fg-devkit 1.28.2 → 1.29.0

package/README.md

@@ -65,18 +65,6 @@ Both use fg-devkit's shared [`configs/fallowrc.json`](configs/fallowrc.json), so
 the next fg-devkit bump. A repo that has its own `.fallowrc.json` (or `.fallowrc.jsonc`, `fallow.toml`, `.fallow.toml`)
 uses that instead, and so does an explicit `--config`.
 
-Write the OWASP Dependency-Check suppressions that apply to a consuming repo and commit them:
-
-```bash
-pnpm exec fgd sync-dependency-check-suppressions-commit        # only entries matching pnpm audit findings
-pnpm exec fgd sync-dependency-check-suppressions-commit --all  # every entry in the shared file
-```
-
-The command runs `pnpm audit` and keeps only the active (not expired) `<suppress>` entries from fg-devkit's shared
-`configs/dependency-check-suppressions.xml` whose GHSA id is reported in the repo, so each repo accepts exactly the
-risks it has. OWASP Dependency-Check reads the file when it is configured as a suppression file. Add another `<suppress>` element in the shared fg-devkit file for each additional accepted finding.
-The command overwrites the consumer copy; if nothing applies and the repo has no copy, no file is created.
-
 To sync standard consumer scripts to `fgd` commands:
 
 ```bash
@@ -183,7 +171,7 @@ Fix `pnpm audit` findings with the smallest change, verify, and auto-commit:
 pnpm exec fgd audit-override-commit              # refresh, override, prune, verify, commit
 pnpm exec fgd audit-override-commit --no-verify  # skip lint/typecheck/test/build (git hooks still run)
 pnpm exec fgd audit-override-commit --no-commit  # leave the changes in the working tree
-pnpm exec fgd audit-override-commit --allow-major --allow-young --bump-direct  # force without asking
+pnpm exec fgd audit-override-commit --allow-major --allow-young --bump-direct --allow-unpatched  # force without asking
 ```
 
 1. Runs `pnpm audit` and refreshes the vulnerable packages in the lockfile (`pnpm update <names>`).
@@ -201,10 +189,13 @@ pnpm exec fgd audit-override-commit --allow-major --allow-young --bump-direct  #
 4. Prunes overrides that no longer change the audit.
 5. Removes `minimumReleaseAgeExclude` entries that are no longer needed (see `prune-release-age-exclude` below).
    This step also runs when `pnpm audit` is clean.
-6. If findings that are still reported have active (not expired) `<suppress>` entries in fg-devkit's shared
-   `configs/dependency-check-suppressions.xml`, writes the repo's `dependency-check-suppressions.xml` with only
-   those entries, so OWASP Dependency-Check accepts exactly the risks this repo has. Findings with no patch and
-   no suppression are listed so you can add one.
+6. Updates the repo's `dependency-check-suppressions.xml`, which OWASP Dependency-Check reads:
+   - for each high or critical finding with no patched version you are asked whether to accept it (without a
+     terminal only with `--allow-unpatched`). An accepted finding gets a `<suppress>` entry valid for 30 days.
+     The date is never pushed forward, so the finding comes back if it is still unpatched. To accept it for longer,
+     review it, change `until` and remove the `Auto-accepted by fg-devkit` line from its notes.
+   - entries whose finding is no longer reported are removed, and the file is removed when no entry is left.
+   - other findings with no patch are listed so you can add an entry by hand.
 7. Installs and runs the repo's `lint-check`, `lint:ts`, `test`, `test:unit` and `build` scripts when present.
    Nothing is committed if a check fails.
 8. Commits the lockfile refresh (`vuln(package): refresh lockfile` / `vuln(): refresh N packages in lockfile`),

package/configs/dependency-policy.vue-workspace.json

@@ -18,7 +18,7 @@
       "@lexical/rich-text": "0.53.0",
       "@piwikpro/vue-piwik-pro": "2.0.0",
       "@sentry/vue": "11.10.0",
-      "@tanstack/vue-query": "5.105.1",
+      "@tanstack/vue-query": "5.105.3",
       "@unhead/vue": "3.4.3",
       "@vuelidate/core": "2.0.3",
       "@vuelidate/validators": "2.0.4",
@@ -57,16 +57,16 @@
       "@storybook/addon-vitest": "10.6.5",
       "@storybook/vue3": "10.6.5",
       "@storybook/vue3-vite": "10.6.5",
-      "@tanstack/vue-query-devtools": "6.3.7",
+      "@tanstack/vue-query-devtools": "6.3.9",
       "@types/lodash-es": "4.17.12",
       "@types/node": "26.6.6",
       "@vitejs/plugin-vue": "6.0.10",
-      "@vitest/browser": "5.0.5",
-      "@vitest/browser-playwright": "5.0.5",
+      "@vitest/browser": "5.1.0",
+      "@vitest/browser-playwright": "5.1.0",
       "@vue/compiler-dom": "3.5.44",
       "@vue/language-core": "3.3.14",
       "@vue/test-utils": "2.5.1",
-      "fg-devkit": "1.28.1",
+      "fg-devkit": "1.28.2",
       "happy-dom": "21.0.4",
       "jsdom": "30.1.3",
       "randexp": "0.6.1",
@@ -77,15 +77,15 @@
       "vite-plugin-dts": "5.1.2",
       "vite-plugin-vue-devtools": "8.2.1",
       "vite-plugin-vue-inspector": "7.0.0",
-      "vitest": "5.0.5"
+      "vitest": "5.1.0"
     }
   },
   "managedAnywhere": {
-    "@tailwindcss/vite": "4.3.3",
+    "@tailwindcss/vite": "4.3.4",
     "@vue/devtools-api": "8.2.1",
     "dotenv": "18.0.9",
     "playwright": "1.64.1",
-    "tailwindcss": "4.3.3",
+    "tailwindcss": "4.3.4",
     "vue": "3.5.44",
     "vue-i18n": "11.4.17",
     "vue-router": "5.4.0"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fg-devkit",
-  "version": "1.28.2",
+  "version": "1.29.0",
   "description": "Shared configs, scripts, and DX tooling for Vue / TypeScript frontend repos",
   "type": "module",
   "license": "UNLICENSED",
@@ -19,7 +19,6 @@
     "./lefthook.yml": "./configs/lefthook.yml",
     "./vscode-settings.json": "./configs/vscode-settings.json",
     "./dependency-policy.vue-workspace.json": "./configs/dependency-policy.vue-workspace.json",
-    "./dependency-check-suppressions.xml": "./configs/dependency-check-suppressions.xml",
     "./scripts/sync-vscode-settings.mjs": "./scripts/sync-vscode-settings.mjs",
     "./scripts/fg-devkit.mjs": "./scripts/fg-devkit.mjs",
     "./release-notes/parseChangelog": "./release-notes/parseChangelog.ts",

package/scaffold/vue/package.json

@@ -15,8 +15,8 @@
     "poeditor:upload": "pnpm exec fg-devkit poeditor-upload"
   },
   "dependencies": {
-    "@tailwindcss/vite": "4.3.3",
-    "@tanstack/vue-query": "5.105.1",
+    "@tailwindcss/vite": "4.3.4",
+    "@tanstack/vue-query": "5.105.3",
     "axios": "1.21.0",
     "content-disposition-header": "0.6.0",
     "date-fns": "4.4.0",
@@ -30,11 +30,11 @@
   },
   "devDependencies": {
     "@intlify/unplugin-vue-i18n": "11.2.8",
-    "@tanstack/vue-query-devtools": "6.3.7",
+    "@tanstack/vue-query-devtools": "6.3.9",
     "@types/node": "26.6.6",
-    "fg-devkit": "1.28.2",
+    "fg-devkit": "1.29.0",
     "@vitejs/plugin-vue": "6.0.10",
-    "tailwindcss": "4.3.3",
+    "tailwindcss": "4.3.4",
     "tsx": "4.23.15",
     "vite": "8.3.5",
     "vite-plugin-vue-inspector": "7.0.0"

package/scripts/audit-override-commit.mjs

@@ -16,16 +16,17 @@
  *   4. Prune overrides that no longer change the audit (prune-overrides --fix).
  *   5. Prune minimumReleaseAgeExclude entries that are no longer needed
  *      (prune-release-age-exclude --fix). Runs even when the audit is clean.
- *   6. If findings that are still reported have active <suppress> entries in fg-devkit's
- *      shared dependency-check-suppressions.xml, write the repo's copy with only those
- *      entries, so OWASP Dependency-Check accepts exactly the risks this repo has.
+ *   6. Update the repo's dependency-check-suppressions.xml: entries whose finding is no
+ *      longer reported are dropped, and high/critical findings with no patched version and
+ *      no entry are asked about (or accepted with --allow-unpatched) and get an entry valid
+ *      for 30 days that is never renewed. The file is removed when no entry applies.
  *   7. Install and run the repo's checks (lint-check, lint:ts, test, test:unit, build).
  *   8. Commit the refresh, the direct bumps, the overrides, the release-age excludes and
  *      the suppressions file separately.
  *
  * Usage:
  *   pnpm exec fg-devkit audit-override-commit [--no-verify] [--no-commit]
- *     [--allow-major] [--allow-young] [--bump-direct]
+ *     [--allow-major] [--allow-young] [--bump-direct] [--allow-unpatched]
  */
 
 import fs from 'node:fs'
@@ -34,12 +35,13 @@ import { spawnSync } from 'node:child_process'
 import { fileURLToPath } from 'node:url'
 import { parseArgs } from 'node:util'
 import {
+  AUTO_SUPPRESSION_DAYS,
+  AUTO_SUPPRESSION_SEVERITIES,
   DEFAULT_MINIMUM_RELEASE_AGE_MINUTES,
-  activeSuppressedGhsas,
   addReleaseAgeExcludes,
   buildRefreshCommitMessage,
+  buildRepoSuppressions,
   bumpDependencySpec,
-  filterSuppressions,
   diffLockfileVersions,
   isReleaseAgeExcluded,
   isSameReleaseLine,
@@ -75,6 +77,7 @@ const { values: args } = parseArgs({
     'allow-major': { type: 'boolean', default: false },
     'allow-young': { type: 'boolean', default: false },
     'bump-direct': { type: 'boolean', default: false },
+    'allow-unpatched': { type: 'boolean', default: false },
     help: { type: 'boolean', short: 'h', default: false },
   },
   strict: true,
@@ -82,12 +85,13 @@ const { values: args } = parseArgs({
 
 if (args.help) {
   console.log(`Usage: pnpm exec fg-devkit audit-override-commit [--no-verify] [--no-commit]
-         [--allow-major] [--allow-young] [--bump-direct]
+         [--allow-major] [--allow-young] [--bump-direct] [--allow-unpatched]
 
 Refreshes vulnerable packages in the lockfile within their existing ranges, adds a
 tight override only where a parent's range blocks the patched version, prunes unused
-overrides, syncs dependency-check-suppressions.xml when a remaining finding is
-suppressed there, runs the repo's checks, and commits each kind of change separately.
+overrides, updates dependency-check-suppressions.xml (accepts high/critical findings
+with no patch for 30 days, drops entries for fixed findings), runs the repo's checks,
+and commits each kind of change separately.
 
 Findings that need a decision are asked about one package at a time in a terminal.
 Without a terminal they are only reported, unless a flag below says yes for them.
@@ -96,7 +100,10 @@ Without a terminal they are only reported, unless a flag below says yes for them
   --no-commit     Leave the changes in the working tree
   --allow-major   Override even when the patch is only in a new major
   --allow-young   Allow patches younger than minimumReleaseAge (adds minimumReleaseAgeExclude)
-  --bump-direct   Bump vulnerable direct dependencies in package.json`)
+  --bump-direct   Bump vulnerable direct dependencies in package.json
+  --allow-unpatched
+                  Accept high/critical findings with no patched version for 30 days
+                  in dependency-check-suppressions.xml`)
   process.exit(0)
 }
 
@@ -409,29 +416,32 @@ function pruneOverrides() {
 }
 
 /**
- * Write the repo's dependency-check-suppressions.xml with only the entries from fg-devkit's
- * shared file that match a finding still reported here. Untouched when nothing matches.
+ * Keep the entries of the repo's dependency-check-suppressions.xml that still match a finding
+ * and add entries for the high and critical findings with no patched version that are
+ * accepted. Removed when no entry applies.
  */
-function syncSuppressions(remaining) {
-  const sourcePath = path.join(fgDevkitRoot, 'configs', SUPPRESSIONS_FILE)
-  if (!fs.existsSync(sourcePath)) return { covered: [], uncovered: remaining }
-  const shared = fs.readFileSync(sourcePath, 'utf8')
-  const active = activeSuppressedGhsas(shared)
-  const covered = remaining
-    .filter((advisory) => active.has(advisory.ghsa))
-    .map((advisory) => ({ ...advisory, until: active.get(advisory.ghsa) }))
-  const uncovered = remaining.filter((advisory) => !active.has(advisory.ghsa))
-  if (covered.length === 0) return { covered, uncovered }
-  const content = filterSuppressions(
-    shared,
-    covered.map((advisory) => advisory.ghsa),
-  )
-  if (readFile(SUPPRESSIONS_FILE) !== content) {
-    fs.writeFileSync(path.join(cwd, SUPPRESSIONS_FILE), content)
+async function syncSuppressions(remaining) {
+  const existing = readFile(SUPPRESSIONS_FILE)
+  const { candidates } = buildRepoSuppressions({ existing, advisories: remaining })
+  const accept = new Set()
+  for (const advisory of candidates) {
+    if (accept.has(advisory.ghsa)) continue
+    const message = `${advisory.name} ${advisory.versions.join(', ')} has no patched version (${advisory.severity}, ${advisory.ghsa}). Accept it in ${SUPPRESSIONS_FILE} for ${AUTO_SUPPRESSION_DAYS} days?`
+    if (await decide(message, 'allow-unpatched')) accept.add(advisory.ghsa)
+  }
+  const result = buildRepoSuppressions({ existing, advisories: remaining, accept })
+  if (result.content === null) {
+    if (existing !== undefined) {
+      fs.rmSync(path.join(cwd, SUPPRESSIONS_FILE))
+      suppressionsWritten = true
+      console.log(`${TAG} Removed ${SUPPRESSIONS_FILE}, no suppression applies to this repo.`)
+    }
+  } else if (existing !== result.content) {
+    fs.writeFileSync(path.join(cwd, SUPPRESSIONS_FILE), result.content)
     suppressionsWritten = true
-    console.log(`${TAG} Wrote ${SUPPRESSIONS_FILE} with the entries that apply to this repo.`)
+    console.log(`${TAG} Updated ${SUPPRESSIONS_FILE}.`)
   }
-  return { covered, uncovered }
+  return result
 }
 
 function verify() {
@@ -451,7 +461,9 @@ function verify() {
 }
 
 function printSummary({ fixedByRefresh, plan, forced, heldBack, applied, pruned, remaining, suppressions, excludeChanges }) {
-  const suppressed = new Set(suppressions.covered.map((advisory) => advisory.ghsa))
+  const suppressed = new Set(
+    [...suppressions.covered, ...suppressions.autoAccepted].map((advisory) => advisory.ghsa),
+  )
   const unique = (items) => [...new Set(items)]
   const lines = []
   const section = (title, items) => {
@@ -499,19 +511,23 @@ function printSummary({ fixedByRefresh, plan, forced, heldBack, applied, pruned,
       .map((item) => `${item.name} ${item.from} -> ${item.to} (${item.ghsas.join(', ')})`),
   )
   section(
-    'No patched version and not suppressed, add a <suppress> entry to fg-devkit configs/dependency-check-suppressions.xml if the risk is accepted:',
+    `No patched version and not suppressed (accept high/critical ones on a re-run or with --allow-unpatched, or add a <suppress> entry to ${SUPPRESSIONS_FILE} by hand):`,
     plan.noPatch
       .filter((item) => !item.ghsas.every((ghsa) => suppressed.has(ghsa)))
       .map((item) => `${item.name} ${item.versions.join(', ')} (${item.ghsas.join(', ')})`),
   )
   section(
-    `Accepted in ${SUPPRESSIONS_FILE}${suppressionsWritten ? ' (updated from fg-devkit)' : ' (already up to date)'}:`,
+    `Accepted in ${SUPPRESSIONS_FILE}:`,
     unique(
       suppressions.covered.map(
         (advisory) => `${advisory.name} ${advisory.ghsa}${advisory.until ? `, until ${advisory.until}` : ''}`,
       ),
     ),
   )
+  section(
+    `Accepted for ${AUTO_SUPPRESSION_DAYS} days in ${SUPPRESSIONS_FILE} (${[...AUTO_SUPPRESSION_SEVERITIES].join('/')}, no patched version, not renewed):`,
+    unique(suppressions.autoAccepted.map((advisory) => `${advisory.name} ${advisory.ghsa}, until ${advisory.until}`)),
+  )
   section(
     'Could not read the patched range, check manually:',
     plan.unparseable.map((item) => `${item.name}: ${item.patched} (${item.ghsas.join(', ')})`),
@@ -596,7 +612,7 @@ async function main() {
 
   // 5. Release-age excludes, 6. suppressions, 7. verify.
   const excludeChanges = pruneReleaseAgeExclude()
-  const suppressions = syncSuppressions(remaining)
+  const suppressions = await syncSuppressions(remaining)
   printSummary({ fixedByRefresh, plan, forced, heldBack, applied: allowed, pruned, remaining, suppressions, excludeChanges })
 
   const final = snapshot()

package/scripts/fg-devkit.mjs

@@ -21,7 +21,6 @@
  *   pnpm exec fg-devkit prune-release-age-exclude [--fix] [--commit]
  *   pnpm exec fg-devkit sync-project-configs   (VS Code + tooling sync; overwrites config files)
  *   pnpm exec fg-devkit sync-tooling-configs   (tooling sync only; overwrites config files)
- *   pnpm exec fg-devkit sync-dependency-check-suppressions-commit [--all]
  *   pnpm exec fg-devkit sync-vscode-settings
  *   pnpm exec fg-devkit sync-consumer-scripts
  *   pnpm exec fg-devkit setup-lefthook
@@ -516,7 +515,6 @@ function runSyncConfigTarget(target) {
   if (target === 'eslint') return syncFileFromTemplate('configs/eslint.sync-stub.js', 'eslint.config.js')
   if (target === 'prettier') return syncFileFromTemplate('configs/prettier.sync-stub.js', 'prettier.config.js')
   if (target === 'tsconfig') return syncFileFromTemplate('configs/tsconfig.app.sync.json', 'tsconfig.json')
-  if (target === 'dependency-check') return runNode('sync-dependency-check-suppressions-commit.mjs')
   if (target === 'vue-inspector') return runNode('sync-vite-plugin-vue-inspector.mjs')
   if (target === 'all') return runNode('sync-project-configs.mjs')
   console.error(`[fg-devkit] Unknown config sync target: ${target}`)
@@ -547,7 +545,6 @@ const DIRECT_COMMANDS = {
   'prune-release-age-exclude': 'prune-release-age-exclude.mjs',
   'sync-project-configs': 'sync-project-configs.mjs',
   'sync-tooling-configs': 'sync-tooling-configs.mjs',
-  'sync-dependency-check-suppressions-commit': 'sync-dependency-check-suppressions-commit.mjs',
   'sync-vscode-settings': 'sync-vscode-settings.mjs',
   'sync-vite-plugin-vue-inspector': 'sync-vite-plugin-vue-inspector.mjs',
   'sync-consumer-scripts': 'sync-consumer-scripts.mjs',
@@ -611,8 +608,6 @@ Commands:
                                  Report minimumReleaseAgeExclude entries that are no longer needed; --fix removes them; --commit also auto-commits
   sync-project-configs            VS Code + tooling sync (overwrites config files)
   sync-tooling-configs            Tooling sync only (overwrites config files)
-  sync-dependency-check-suppressions-commit [--all]
-                                 Write the dependency-check suppressions that match pnpm audit findings and auto-commit (--all: copy every entry)
   sync-vscode-settings            Copy shared VS Code settings into .vscode/settings.json
   sync-vite-plugin-vue-inspector  Add/pin vite-plugin-vue-inspector, wire vite.config, install, commit
   sync-consumer-scripts           Enforce standard fgd scripts in consumer package.json
@@ -1109,11 +1104,6 @@ async function runInteractiveMenu() {
           { name: 'ESLint', value: 'eslint', description: 'Overwrite eslint.config.js with the shared config' },
           { name: 'Prettier', value: 'prettier', description: 'Overwrite prettier.config.js with the shared config' },
           { name: 'tsconfig', value: 'tsconfig', description: 'Overwrite tsconfig.json with the shared config' },
-          {
-            name: autoCommit('Dependency-Check suppressions'),
-            value: 'dependency-check',
-            description: 'Write the suppressions that match pnpm audit findings',
-          },
           {
             name: autoCommit('Vue inspector'),
             value: 'vue-inspector',

package/scripts/lib/audit-fix-plan.mjs

@@ -537,29 +537,96 @@ export function parseSuppressions(xmlText, now = Date.now()) {
   return entries
 }
 
-/** GHSA id -> `until` for every active `<suppress>` entry. */
-export function activeSuppressedGhsas(xmlText, now = Date.now()) {
-  const covered = new Map()
-  for (const entry of parseSuppressions(xmlText, now)) {
-    if (!entry.active) continue
-    for (const ghsa of entry.ghsas) covered.set(ghsa, entry.until)
-  }
-  return covered
+export const AUTO_SUPPRESSION_MARKER = 'Auto-accepted by fg-devkit'
+export const AUTO_SUPPRESSION_SEVERITIES = new Set(['high', 'critical'])
+export const AUTO_SUPPRESSION_DAYS = 30
+
+const GHSA_PATTERN = /^GHSA-[0-9a-z]{4}-[0-9a-z]{4}-[0-9a-z]{4}$/
+const SUPPRESSIONS_TEMPLATE = [
+  '<?xml version="1.0" encoding="UTF-8"?>',
+  '<suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.3.xsd">',
+  '</suppressions>',
+  '',
+].join('\n')
+
+function escapeRegExp(text) {
+  return text.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')
+}
+
+function renderAutoSuppression(advisory, until) {
+  return [
+    `  <suppress until="${until}">`,
+    '    <notes><![CDATA[',
+    `      ${AUTO_SUPPRESSION_MARKER}: no patched version of ${advisory.name} exists.`,
+    `      ${advisory.ghsa} (${advisory.severity}): ${advisory.title ?? ''}`.trimEnd(),
+    '      Not renewed automatically. To accept the risk for longer, review it and',
+    '      remove the first line of these notes so the entry is kept as written.',
+    '    ]]></notes>',
+    `    <filePath regex="true">.*pnpm-lock\\.yaml\\?${escapeRegExp(advisory.name)}$</filePath>`,
+    `    <vulnerabilityName regex="true">.*${advisory.ghsa}.*</vulnerabilityName>`,
+    '  </suppress>',
+    '',
+  ].join('\n')
 }
 
 /**
- * The shared suppressions file reduced to the active entries that match one of `ghsas`,
- * so a repo only accepts the risks it actually has. Header, namespace and the kept
- * entries are copied verbatim.
+ * The repo's dependency-check-suppressions.xml for the advisories `pnpm audit` still reports.
+ *
+ * Entries already in the file are kept while one of their GHSA ids is still reported, and
+ * dropped otherwise. High and critical advisories with no patched version and no entry are
+ * returned as `candidates`; those whose GHSA id is in `accept` get an auto-accepted entry valid
+ * for AUTO_SUPPRESSION_DAYS. Kept entries are never changed, so an auto-accepted `until` date is
+ * never pushed forward and an expired entry stays expired.
+ *
+ * @param {{ existing?: string, advisories: ReturnType<typeof normalizeAdvisories>, accept?: Set<string>, now?: number }} input
+ * @returns {{ content: string | null, covered: object[], autoAccepted: object[], candidates: object[], uncovered: object[] }}
+ *   `content` is null when no entry applies (the repo needs no file).
  */
-export function filterSuppressions(xmlText, ghsas, now = Date.now()) {
-  const wanted = new Set(ghsas)
-  let result = String(xmlText ?? '')
-  for (const entry of parseSuppressions(result, now)) {
-    if (entry.active && entry.ghsas.some((ghsa) => wanted.has(ghsa))) continue
-    result = result.replace(entry.text, '')
+export function buildRepoSuppressions({ existing, advisories, accept = new Set(), now = Date.now() }) {
+  const reported = new Set(advisories.map((advisory) => advisory.ghsa))
+  const entryByGhsa = new Map()
+  let content = existing ?? SUPPRESSIONS_TEMPLATE
+  let kept = 0
+  for (const entry of parseSuppressions(content, now)) {
+    if (!entry.ghsas.some((ghsa) => reported.has(ghsa))) {
+      content = content.replace(entry.text, '')
+      continue
+    }
+    kept += 1
+    for (const ghsa of entry.ghsas) entryByGhsa.set(ghsa, entry)
   }
-  return result
+  const newUntil = `${new Date(now + AUTO_SUPPRESSION_DAYS * 86400000).toISOString().slice(0, 10)}Z`
+
+  const covered = []
+  const autoAccepted = []
+  const candidates = []
+  const uncovered = []
+  const added = new Map()
+  for (const advisory of advisories) {
+    const entry = entryByGhsa.get(advisory.ghsa)
+    if (entry) {
+      if (!entry.active) uncovered.push(advisory)
+      else if (entry.text.includes(AUTO_SUPPRESSION_MARKER)) autoAccepted.push({ ...advisory, until: entry.until })
+      else covered.push({ ...advisory, until: entry.until })
+      continue
+    }
+    const canAutoAccept =
+      AUTO_SUPPRESSION_SEVERITIES.has(advisory.severity) &&
+      GHSA_PATTERN.test(advisory.ghsa) &&
+      lowestPatchedVersion(advisory.patched, '0.0.0').status === 'none'
+    if (canAutoAccept) candidates.push(advisory)
+    if (!canAutoAccept || !accept.has(advisory.ghsa)) {
+      uncovered.push(advisory)
+      continue
+    }
+    autoAccepted.push({ ...advisory, until: newUntil })
+    if (!added.has(advisory.ghsa)) added.set(advisory.ghsa, renderAutoSuppression(advisory, newUntil))
+  }
+
+  if (kept === 0 && added.size === 0) return { content: null, covered, autoAccepted, candidates, uncovered }
+  const closing = content.lastIndexOf('</suppressions>')
+  content = `${content.slice(0, closing)}${[...added.values()].join('')}${content.slice(closing)}`
+  return { content, covered, autoAccepted, candidates, uncovered }
 }
 
 // ---------------------------------------------------------------------------

package/scripts/lib/audit-fix-plan.test.mjs

@@ -2,18 +2,18 @@ import assert from 'node:assert/strict'
 import test from 'node:test'
 
 import {
-  activeSuppressedGhsas,
   addReleaseAgeExcludes,
   buildRefreshCommitMessage,
+  buildRepoSuppressions,
   bumpDependencySpec,
   compareVersions,
   diffLockfileVersions,
-  filterSuppressions,
   isReleaseAgeExcluded,
   isSameReleaseLine,
   lowestPatchedVersion,
   normalizeAdvisories,
   overrideKey,
+  parseSuppressions,
   planOverrides,
   planReleaseAgeExcludePrune,
   releaseLineFloor,
@@ -383,7 +383,7 @@ test('buildRefreshCommitMessage follows the vuln() convention', () => {
   )
 })
 
-test('activeSuppressedGhsas reads active entries and ignores notes and expired ones', () => {
+test('parseSuppressions reads GHSA ids from matchers only and marks expired entries inactive', () => {
   const xml = `<?xml version="1.0" encoding="UTF-8"?>
 <suppressions>
   <suppress until="2026-12-01Z">
@@ -400,46 +400,69 @@ test('activeSuppressedGhsas reads active entries and ignores notes and expired o
 </suppressions>`
   const now = Date.parse('2026-10-06T12:00:00Z')
   assert.deepEqual(
-    [...activeSuppressedGhsas(xml, now)],
+    parseSuppressions(xml, now).map(({ ghsas, until, active }) => ({ ghsas, until, active })),
     [
-      ['GHSA-vfj7-8cjw-p6xm', '2026-12-01Z'],
-      ['GHSA-aaaa-bbbb-cccc', undefined],
+      { ghsas: ['GHSA-vfj7-8cjw-p6xm'], until: '2026-12-01Z', active: true },
+      { ghsas: ['GHSA-hp3w-g68c-fv3c'], until: '2026-01-01Z', active: false },
+      { ghsas: ['GHSA-aaaa-bbbb-cccc'], until: undefined, active: true },
     ],
   )
-  assert.equal(activeSuppressedGhsas(xml, Date.parse('2026-12-02T00:00:00Z')).has('GHSA-vfj7-8cjw-p6xm'), false)
+  assert.equal(parseSuppressions(xml, Date.parse('2026-12-02T00:00:00Z'))[0].active, false)
 })
 
-test('filterSuppressions keeps only active entries that match the repo findings', () => {
-  const xml = [
+test('buildRepoSuppressions keeps reported entries and adds accepted unpatched high and critical findings', () => {
+  const now = Date.parse('2026-11-03T12:00:00Z')
+  const finding = (ghsa, name, severity, patched) => ({ ...advisory({ name, ghsa, patched, versions: ['1.0.0'] }), severity })
+  const existing = [
     '<?xml version="1.0" encoding="UTF-8"?>',
     '<suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.3.xsd">',
     '  <suppress until="2026-12-01Z">',
-    '    <notes><![CDATA[ braces ]]></notes>',
-    '    <vulnerabilityName regex="true">.*(GHSA-vfj7-8cjw-p6xm|1240992).*</vulnerabilityName>',
+    '    <vulnerabilityName regex="true">.*(GHSA-vfj7-8cjw-p6xm).*</vulnerabilityName>',
     '  </suppress>',
     '  <suppress until="2026-12-01Z">',
-    '    <notes><![CDATA[ sprintf-js ]]></notes>',
     '    <vulnerabilityName regex="true">.*(GHSA-hp3w-g68c-fv3c).*</vulnerabilityName>',
     '  </suppress>',
     '</suppressions>',
     '',
   ].join('\n')
-  const now = Date.parse('2026-10-06T12:00:00Z')
-  assert.equal(
-    filterSuppressions(xml, ['GHSA-vfj7-8cjw-p6xm'], now),
-    [
-      '<?xml version="1.0" encoding="UTF-8"?>',
-      '<suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.3.xsd">',
-      '  <suppress until="2026-12-01Z">',
-      '    <notes><![CDATA[ braces ]]></notes>',
-      '    <vulnerabilityName regex="true">.*(GHSA-vfj7-8cjw-p6xm|1240992).*</vulnerabilityName>',
-      '  </suppress>',
-      '</suppressions>',
-      '',
-    ].join('\n'),
+  const findings = [
+    finding('GHSA-vfj7-8cjw-p6xm', 'braces', 'high', '<0.0.0'),
+    finding('GHSA-aaaa-bbbb-cccc', '@scope/pkg.js', 'critical', '<0.0.0'),
+    finding('GHSA-dddd-eeee-ffff', 'moderate-pkg', 'moderate', '<0.0.0'),
+    finding('GHSA-gggg-hhhh-iiii', 'fixable', 'high', '>=2.0.0'),
+  ]
+  const unaccepted = buildRepoSuppressions({ existing, advisories: findings, now })
+  assert.deepEqual(
+    unaccepted.candidates.map((item) => item.ghsa),
+    ['GHSA-aaaa-bbbb-cccc'],
   )
-  // Expired entries are dropped even when they match.
-  assert.doesNotMatch(filterSuppressions(xml, ['GHSA-vfj7-8cjw-p6xm'], Date.parse('2026-12-02T00:00:00Z')), /GHSA-vfj7/)
+  assert.equal(unaccepted.autoAccepted.length, 0)
+  assert.doesNotMatch(unaccepted.content, /GHSA-aaaa/)
+
+  const first = buildRepoSuppressions({ existing, advisories: findings, accept: new Set(['GHSA-aaaa-bbbb-cccc']), now })
+  assert.deepEqual(
+    first.covered.map((item) => item.ghsa),
+    ['GHSA-vfj7-8cjw-p6xm'],
+  )
+  assert.deepEqual(
+    first.autoAccepted.map((item) => [item.ghsa, item.until]),
+    [['GHSA-aaaa-bbbb-cccc', '2026-12-03Z']],
+  )
+  assert.deepEqual(
+    first.uncovered.map((item) => item.ghsa),
+    ['GHSA-dddd-eeee-ffff', 'GHSA-gggg-hhhh-iiii'],
+  )
+  assert.doesNotMatch(first.content, /GHSA-hp3w/)
+  assert.match(first.content, /pnpm-lock\\.yaml\\\?@scope\/pkg\\.js\$/)
+
+  const later = buildRepoSuppressions({ existing: first.content, advisories: findings, now: now + 10 * 86400000 })
+  assert.equal(later.content, first.content)
+  const expired = buildRepoSuppressions({ existing: first.content, advisories: findings, now: now + 40 * 86400000 })
+  assert.equal(expired.content, first.content)
+  assert.equal(expired.autoAccepted.length, 0)
+
+  assert.equal(buildRepoSuppressions({ existing: first.content, advisories: [], now }).content, null)
+  assert.equal(buildRepoSuppressions({ advisories: [findings[2]], now }).content, null)
 })
 
 test('planReleaseAgeExcludePrune drops versions that are old enough or no longer installed', () => {

package/configs/dependency-check-suppressions.xml

@@ -1,36 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.3.xsd">
-  <suppress until="2026-12-01Z">
-    <notes><![CDATA[
-      braces <= 3.0.3 — GHSA-vfj7-8cjw-p6xm (stack exhaustion via deeply nested patterns).
-      No patched release exists; 3.0.3 is the latest version.
-      Transitive devDependency only, via fast-glob and micromatch
-      (@intlify/unplugin-vue-i18n and fg-devkit). Not shipped in the app runtime.
-      Risk accepted until braces publishes a release after 3.0.3.
-
-      pnpm audit paths do not equal the module name, so Dependency-Check creates
-      a virtual dependency at pnpm-lock.yaml?braces with no package URL version.
-      Jenkins shows the id as NPMGHSA-vfj7-8cjw-p6xm (source NPM + GHSA id).
-      Older analyzers may use the numeric advisory id 1240992.
-    ]]></notes>
-    <filePath regex="true">.*pnpm-lock\.yaml\?braces$</filePath>
-    <vulnerabilityName regex="true">.*(GHSA-vfj7-8cjw-p6xm|1240992).*</vulnerabilityName>
-  </suppress>
-  <suppress until="2026-12-01Z">
-    <notes><![CDATA[
-      sprintf-js <=1.1.3 — GHSA-hp3w-g68c-fv3c / CVE-2026-97058 (denial of service
-      through unbounded precision specifiers). No patched release exists; 1.1.3
-      is the latest version. Transitive optional devDependency only, via
-      vite-plugin-dts > @microsoft/api-extractor > @rushstack/ts-command-line >
-      argparse. Not shipped in the library runtime. Risk accepted until
-      sprintf-js publishes a release after 1.1.3.
-
-      pnpm audit paths do not equal the module name, so Dependency-Check creates
-      a virtual dependency at pnpm-lock.yaml?sprintf-js with no package URL version.
-      Jenkins shows the id as NPMGHSA-hp3w-g68c-fv3c (source NPM + GHSA id).
-      Older analyzers may use the numeric advisory id 1241202.
-    ]]></notes>
-    <filePath regex="true">.*pnpm-lock\.yaml\?sprintf-js$</filePath>
-    <vulnerabilityName regex="true">.*(GHSA-hp3w-g68c-fv3c|CVE-2026-97058|1241202).*</vulnerabilityName>
-  </suppress>
-</suppressions>

package/scripts/sync-dependency-check-suppressions-commit.mjs

@@ -1,110 +0,0 @@
-#!/usr/bin/env node
-/**
- * Write dependency-check-suppressions.xml into the consumer repo and auto-commit.
- *
- * Only the active <suppress> entries from fg-devkit's shared file that match a finding
- * `pnpm audit` still reports in this repo are written, so OWASP Dependency-Check accepts
- * exactly the risks this repo has. Pass --all to copy the whole shared file instead.
- *
- * Usage:
- *   node node_modules/fg-devkit/scripts/sync-dependency-check-suppressions-commit.mjs [--all]
- *   pnpm exec fg-devkit sync-dependency-check-suppressions-commit [--all]
- */
-
-import fs from 'node:fs'
-import path from 'node:path'
-import { spawnSync } from 'node:child_process'
-import { parseArgs } from 'node:util'
-import { filterSuppressions, normalizeAdvisories, parseAuditJson, parseSuppressions } from './lib/audit-fix-plan.mjs'
-import { fileDiffersFromHead, findFgDevkitPackageRoot, runGit } from './lib/common.mjs'
-
-const TAG = '[sync-dependency-check-suppressions]'
-const FILE_NAME = 'dependency-check-suppressions.xml'
-const COMMIT_MESSAGE = 'chore(repo): sync dependency-check suppressions'
-const projectRoot = process.cwd()
-const GIT = { cwd: projectRoot, tag: TAG }
-
-const { values: args } = parseArgs({
-  options: {
-    all: { type: 'boolean', default: false },
-    help: { type: 'boolean', short: 'h', default: false },
-  },
-  strict: true,
-})
-
-if (args.help) {
-  console.log(`Usage: pnpm exec fg-devkit sync-dependency-check-suppressions-commit [--all]
-
-Writes ${FILE_NAME} with the entries from fg-devkit that match findings
-pnpm audit reports in this repo, and auto-commits it.
-
-  --all   Copy every entry from fg-devkit's shared file (no pnpm audit)`)
-  process.exit(0)
-}
-
-/** GHSA ids `pnpm audit` reports in this repo. Exits on audit failure so nothing is written blindly. */
-function reportedGhsas() {
-  const result = spawnSync('pnpm', ['audit', '--json'], {
-    cwd: projectRoot,
-    env: process.env,
-    encoding: 'utf8',
-    maxBuffer: 50 * 1024 * 1024,
-  })
-  if (result.error || (result.status !== 0 && result.status !== 1)) {
-    console.error(`${TAG} pnpm audit failed, ${FILE_NAME} was not changed.`)
-    console.error((result.error?.message ?? result.stderr ?? result.stdout ?? '').trim())
-    process.exit(1)
-  }
-  return new Set(normalizeAdvisories(parseAuditJson(result.stdout)).map((advisory) => advisory.ghsa))
-}
-
-const fgRoot = findFgDevkitPackageRoot(projectRoot)
-if (!fgRoot) {
-  console.error(`${TAG} Could not find fg-devkit (install fg-devkit or a package that bundles it, e.g. fds-vue-core).`)
-  process.exit(1)
-}
-
-const sourcePath = path.join(fgRoot, 'configs', FILE_NAME)
-if (!fs.existsSync(sourcePath)) {
-  console.error(`${TAG} Missing template: ${sourcePath}`)
-  process.exit(1)
-}
-
-const shared = fs.readFileSync(sourcePath, 'utf8')
-const targetPath = path.join(projectRoot, FILE_NAME)
-let content = shared
-
-if (!args.all) {
-  console.log(`${TAG} Running pnpm audit to find the entries that apply to this repo…`)
-  const reported = reportedGhsas()
-  const now = Date.now()
-  const kept = parseSuppressions(shared, now).filter(
-    (entry) => entry.active && entry.ghsas.some((ghsa) => reported.has(ghsa)),
-  )
-  content = filterSuppressions(shared, reported, now)
-
-  if (kept.length === 0 && !fs.existsSync(targetPath)) {
-    console.log(`${TAG} No shared suppression applies to this repo. ${FILE_NAME} not created.`)
-    process.exit(0)
-  }
-  const keptIds = kept.flatMap((entry) => entry.ghsas).filter((ghsa) => reported.has(ghsa))
-  console.log(
-    kept.length > 0
-      ? `${TAG} Keeping ${kept.length} entr${kept.length === 1 ? 'y' : 'ies'}: ${keptIds.join(', ')}`
-      : `${TAG} No shared suppression applies to this repo. Writing ${FILE_NAME} without entries.`,
-  )
-}
-
-fs.writeFileSync(targetPath, content)
-console.log(`${TAG} Updated ${FILE_NAME}.`)
-
-if (!fileDiffersFromHead(FILE_NAME, GIT)) {
-  console.log(`${TAG} No changes to commit.`)
-  process.exit(0)
-}
-
-const stage = runGit(['add', '--', FILE_NAME], GIT)
-if (stage.status !== 0) process.exit(stage.status)
-
-console.log(`${TAG} Auto-committing: ${COMMIT_MESSAGE}`)
-process.exit(runGit(['commit', '-m', COMMIT_MESSAGE], GIT).status)