fg-devkit 1.20.2 → 1.21.1

package/scripts/audit-override-commit.mjs

@@ -1,16 +1,42 @@
 #!/usr/bin/env node
 /**
- * Fix one or more vulnerabilities via `pnpm audit --fix override -i`, prune unused
- * overrides, install, then auto-commit.
+ * Fix `pnpm audit` findings with the smallest possible change, verify, and auto-commit.
+ *
+ *   1. Audit and collect the vulnerable packages.
+ *   2. Refresh them in the lockfile (`pnpm update <names>`): newest version each parent's
+ *      range already allows. No overrides, nothing to clean up later.
+ *   3. Audit again. Remaining findings with a patched version that a parent's range blocks
+ *      get a tight override (`name@>=installed <patched`: lowest patched version) in
+ *      pnpm-workspace.yaml. Findings with no patch, a patch in another major, a patch
+ *      younger than minimumReleaseAge, or on a direct dependency are reported, not overridden.
+ *   4. Prune overrides that no longer change the audit (prune-overrides --fix).
+ *   5. If findings that are still reported have active <suppress> entries in fg-devkit's
+ *      shared dependency-check-suppressions.xml, write the repo's copy with only those
+ *      entries, so OWASP Dependency-Check accepts exactly the risks this repo has.
+ *   6. Install and run the repo's checks (lint-check, lint:ts, test, test:unit, build).
+ *   7. Commit the refresh, the override changes and the suppressions file separately.
  *
  * Usage:
- *   pnpm exec fg-devkit audit-override-commit [pnpm-audit-args...]
+ *   pnpm exec fg-devkit audit-override-commit [--no-verify] [--no-commit]
  */
 
 import fs from 'node:fs'
 import path from 'node:path'
 import { spawnSync } from 'node:child_process'
 import { fileURLToPath } from 'node:url'
+import { parseArgs } from 'node:util'
+import {
+  DEFAULT_MINIMUM_RELEASE_AGE_MINUTES,
+  activeSuppressedGhsas,
+  buildRefreshCommitMessage,
+  filterSuppressions,
+  diffLockfileVersions,
+  isReleaseAgeExcluded,
+  normalizeAdvisories,
+  parseAuditJson,
+  planOverrides,
+  upsertWorkspaceOverrides,
+} from './audit-fix-plan.mjs'
 import {
   buildOverrideCommitMessage,
   collectOverrideChanges,
@@ -18,120 +44,393 @@ import {
   formatOverrideValue,
 } from './override-changes.mjs'
 
+const TAG = '[audit-override-commit]'
 const cwd = process.cwd()
 const scriptDir = path.dirname(fileURLToPath(import.meta.url))
-const packageJsonPath = path.join(cwd, 'package.json')
+const TRACKED_FILES = ['package.json', 'pnpm-lock.yaml', 'pnpm-workspace.yaml']
+const VERIFY_SCRIPTS = ['lint-check', 'lint:ts', 'test', 'test:unit', 'build']
+const SUPPRESSIONS_FILE = 'dependency-check-suppressions.xml'
+const SUPPRESSIONS_COMMIT_MESSAGE = 'chore(repo): sync dependency-check suppressions'
+let suppressionsWritten = false
+
+const { values: args } = parseArgs({
+  options: {
+    'no-verify': { type: 'boolean', default: false },
+    'no-commit': { type: 'boolean', default: false },
+    help: { type: 'boolean', short: 'h', default: false },
+  },
+  strict: true,
+})
+
+if (args.help) {
+  console.log(`Usage: pnpm exec fg-devkit audit-override-commit [--no-verify] [--no-commit]
+
+Refreshes vulnerable packages in the lockfile within their existing ranges, adds a
+tight override only where a parent's range blocks the patched version, prunes unused
+overrides, syncs dependency-check-suppressions.xml when a remaining finding is
+suppressed there, runs the repo's checks, and commits each kind of change separately.
+
+  --no-verify   Skip lint/typecheck/test/build (git hooks still run on commit)
+  --no-commit   Leave the changes in the working tree`)
+  process.exit(0)
+}
+
+// ---------------------------------------------------------------------------
+// Process helpers
+// ---------------------------------------------------------------------------
 
-function runPnpm(args) {
-  const result = spawnSync('pnpm', args, {
-    stdio: 'inherit',
+function run(command, commandArgs, { capture = false, env = {}, input } = {}) {
+  const result = spawnSync(command, commandArgs, {
     cwd,
-    env: process.env,
+    env: { ...process.env, ...env },
+    encoding: 'utf8',
+    stdio: capture ? ['pipe', 'pipe', 'pipe'] : ['inherit', 'inherit', 'inherit'],
+    input,
+    maxBuffer: 50 * 1024 * 1024,
   })
-  if (result.error) {
-    console.error('[audit-override-commit]', result.error.message)
-    return 1
+  if (result.error) throw result.error
+  return result
+}
+
+function runOrFail(command, commandArgs, options) {
+  const result = run(command, commandArgs, options)
+  if (result.status !== 0) {
+    const detail = options?.capture ? `\n${(result.stderr || result.stdout || '').trim()}` : ''
+    throw new Error(`${command} ${commandArgs.join(' ')} failed (exit ${result.status})${detail}`)
   }
-  return result.status ?? 1
+  return result
 }
 
-function runGit(args) {
-  const result = spawnSync('git', args, {
-    stdio: 'inherit',
-    cwd,
-    env: process.env,
-  })
-  if (result.error) {
-    console.error('[audit-override-commit]', result.error.message)
-    return 1
+function readFile(file) {
+  const full = path.join(cwd, file)
+  return fs.existsSync(full) ? fs.readFileSync(full, 'utf8') : undefined
+}
+
+function snapshot() {
+  return Object.fromEntries(TRACKED_FILES.map((file) => [file, readFile(file)]))
+}
+
+function isWorkspaceWithPackages() {
+  return /^packages:/m.test(readFile('pnpm-workspace.yaml') ?? '')
+}
+
+// ---------------------------------------------------------------------------
+// pnpm
+// ---------------------------------------------------------------------------
+
+function audit() {
+  const result = run('pnpm', ['audit', '--json'], { capture: true })
+  if (result.status !== 0 && result.status !== 1) {
+    throw new Error(`pnpm audit failed (exit ${result.status})\n${(result.stderr || result.stdout || '').trim()}`)
   }
-  return result.status ?? 1
+  return normalizeAdvisories(parseAuditJson(result.stdout))
 }
 
-function runPruneOverridesFix() {
-  console.log('[audit-override-commit] Pruning overrides that no longer affect pnpm audit…')
-  const result = spawnSync(process.execPath, [path.join(scriptDir, 'prune-overrides.mjs'), '--fix'], {
-    stdio: 'inherit',
-    cwd,
-    env: process.env,
-  })
-  if (result.error) {
-    console.error('[audit-override-commit]', result.error.message)
-    return 1
+function readPnpmConfig() {
+  const result = run('pnpm', ['config', 'list', '--json'], { capture: true })
+  if (result.status !== 0) return {}
+  try {
+    return parseAuditJson(result.stdout)
+  } catch {
+    return {}
+  }
+}
+
+function publishTimes(name) {
+  const result = run('pnpm', ['view', name, 'time', '--json'], { capture: true })
+  if (result.status !== 0) return {}
+  try {
+    return parseAuditJson(result.stdout)
+  } catch {
+    return {}
   }
-  return result.status ?? 1
 }
 
-function stageExistingFiles(files) {
-  const existingFiles = files.filter((filePath) => fs.existsSync(path.join(cwd, filePath)))
-  if (existingFiles.length === 0) return 0
-  return runGit(['add', '--', ...existingFiles])
+function directDependencies() {
+  const pkg = JSON.parse(readFile('package.json'))
+  return new Set(
+    ['dependencies', 'devDependencies', 'optionalDependencies'].flatMap((section) => Object.keys(pkg[section] ?? {})),
+  )
 }
 
-function main() {
-  if (!fs.existsSync(packageJsonPath)) {
-    console.error(`[audit-override-commit] package.json not found at ${packageJsonPath}`)
+// ---------------------------------------------------------------------------
+// git
+// ---------------------------------------------------------------------------
+
+function assertCleanGitState() {
+  const files = [...TRACKED_FILES, SUPPRESSIONS_FILE]
+  const status = runOrFail('git', ['status', '--porcelain', '--', ...files], { capture: true }).stdout.trim()
+  const problem = status
+    ? `Commit or stash your changes to ${files.join(', ')} first:\n${status}`
+    : run('git', ['diff', '--cached', '--quiet'], { capture: true }).status !== 0
+      ? 'There are staged changes. Commit or unstage them first.'
+      : undefined
+  if (problem) {
+    console.error(`${TAG} ${problem}`)
     process.exit(1)
   }
+}
 
-  let beforeOverrides
-  try {
-    beforeOverrides = collectOverrides(cwd)
-  } catch (err) {
-    console.error(`[audit-override-commit] Failed to read overrides before audit fix: ${err.message}`)
-    process.exit(1)
+function headContent(file) {
+  const result = run('git', ['show', `HEAD:${file}`], { capture: true })
+  return result.status === 0 ? result.stdout : undefined
+}
+
+/** Stage given file contents (not necessarily what is on disk) without touching the working tree. */
+function stageContents(contents) {
+  let staged = 0
+  for (const [file, content] of Object.entries(contents)) {
+    if (content === undefined || content === headContent(file)) continue
+    const sha = runOrFail('git', ['hash-object', '-w', '--stdin', `--path=${file}`], {
+      capture: true,
+      input: content,
+    }).stdout.trim()
+    runOrFail('git', ['update-index', '--add', '--cacheinfo', `100644,${sha},${file}`])
+    staged += 1
   }
+  return staged
+}
+
+let commitsMade = 0
+
+function commit({ subject, body }) {
+  commitsMade += 1
+  console.log(`${TAG} Committing: ${subject}`)
+  runOrFail('git', body ? ['commit', '-m', subject, '-m', body] : ['commit', '-m', subject])
+}
+
+// ---------------------------------------------------------------------------
+// Steps
+// ---------------------------------------------------------------------------
 
-  const auditArgs =
-    process.argv.length > 2 ? process.argv.slice(2) : ['audit', '--fix', 'override', '-i']
+function refreshLockfile(advisories) {
+  const names = [...new Set(advisories.map((advisory) => advisory.name))].sort()
+  console.log(`${TAG} Refreshing within existing ranges: ${names.join(', ')}`)
+  const recursive = isWorkspaceWithPackages() ? ['--recursive'] : []
+  runOrFail('pnpm', ['update', ...recursive, ...names, '--lockfile-only'])
+}
 
-  const auditExitCode = runPnpm(auditArgs)
-  if (auditExitCode !== 0) {
-    process.exit(auditExitCode)
+/** Split planned overrides into ones we apply and ones held back by minimumReleaseAge. */
+function applyReleaseAgeGate(overrides) {
+  const config = readPnpmConfig()
+  const minutes = Number(config.minimumReleaseAge ?? DEFAULT_MINIMUM_RELEASE_AGE_MINUTES)
+  if (!minutes) return { allowed: overrides, heldBack: [] }
+  const excluded = config.minimumReleaseAgeExclude ?? []
+  const allowed = []
+  const heldBack = []
+  const timesByName = new Map()
+  for (const override of overrides) {
+    if (isReleaseAgeExcluded(excluded, override.name, override.value)) {
+      allowed.push(override)
+      continue
+    }
+    if (!timesByName.has(override.name)) timesByName.set(override.name, publishTimes(override.name))
+    const published = Date.parse(timesByName.get(override.name)[override.value] ?? '')
+    const ageMinutes = (Date.now() - published) / 60000
+    if (Number.isFinite(ageMinutes) && ageMinutes < minutes) {
+      heldBack.push({ ...override, waitHours: Math.ceil((minutes - ageMinutes) / 60) })
+    } else {
+      allowed.push(override)
+    }
   }
+  return { allowed, heldBack }
+}
 
-  const installExitCode = runPnpm(['install'])
-  if (installExitCode !== 0) {
-    process.exit(installExitCode)
+function writeOverrides(overrides) {
+  const file = path.join(cwd, 'pnpm-workspace.yaml')
+  const before = fs.existsSync(file) ? fs.readFileSync(file, 'utf8') : ''
+  fs.writeFileSync(file, upsertWorkspaceOverrides(before, overrides))
+  for (const override of overrides) {
+    console.log(`${TAG} Override ${override.key}: ${override.value} (${override.ghsas.join(', ')})`)
   }
+  runOrFail('pnpm', ['install', '--lockfile-only', '--ignore-scripts', '--no-frozen-lockfile'])
+}
+
+function pruneOverrides() {
+  if (!/^overrides:/m.test(readFile('pnpm-workspace.yaml') ?? '')) return
+  console.log(`${TAG} Pruning overrides that no longer affect pnpm audit…`)
+  runOrFail(process.execPath, [path.join(scriptDir, 'prune-overrides.mjs'), '--fix'])
+}
 
-  const pruneExitCode = runPruneOverridesFix()
-  if (pruneExitCode !== 0) {
-    process.exit(pruneExitCode)
+/**
+ * Write the repo's dependency-check-suppressions.xml with only the entries from fg-devkit's
+ * shared file that match a finding still reported here. Untouched when nothing matches.
+ */
+function syncSuppressions(remaining) {
+  const sourcePath = path.resolve(scriptDir, '..', 'configs', SUPPRESSIONS_FILE)
+  if (!fs.existsSync(sourcePath)) return { covered: [], uncovered: remaining }
+  const shared = fs.readFileSync(sourcePath, 'utf8')
+  const active = activeSuppressedGhsas(shared)
+  const covered = remaining
+    .filter((advisory) => active.has(advisory.ghsa))
+    .map((advisory) => ({ ...advisory, until: active.get(advisory.ghsa) }))
+  const uncovered = remaining.filter((advisory) => !active.has(advisory.ghsa))
+  if (covered.length === 0) return { covered, uncovered }
+  const content = filterSuppressions(
+    shared,
+    covered.map((advisory) => advisory.ghsa),
+  )
+  if (readFile(SUPPRESSIONS_FILE) !== content) {
+    fs.writeFileSync(path.join(cwd, SUPPRESSIONS_FILE), content)
+    suppressionsWritten = true
+    console.log(`${TAG} Wrote ${SUPPRESSIONS_FILE} with the entries that apply to this repo.`)
   }
+  return { covered, uncovered }
+}
 
-  let afterOverrides
-  try {
-    afterOverrides = collectOverrides(cwd)
-  } catch (err) {
-    console.error(`[audit-override-commit] Failed to read overrides after audit fix: ${err.message}`)
-    process.exit(1)
+function verify() {
+  console.log(`${TAG} Installing…`)
+  runOrFail('pnpm', ['install', '--no-frozen-lockfile'])
+  if (args['no-verify']) return
+  const scripts = JSON.parse(readFile('package.json')).scripts ?? {}
+  const toRun = VERIFY_SCRIPTS.filter((name) => scripts[name])
+  if (toRun.length === 0) {
+    console.log(`${TAG} No verification scripts (${VERIFY_SCRIPTS.join(', ')}) found; skipping checks.`)
+    return
   }
+  for (const name of toRun) {
+    console.log(`${TAG} Verifying: pnpm run ${name}`)
+    runOrFail('pnpm', ['run', name], { env: { CI: 'true' } })
+  }
+}
 
-  const changed = collectOverrideChanges(beforeOverrides, afterOverrides)
-  if (changed.length === 0) {
-    console.log('[audit-override-commit] No override changes detected.')
-    process.exit(0)
+function printSummary({ fixedByRefresh, plan, heldBack, applied, remaining, suppressions }) {
+  const suppressed = new Set(suppressions.covered.map((advisory) => advisory.ghsa))
+  const unique = (items) => [...new Set(items)]
+  const lines = []
+  const section = (title, items) => {
+    if (items.length === 0) return
+    lines.push(title, ...items.map((item) => `  - ${item}`))
   }
+  section('Fixed by lockfile refresh:', fixedByRefresh)
+  section(
+    'Overridden (parent range blocked the patch):',
+    applied.map((item) => `${item.key} -> ${item.value} (${item.ghsas.join(', ')})`),
+  )
+  section(
+    'Held back by minimumReleaseAge (re-run later, or add to minimumReleaseAgeExclude):',
+    heldBack.map((item) => `${item.name}@${item.value}, ~${item.waitHours}h left (${item.ghsas.join(', ')})`),
+  )
+  section(
+    'Direct dependency, bump it in package.json (policy-upgrade-commit):',
+    plan.direct.map((item) => `${item.name} ${item.versions.join(', ')} (${item.ghsas.join(', ')})`),
+  )
+  section(
+    'Patch only in a new major, upgrade the parent instead:',
+    plan.crossMajor.map((item) => `${item.name} ${item.from} -> ${item.to} (${item.ghsas.join(', ')})`),
+  )
+  section(
+    'No patched version and not suppressed, add a <suppress> entry to fg-devkit configs/dependency-check-suppressions.xml if the risk is accepted:',
+    plan.noPatch
+      .filter((item) => !item.ghsas.every((ghsa) => suppressed.has(ghsa)))
+      .map((item) => `${item.name} ${item.versions.join(', ')} (${item.ghsas.join(', ')})`),
+  )
+  section(
+    `Accepted in ${SUPPRESSIONS_FILE}${suppressionsWritten ? ' (updated from fg-devkit)' : ' (already up to date)'}:`,
+    unique(
+      suppressions.covered.map(
+        (advisory) => `${advisory.name} ${advisory.ghsa}${advisory.until ? `, until ${advisory.until}` : ''}`,
+      ),
+    ),
+  )
+  section(
+    'Could not read the patched range, check manually:',
+    plan.unparseable.map((item) => `${item.name}: ${item.patched} (${item.ghsas.join(', ')})`),
+  )
+  if (remaining.length > 0) {
+    lines.push(`Still reported by pnpm audit: ${remaining.length} advisory range(s).`)
+  } else {
+    lines.push('pnpm audit is clean.')
+  }
+  console.log(`\n${TAG} Summary\n${lines.join('\n')}`)
+}
+
+// ---------------------------------------------------------------------------
+// Main
+// ---------------------------------------------------------------------------
+
+function main() {
+  if (!readFile('package.json')) throw new Error(`package.json not found in ${cwd}`)
+  if (!readFile('pnpm-lock.yaml')) throw new Error(`pnpm-lock.yaml not found in ${cwd}`)
+  const shouldCommit = !args['no-commit']
+  if (shouldCommit) assertCleanGitState()
+
+  const original = snapshot()
+  const overridesBefore = collectOverrides(cwd)
 
-  console.log('[audit-override-commit] Override changes detected:')
-  for (const item of changed) {
-    const fromLabel = item.from ?? '(missing)'
-    console.log(`  - ${item.name}: ${fromLabel} -> ${formatOverrideValue(item.to)}`)
+  console.log(`${TAG} Running pnpm audit…`)
+  const initial = audit()
+  if (initial.length === 0) {
+    console.log(`${TAG} pnpm audit is clean. Nothing to do.`)
+    return 0
   }
+  console.log(`${TAG} ${initial.length} advisory range(s) in ${new Set(initial.map((a) => a.name)).size} package(s).`)
 
-  const stageExitCode = stageExistingFiles(['package.json', 'pnpm-lock.yaml', 'pnpm-workspace.yaml'])
-  if (stageExitCode !== 0) {
-    process.exit(stageExitCode)
+  // 2. Refresh within ranges.
+  refreshLockfile(initial)
+  const refreshed = snapshot()
+  const refreshChanges = diffLockfileVersions(original['pnpm-lock.yaml'], refreshed['pnpm-lock.yaml'])
+
+  // 3. Plan overrides for what is left.
+  const afterRefresh = audit()
+  const remainingIds = new Set(afterRefresh.map((advisory) => advisory.id))
+  const fixedByRefresh = [
+    ...new Set(initial.filter((advisory) => !remainingIds.has(advisory.id)).map((a) => `${a.name} (${a.ghsa})`)),
+  ]
+  const plan = planOverrides(afterRefresh, { directDependencies: directDependencies() })
+  const { allowed, heldBack } = applyReleaseAgeGate(plan.overrides)
+  if (allowed.length > 0) writeOverrides(allowed)
+
+  // 4. Prune, 5. sync suppressions, 6. verify.
+  pruneOverrides()
+  const remaining = allowed.length > 0 ? audit() : afterRefresh
+  const suppressions = syncSuppressions(remaining)
+  printSummary({ fixedByRefresh, plan, heldBack, applied: allowed, remaining, suppressions })
+  verify()
+
+  // 7. Commit.
+  const final = snapshot()
+  const overrideChanges = collectOverrideChanges(overridesBefore, collectOverrides(cwd))
+  const nothingChanged = !suppressionsWritten && TRACKED_FILES.every((file) => final[file] === original[file])
+  if (nothingChanged) {
+    console.log(`${TAG} No file changes.`)
+    return 0
+  }
+  if (!shouldCommit) {
+    console.log(`${TAG} --no-commit: changes left in the working tree.`)
+    return 0
   }
 
-  const { subject, body } = buildOverrideCommitMessage(changed)
-  console.log(`[audit-override-commit] Auto-committing: ${subject}`)
-  if (body) {
-    console.log(body)
+  if (refreshChanges.length > 0 && stageContents(refreshed) > 0) {
+    commit(buildRefreshCommitMessage(refreshChanges))
   }
-  const commitArgs = body ? ['commit', '-m', subject, '-m', body] : ['commit', '-m', subject]
-  process.exit(runGit(commitArgs))
+  if (overrideChanges.length > 0) {
+    for (const item of overrideChanges) {
+      console.log(`  - ${item.name}: ${item.from ?? '(missing)'} -> ${formatOverrideValue(item.to)}`)
+    }
+  }
+  if (stageContents(final) > 0) {
+    commit(
+      overrideChanges.length > 0
+        ? buildOverrideCommitMessage(overrideChanges)
+        : buildRefreshCommitMessage(diffLockfileVersions(refreshed['pnpm-lock.yaml'], final['pnpm-lock.yaml'])),
+    )
+  }
+  if (suppressionsWritten) {
+    runOrFail('git', ['add', '--', SUPPRESSIONS_FILE])
+    commit({ subject: SUPPRESSIONS_COMMIT_MESSAGE })
+  }
+  return 0
 }
 
-main()
+try {
+  process.exit(main())
+} catch (error) {
+  console.error(`${TAG} ${error instanceof Error ? error.message : error}`)
+  console.error(
+    commitsMade > 0
+      ? `${TAG} ${commitsMade} commit(s) were made before the failure. Check git log and git status.`
+      : `${TAG} Nothing was committed. Inspect the changes with git status and git diff.`,
+  )
+  process.exit(1)
+}

package/scripts/bump-node-toolchain.mjs

@@ -33,10 +33,7 @@ import fs from 'node:fs'
 import path from 'node:path'
 import { fileURLToPath } from 'node:url'
 
-import {
-  DEFAULT_NODE_TOOLCHAIN_EXCLUDE,
-  collectFleetProjectRepos,
-} from './fleet-project-repos.mjs'
+import { collectFleetProjectRepos, toolchainExclude } from './fleet-project-repos.mjs'
 import { parseFleetSelectionFlags, resolveFleetRepos } from './fleet-repo-picker.mjs'
 import {
   formatNodeNvmrc,
@@ -213,7 +210,7 @@ async function main() {
     process.exit(1)
   }
 
-  const allRepos = collectFleetProjectRepos(projectsRoot, { exclude: DEFAULT_NODE_TOOLCHAIN_EXCLUDE })
+  const allRepos = collectFleetProjectRepos(projectsRoot, { exclude: toolchainExclude(projectsRoot) })
   if (allRepos.length === 0) {
     console.log(`[bump-node-toolchain] No project repositories under ${projectsRoot}`)
     process.exit(0)

package/scripts/fg-devkit.mjs

@@ -16,11 +16,11 @@
  *   pnpm exec fg-devkit bump-node-toolchain [nvmrc-version] [projects-root] [--dry-run] [--skip-fleet] [--no-engines]
  *   pnpm exec fg-devkit policy-upgrade [policy-file] [ncu-args...]
  *   pnpm exec fg-devkit policy-upgrade-commit [--prune-overrides] [ncu-args...]
- *   pnpm exec fg-devkit audit-override-commit [pnpm-audit-args...]
+ *   pnpm exec fg-devkit audit-override-commit [--no-verify] [--no-commit]
  *   pnpm exec fg-devkit prune-overrides [--fix] [--commit]
  *   pnpm exec fg-devkit sync-project-configs   (VS Code + tooling sync; overwrites config files)
  *   pnpm exec fg-devkit sync-tooling-configs   (tooling sync only; overwrites config files)
- *   pnpm exec fg-devkit sync-dependency-check-suppressions-commit
+ *   pnpm exec fg-devkit sync-dependency-check-suppressions-commit [--all]
  *   pnpm exec fg-devkit sync-vscode-settings
  *   pnpm exec fg-devkit sync-core-coding-standards
  *   pnpm exec fg-devkit sync-consumer-scripts
@@ -542,14 +542,14 @@ Commands:
   policy-upgrade-commit [--prune-overrides] [ncu-args...]
                                  Upgrade consumer package.json packages and auto-commit
                                  --prune-overrides also drops unused workspace overrides in a second commit
-  audit-override-commit [pnpm-audit-args...]
-                                 Fix vulnerability overrides via pnpm audit, prune unused ones, auto-commit
+  audit-override-commit [--no-verify] [--no-commit]
+                                 Fix pnpm audit findings: refresh lockfile first, override only when a range blocks the fix, verify, auto-commit
   prune-overrides [--fix] [--commit]
                                  Report unused workspace overrides; --fix removes them; --commit also auto-commits
   sync-project-configs            VS Code + tooling sync (overwrites config files)
   sync-tooling-configs            Tooling sync only (overwrites config files)
-  sync-dependency-check-suppressions-commit
-                                 Copy dependency-check-suppressions.xml and auto-commit
+  sync-dependency-check-suppressions-commit [--all]
+                                 Write the dependency-check suppressions that match pnpm audit findings and auto-commit (--all: copy every entry)
   sync-vscode-settings            Copy shared VS Code settings into .vscode/settings.json
   sync-core-coding-standards      Copy .cursor core coding standards with consumer package name
   sync-vite-plugin-vue-inspector  Add/pin vite-plugin-vue-inspector, wire vite.config, install, commit

package/scripts/fleet-project-repos.mjs

@@ -80,11 +80,31 @@ export function collectFleetGitRepos(projectsRoot) {
   return repos.sort((a, b) => a.localeCompare(b))
 }
 
-/** Repos that intentionally maintain multiple Node versions or non-pnpm tooling. */
-export const DEFAULT_NODE_TOOLCHAIN_EXCLUDE = new Set(['jenkins-dockerfile', 'vulnerability-test'])
+/** Local config file in the projects root (not part of fg-devkit). */
+export const FLEET_CONFIG_FILE = '.fg-devkit-fleet.json'
 
-/** Repos excluded from fleet-wide pnpm toolchain bumps (non-pnpm or special tooling). */
-export const DEFAULT_PNPM_TOOLCHAIN_EXCLUDE = new Set(['jenkins-dockerfile', 'vulnerability-test'])
+/**
+ * Repos excluded from fleet-wide Node and pnpm toolchain bumps (for example repos that
+ * maintain several Node versions or do not use pnpm). Read from `toolchainExclude` in
+ * `<projectsRoot>/.fg-devkit-fleet.json` and the comma-separated `FGD_TOOLCHAIN_EXCLUDE`
+ * environment variable.
+ *
+ * @param {string} projectsRoot
+ * @returns {Set<string>}
+ */
+export function toolchainExclude(projectsRoot) {
+  const names = new Set()
+  try {
+    const config = JSON.parse(fs.readFileSync(path.join(projectsRoot, FLEET_CONFIG_FILE), 'utf8'))
+    for (const name of config?.toolchainExclude ?? []) names.add(String(name))
+  } catch {
+    // No local config: nothing excluded.
+  }
+  for (const name of (process.env.FGD_TOOLCHAIN_EXCLUDE ?? '').split(',')) {
+    if (name.trim()) names.add(name.trim())
+  }
+  return names
+}
 
 /**
  * @param {string} dir
@@ -108,7 +128,7 @@ export function isPnpmPackageJsonDir(dir, pkg) {
 export function collectFleetPnpmRepos(projectsRoot, options = {}) {
   const exclude = new Set([
     ...DEFAULT_FLEET_REPO_EXCLUDE,
-    ...DEFAULT_PNPM_TOOLCHAIN_EXCLUDE,
+    ...toolchainExclude(projectsRoot),
     ...(options.exclude ?? []),
   ])
   const { skipScaffoldVue = true } = options

package/scripts/node-toolchain-sync.mjs

@@ -13,7 +13,7 @@ import {
 } from './dependency-policy-toolchain.mjs'
 
 const DOCKER_FROM_NODE_PATTERN = /FROM node:(v)?(\d+(?:\.\d+)?)(-[a-z0-9-]+)?/gi
-const JENKINS_NODE_IMAGE_PATTERN = /(feelgoodsvenska\/jenkins-build:)node\d+/g
+const JENKINS_NODE_IMAGE_PATTERN = /([\w.-]+\/jenkins-build:)node\d+/g
 const GITHUB_NODE_VERSION_PATTERN = /node-version:\s*['"]?\d+(?:\.\d+)?['"]?/g
 
 /**
@@ -323,7 +323,7 @@ export function collectNodeToolchainViolations(repoRoot, policy, fgDevkitRoot) {
   const expectedJenkins = jenkinsImage ?? deriveJenkinsImageTag(nvmrc)
   if (fs.existsSync(jenkinsfilePath)) {
     const jenkinsfile = fs.readFileSync(jenkinsfilePath, 'utf8')
-    const matches = [...jenkinsfile.matchAll(/feelgoodsvenska\/jenkins-build:(node\d+)/g)]
+    const matches = [...jenkinsfile.matchAll(/[\w.-]+\/jenkins-build:(node\d+)/g)]
     for (const match of matches) {
       if (match[1] !== expectedJenkins) {
         violations.push(`Jenkinsfile: expected jenkins-build:${expectedJenkins}, got jenkins-build:${match[1]}`)

package/scripts/piwik-dimensions.test.mjs

@@ -381,20 +381,3 @@ test('pull plans tracking id updates from Piwik into the local map', () => {
     'export const customDimensions = { active: 46, step: 30 } as const\n',
   )
 })
-
-test('parses the real consumer dimension files when they are checked out beside fg-devkit', () => {
-  const files = [
-    ['../../bokningsverktyget-ui/src/analytics/dimensions.ts', 'event', 'rowsBooked', 7],
-    ['../../webbportalen-ui/src/analytics/dimensions.ts', 'session', 'organizationName', 26],
-    ['../../feelgood-app/src/util/piwikDimensions.ts', 'event', 'eventTimestamp', 78],
-  ]
-  for (const [relative, scope, key, slot] of files) {
-    const file = path.join(scriptDir, relative)
-    if (!fs.existsSync(file)) continue
-    const dimensions = parseDimensionSource(fs.readFileSync(file, 'utf8'), relative)
-    const found = dimensions.find((item) => item.key === key)
-    assert.ok(found, `${key} missing in ${relative}`)
-    assert.equal(found.scope, scope)
-    assert.equal(found.slot, slot)
-  }
-})