@devopsplaybook.io/common-web 0.3.0 → 0.4.0

package/CHANGELOG.md

@@ -5,6 +5,20 @@ All notable changes to this project are documented here.
 This project follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/)
 and [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.4.0] - 2026-10-24
+
+### Changed
+
+- Refresh the development toolchain: Nuxt `^4.6.2`, Vitest and
+  `@vitest/coverage-v8` `^5.0.5`, and a regenerated lockfile. The production
+  dependency audit now reports no vulnerabilities.
+- Run `PR Check` and `Main Build` as repository-local equivalents of the shared
+  `common-utils` npm workflows: the blocking gate covers runtime dependencies
+  only (`npm audit --omit=dev --audit-level=high`) and the full audit is
+  reported without failing the build.
+- Document the dependency audit policy and the accepted development-only
+  advisories in `CONTRIBUTING.md`.
+
 ## [0.3.0] - 2026-09-28
 
 ### Added

package/CONTRIBUTING.md

@@ -9,6 +9,7 @@ npm ci
 npm run lint
 npm test
 npm run build
+npm audit --omit=dev --audit-level=high
 ```
 
 The tests consume the generated npm tarball, not only the working tree.
@@ -32,6 +33,44 @@ The `Main Build` workflow publishes a version to public npm only when that
 version does not already exist. Do not publish manually from a developer
 machine.
 
-The first package PR uses equivalent local checks because the shared PR
-workflow expects `package.json` to exist on `main`; subsequent PRs use the
-shared npm PR workflow.
+`PR Check` and `Main Build` use repository-local copies of the shared
+`common-utils` npm workflows until the shared versions adopt the
+production-only audit gate. See [Dependency audit
+policy](#dependency-audit-policy).
+
+## Dependency audit policy
+
+CI gates only the dependencies that ship to applications:
+
+- **Blocking**: `npm audit --omit=dev --audit-level=high` must report zero
+  vulnerabilities. Runtime dependencies such as `axios` are covered by this gate.
+- **Non-blocking**: the full `npm audit` (devDependencies included) also runs in
+  the same job with `continue-on-error: true`. Its findings are reported in the
+  workflow log and in this document; they do not fail the build.
+
+This package is a no-build Nuxt layer: consumers receive raw sources and install
+their own Nuxt, so the Nuxt build/test toolchain in `devDependencies` is never
+shipped or executed inside a consuming application. A vulnerability that exists
+only in that toolchain is a build-environment risk, not a runtime risk for
+consumers.
+
+Accepted development-only advisories (2026-10-24, after the Nuxt 4.6.2 /
+Vitest 5.0.5 refresh):
+
+| Advisory | Package | Severity | Path | Status |
+| --- | --- | --- | --- | --- |
+| GHSA-86w9-cpqp-85rv | node-forge 1.4.0 | high | nuxt → @nuxt/nitro-server → nitropack → listhen → node-forge | No fixed release (1.4.0 is latest); npm's only suggested fix is downgrading Nuxt to 4.1.3, rejected |
+
+`npm audit` lists this single advisory as seven high entries because it is also
+aggregated through `@nuxt/nitro-server`, `@nuxt/vite-builder`,
+`@nuxt/vite-server`, `nitropack`, `listhen`, and `nuxt`.
+
+Do not silence advisories with `npm audit fix --force`, npm `overrides`, or a
+Nuxt downgrade. Re-run both audits after every dependency update and update this
+table when the tree changes (remove the exception once `node-forge` ships a fix).
+
+`PR Check` and `Main Build` run repository-local copies of the shared
+`common-utils` npm workflows because the shared versions still gate on a full
+`npm audit`. Restore the shared workflow calls once
+`devopsplaybook-io/common-utils` adopts the production-only gate (its
+`reusable-npm-audit.yml` already implements it for other workflow families).

package/README.md

@@ -102,12 +102,13 @@ features, and major for breaking API or framework changes. The merge workflow
 publishes a new public npm version when the package version is not already
 published; bump `package.json` manually on the release PR.
 
-The initial bootstrap PR uses a repository-local workflow that runs install,
-audit, lint, packed-package tests, and the playground build. This is necessary
-because the shared PR workflow compares against `origin/main:package.json`,
-which does not exist before this first package change. Once the manifest is on
-`main`, PRs use the shared npm PR workflow; main builds always use the shared
-publish workflow.
+`PR Check` and `Main Build` run repository-local versions of the shared npm
+workflows so the audit gate can cover production dependencies only;
+development-toolchain advisories are reported but do not fail the build. See
+[CONTRIBUTING.md](CONTRIBUTING.md#dependency-audit-policy) for the policy and
+the accepted development-only advisories. The local jobs are a stop-gap until
+the shared `common-utils` npm workflows adopt the same gate; the `PR Check`
+bootstrap job is retained for the case where `main` has no package manifest.
 
 ## Development
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@devopsplaybook.io/common-web",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "Shared Nuxt layer for DevOpsPlaybook web applications",
   "license": "ISC",
   "engines": {
@@ -44,13 +44,13 @@
   },
   "devDependencies": {
     "@vitejs/plugin-vue": "^6.0.9",
-    "@vitest/coverage-v8": "^5.0.2",
+    "@vitest/coverage-v8": "^5.0.5",
     "@vue/test-utils": "^2.5.1",
     "jsdom": "^30.1.1",
-    "nuxt": "4.5.2",
+    "nuxt": "^4.6.2",
     "oxlint": "^1.85.0",
     "pinia": "^4.0.3",
-    "vitest": "^5.0.2"
+    "vitest": "^5.0.5"
   },
   "publishConfig": {
     "access": "public"