Address vulnerabilities and update CI to handle acceptable vulnerabilities

Author: rashmithachamikara

.github/workflows/portal-frontend-ci.yml

@@ -41,7 +41,7 @@ jobs:
         run: pnpm install --frozen-lockfile
 
       - name: Audit production dependencies
-        run: pnpm audit --prod --audit-level high
+        run: pnpm security:audit
 
       - name: Lint
         run: pnpm lint

portal/frontend/package.json

@@ -15,6 +15,7 @@
     "test:coverage": "vitest run --coverage",
     "format": "prettier . --write",
     "format:check": "prettier . --check",
+    "security:audit": "node scripts/audit-production-dependencies.mjs",
     "security:verify": "node scripts/verify-production-security.mjs",
     "preview": "vite preview"
   },
@@ -26,7 +27,7 @@
     "react": "19.2.4",
     "react-dom": "19.2.4",
     "react-i18next": "16.6.2",
-    "react-router-dom": "7.15.1"
+    "react-router-dom": "7.18.2"
   },
   "devDependencies": {
     "@eslint/eslintrc": "3.3.5",
@@ -58,12 +59,13 @@
   "pnpm": {
     "overrides": {
       "yaml@>=1.0.0 <1.10.3": "1.10.3",
-      "brace-expansion@<1.1.13": "1.1.13",
-      "brace-expansion@>=2.0.0 <2.0.3": "2.0.3",
+      "brace-expansion@<1.1.16": "1.1.16",
+      "brace-expansion@>=2.0.0 <2.1.2": "2.1.2",
+      "brace-expansion@>=5.0.0 <5.0.8": "5.0.8",
       "picomatch@>=4.0.0 <4.0.4": "4.0.4",
-      "postcss@<8.5.10": "8.5.10",
+      "postcss@<8.5.18": "8.5.18",
       "esbuild@>=0.27.3 <0.28.1": "0.28.1",
-      "js-yaml@>=4.0.0 <=4.1.1": "4.2.0",
+      "js-yaml@>=4.0.0 <4.3.0": "4.3.0",
       "ws@>=8.0.0 <8.21.0": "8.21.0",
       "@babel/core@<=7.29.0": "7.29.6"
     }

portal/frontend/pnpm-lock.yaml

@@ -0,0 +1,84 @@
+/*
+ * Copyright (c) 2026, WSO2 LLC. (https://www.wso2.com).
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ */
+
+import { spawnSync } from 'node:child_process'
+
+const allowedAdvisories = new Map([
+  [
+    'GHSA-qwww-vcr4-c8h2',
+    {
+      description: 'React Router unstable RSC APIs are not used by this Vite SPA',
+      pathPattern: /^\. > react-router-dom@[^ ]+ > react-router@[^ ]+$/,
+    },
+  ],
+])
+
+const pnpmCli = process.env.npm_execpath
+
+if (!pnpmCli) {
+  throw new Error('Unable to locate the active pnpm CLI from npm_execpath')
+}
+
+const audit = spawnSync(process.execPath, [pnpmCli, 'audit', '--prod', '--json'], {
+  cwd: process.cwd(),
+  encoding: 'utf8',
+  shell: false,
+})
+
+if (audit.error) {
+  throw new Error(`Unable to run pnpm audit: ${audit.error.message}`)
+}
+
+let report
+
+try {
+  report = JSON.parse(audit.stdout)
+} catch {
+  const details = [audit.stdout, audit.stderr].filter(Boolean).join('\n').trim()
+  throw new Error(`Unable to parse pnpm audit output${details ? `:\n${details}` : ''}`)
+}
+
+if (audit.status !== 0 && audit.status !== 1) {
+  throw new Error(`pnpm audit failed with exit code ${String(audit.status)}:\n${audit.stderr}`)
+}
+
+const advisories = Object.values(report.advisories ?? {})
+const blockingAdvisories = []
+const acceptedAdvisories = []
+
+for (const advisory of advisories) {
+  if (advisory.severity === 'high' || advisory.severity === 'critical') {
+    const exception = allowedAdvisories.get(advisory.github_advisory_id)
+    const paths = advisory.findings?.flatMap((finding) => finding.paths ?? []) ?? []
+    const pathsMatch = paths.length > 0 && paths.every((path) => exception?.pathPattern.test(path))
+
+    if (exception && pathsMatch) {
+      acceptedAdvisories.push({ advisory, description: exception.description })
+    } else {
+      blockingAdvisories.push(advisory)
+    }
+  }
+}
+
+for (const { advisory, description } of acceptedAdvisories) {
+  console.warn(
+    `Accepted documented advisory ${advisory.github_advisory_id}: ${advisory.title}\n` +
+      `Reason: ${description}\n`,
+  )
+}
+
+if (blockingAdvisories.length > 0) {
+  const summary = blockingAdvisories
+    .map(
+      (advisory) =>
+        `- ${advisory.github_advisory_id ?? advisory.id}: ${advisory.title} (${advisory.severity})`,
+    )
+    .join('\n')
+
+  throw new Error(`Production dependency audit found blocking advisories:\n${summary}`)
+}
+
+console.log('Production dependency audit passed.')