      "brace-expansion@<1.1.16": "1.1.16",
+      "brace-expansion@>=2.0.0 <2.1.2": "2.1.2",
+      "brace-expansion@>=5.0.0 <5.0.8": "5.0.8",
       "picomatch@>=4.0.0 <4.0.4": "4.0.4",
-      "postcss@<8.5.10": "8.5.10",
+      "postcss@<8.5.18": "8.5.18",
       "esbuild@>=0.27.3 <0.28.1": "0.28.1",
-      "js-yaml@>=4.0.0 <=4.1.1": "4.2.0",
+      "js-yaml@>=4.0.0 <4.3.0": "4.3.0",
       "ws@>=8.0.0 <8.21.0": "8.21.0",
       "@babel/core@<=7.29.0": "7.29.6"
     }

portal/frontend/pnpm-lock.yaml

@@ -0,0 +1,84 @@
+/*
+ * Copyright (c) 2026, WSO2 LLC. (https://www.wso2.com).
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ */
+
+import { spawnSync } from 'node:child_process'
+
+const allowedAdvisories = new Map([
+  [
+    'GHSA-qwww-vcr4-c8h2',
+    {
+      description: 'React Router unstable RSC APIs are not used by this Vite SPA',
+      pathPattern: /^\. > react-router-dom@[^ ]+ > react-router@[^ ]+$/,
+    },
+  ],
+])
+
+const pnpmCli = process.env.npm_execpath
+
+if (!pnpmCli) {
+  throw new Error('Unable to locate the active pnpm CLI from npm_execpath')
+}
+
+const audit = spawnSync(process.execPath, [pnpmCli, 'audit', '--prod', '--json'], {
+  cwd: process.cwd(),
+  encoding: 'utf8',
+  shell: false,
+})
+
+if (audit.error) {
+  throw new Error(`Unable to run pnpm audit: ${audit.error.message}`)
+}
+
+let report
+
+try {
+  report = JSON.parse(audit.stdout)
+} catch {
+  const details = [audit.stdout, audit.stderr].filter(Boolean).join('\n').trim()
+  throw new Error(`Unable to parse pnpm audit output${details ? `:\n${details}` : ''}`)
+}
+
+if (audit.status !== 0 && audit.status !== 1) {
+  throw new Error(`pnpm audit failed with exit code ${String(audit.status)}:\n${audit.stderr}`)
+}
+
+const advisories = Object.values(report.advisories ?? {})
+const blockingAdvisories = []
+const acceptedAdvisories = []
+
+for (const advisory of advisories) {
+  if (advisory.severity === 'high' || advisory.severity === 'critical') {
+    const exception = allowedAdvisories.get(advisory.github_advisory_id)
+    const paths = advisory.findings?.flatMap((finding) => finding.paths ?? []) ?? []
+    const pathsMatch = paths.length > 0 && paths.every((path) => exception?.pathPattern.test(path))
+
+    if (exception && pathsMatch) {
+      acceptedAdvisories.push({ advisory, description: exception.description })
+    } else {
+      blockingAdvisories.push(advisory)
+    }
+  }
+}
+
+for (const { advisory, description } of acceptedAdvisories) {
+  console.warn(
+    `Accepted documented advisory ${advisory.github_advisory_id}: ${advisory.title}\n` +
+      `Reason: ${description}\n`,
+  )
+}
+
+if (blockingAdvisories.length > 0) {
+  const summary = blockingAdvisories
+    .map(
+      (advisory) =>
+        `- ${advisory.github_advisory_id ?? advisory.id}: ${advisory.title} (${advisory.severity})`,
+    )
+    .join('\n')
+
+  throw new Error(`Production dependency audit found blocking advisories:\n${summary}`)
+}
+
+console.log('Production dependency audit passed.')