chore(ci): point Dependabot at development, where the gates actually run by rubenvdlinde · Pull Request #445 · ConductionNL/stackiq

rubenvdlinde · 2026-08-06T11:16:27Z

The problem

Dependabot targets the repository default branch, which here is main. main is 729 commits behind development and carries a completely different lockfile.

Two consequences, both bad:

1. The alert list measures the wrong tree. The reported backlog for this repo was ~151 vulnerabilities / 5 critical. Measured against development:

ecosystem	critical	high	moderate	low
composer	0	0	0	0
npm	1	2	5	5

The critical twig/twig < 3.26.0 alert is moot on development — it is on 3.27.0. Same story across the fleet: every Conduction repo shows zero composer advisories on development.

2. The PRs were ungated. Dependabot PRs #368 and #369 collected no check runs at all beyond a neutral CodeQL:

$ gh api /repos/.../commits/<head>/check-runs --jq .total_count
1
  CodeQL completed neutral

main still carries the old self-contained code-quality.yml, while development uses the shared quality workflow. A dependency PR that nothing builds is precisely how this fleet previously shipped an unbuildable image for two months.

The change

target-branch: development on npm.
Adds the missing composer ecosystem — it had no entry at all, so its only PRs were security updates against main.
Adds github-actions.

Trade-off, stated explicitly

GitHub only raises Dependabot security updates against the default branch, so target-branch converts these into version updates. That is a net gain: a version update on development is verified and mergeable; a security update on a 729-commit-dead main was neither. The alert list still tracks main and will shrink as development is released forward.

Matches the convention already in place on nldesign, decidesk, openbuild, procest and shillinq.

Companion to #443 (which clears every critical and high npm advisory on development).

Dependabot targeted the DEFAULT branch `main`, which is 729 commits behind `development` and carries a different lockfile. Two consequences, both bad: 1. The alert list measured the wrong tree. Open alerts claimed 5 critical / 51 high; `development` actually had 1 critical / 2 high on npm and ZERO composer advisories (the critical twig/twig <3.26.0 alert is moot there — development is on 3.27.0). 2. The PRs were ungated. #368 and #369 collected no check runs at all beyond a neutral CodeQL, because `main` still carries the old self-contained code-quality workflow. An unverified dependency PR is how this fleet previously shipped an unbuildable image for two months. Also adds the missing composer and github-actions ecosystems — composer had no entry, so its only PRs were security updates against main. Trade-off is stated in the file: security updates only ever target the default branch, so these become version updates. A verified version update on development beats an unmergeable security update on a dead main.

OS command injection in PHP_CodeSniffer, GHSA-hmqg-cxww-wqhq, reported 2026-08-05. Affected: <3.13.6 | >=4.0.0,<4.0.2. This repo was on 3.13.5. The advisory landed mid-review: this PR's own 'Security (composer)' leg PASSED earlier today and the same leg on #445 then FAILED, on a config-only change. The audit DB is live, so a composer.lock that was clean this morning is not clean now — 'composer audit --locked' returned zero advisories for this repo an hour before it returned this one. Fleet-wide: all 16 checked repos are on 3.13.5 and are equally affected. Verified - composer audit --locked: 'No security vulnerability advisories found' (was 1). - vendor/bin/phpcs --version -> 3.13.6. - composer phpcs: rc=0, unchanged findings. - Positive control: a deliberately non-conforming file under lib/ made phpcs exit 2 with 13 findings, so the green above is a real pass and not a checker that silently no-ops. Probe file removed; only composer.lock is modified.

github-actions · 2026-08-06T11:26:01Z

Quality Report — ConductionNL/softwarecatalog @ `7ab245d`

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-manifest		✅
check-vue-demi		✅
test-l10n		✅
composer			❌	✅ 121/121
npm			✅	✅ 849/849
PHPUnit					⏭️
Newman					⏭️
Playwright					⏭️
Hydra gates					✅

Quality workflow — 2026-08-06 11:25 UTC

Download the full PDF report from the workflow artifacts.

…443) * chore(deps): clear all critical + high npm advisories on development Measured state of `development` (npm audit --package-lock-only), NOT the 154 Dependabot alerts, which are computed against the DEFAULT branch `main` — 729 commits behind and carrying a different lockfile entirely. Before: 1 critical, 2 high, 5 moderate, 5 low (13). composer: 0. After: 0 critical, 0 high, 3 moderate, 6 low (9). Bumps - vitest 1.6.1 -> 3.2.7 and @vitest/coverage-v8 to match. Clears the critical (Vitest UI server arbitrary file read/exec, <=3.2.5) and pulls vite 5.4.21 -> 7.3.6, vite-node -> 3.2.4, esbuild 0.21.5 -> 0.28.1, clearing the high (vite path traversal / fs.deny bypass) and two moderates. npm audit proposed vitest@4; 3.2.7 is outside every advisory range and is one major less disruptive. - @cyclonedx/cyclonedx-npm 4.2.1 -> 6.0.0. Clears the high (shell injection via unsanitised --workspace). This repo passes no --workspace, so it was not reachable, but the SBOM step runs the local binary so the bump is exercised. - node-polyfill-webpack-plugin 3.0.0 -> 4.1.0 (maintained line). Drop the blanket `minimatch: ^3.1.2` override That override existed to silence old minimatch advisories. It forced v3 on EVERY consumer, and test-exclude@7 (new, via coverage-v8 3.x) does `const { minimatch } = require('minimatch')` — the v10 named export — so v3's bare-function export destructured to undefined and `npm run test:coverage` died with "minimatch is not a function". Removing the override lets each consumer resolve its own (test-exclude 10.2.6, others 9.0.9, root 3.1.5); nothing in the tree resolves below the 3.1.2 ReDoS fix. Verified (node 22 local; CI is node 20/npm 10.8.2) - npx npm@10.8.2 ci: rc=0; lockfile byte-identical afterwards. npm 11 ci also ok. - vitest 210/210 pass; jest 120/120 pass. - test:coverage rc=0; ratchet rc=0 (vitest baseline is null/unseeded). - npm run build: webpack compiled, 3 pre-existing warnings, 0 errors. - npm run lint: 0 errors (355 pre-existing warnings, unchanged). - check:manifest, check:vue-demi, test:l10n: rc=0. - Exact CI SBOM command under cyclonedx 6.0.0: rc=0, valid CycloneDX specVersion 1.5, 814 components. - Licences read from the LOCKFILE: all bumps MIT except cyclonedx (Apache-2.0). vue3-apexcharts stays 1.8.0 MIT, pinned ~1.8.0 by @conduction/nextcloud-vue, so it cannot drift into the proprietary 1.9.0 line. Untouched by this change. NOT fixed here, deliberately - dompurify (3 moderate): @toast-ui/editor INLINES DOMPurify 2.3.3 into its own dist and never require()s the dompurify package — confirmed in js/softwarecatalog-main.js.LICENSE.txt. The flagged node_modules/@toast-ui/editor/node_modules/dompurify@2.5.9 is installed but never loaded. An npm override would turn the audit green and change nothing that ships. toast-ui 3.2.2 (latest) still depends on dompurify ^2.3.3, so there is no upstream fix. Needs a real remediation, filed separately. - elliptic/browserify-sign/create-ecdh/crypto-browserify/node-stdlib-browser (6 low): reachable only through node-polyfill-webpack-plugin, whose plugin instance is discarded — webpack.config.js REPLACES the plugins array from @nextcloud/webpack-vue-config. No polyfill lands in the bundle (no elliptic in js/*.js). The package cannot simply be dropped: webpack-vue-config require()s it at module load without declaring it. * fix(deps): squizlabs/php_codesniffer 3.13.5 -> 3.13.6 (CVE-2026-67434) OS command injection in PHP_CodeSniffer, GHSA-hmqg-cxww-wqhq, reported 2026-08-05. Affected: <3.13.6 | >=4.0.0,<4.0.2. This repo was on 3.13.5. The advisory landed mid-review: this PR's own 'Security (composer)' leg PASSED earlier today and the same leg on #445 then FAILED, on a config-only change. The audit DB is live, so a composer.lock that was clean this morning is not clean now — 'composer audit --locked' returned zero advisories for this repo an hour before it returned this one. Fleet-wide: all 16 checked repos are on 3.13.5 and are equally affected. Verified - composer audit --locked: 'No security vulnerability advisories found' (was 1). - vendor/bin/phpcs --version -> 3.13.6. - composer phpcs: rc=0, unchanged findings. - Positive control: a deliberately non-conforming file under lib/ made phpcs exit 2 with 13 findings, so the green above is a real pass and not a checker that silently no-ops. Probe file removed; only composer.lock is modified.

…ot-target-development

github-actions · 2026-08-06T12:08:04Z

Quality Report — ConductionNL/softwarecatalog @ `adb6c26`

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-manifest		✅
check-vue-demi		✅
test-l10n		✅
composer			✅	✅ 121/121
npm			✅	✅ 853/853
PHPUnit					✅
Newman					⏭️
Playwright					✅
Hydra gates					✅

Quality workflow — 2026-08-06 12:08 UTC

Download the full PDF report from the workflow artifacts.

This was referenced Aug 6, 2026

chore(deps): Bump the npm_and_yarn group across 1 directory with 13 updates #276

Closed

chore(deps): bump the npm_and_yarn group across 1 directory with 15 updates #368

Closed

chore(deps): bump the composer group across 1 directory with 8 updates #369

Closed

Merge remote-tracking branch 'origin/development' into chore/dependab…

6932103

…ot-target-development

rubenvdlinde merged commit 8f14a11 into development Aug 6, 2026
29 checks passed

rubenvdlinde deleted the chore/dependabot-target-development branch August 6, 2026 12:27

Navigation Menu

Uh oh!

chore(ci): point Dependabot at development, where the gates actually run - #445

chore(ci): point Dependabot at development, where the gates actually run#445
rubenvdlinde merged 2 commits into
developmentfrom
chore/dependabot-target-development

rubenvdlinde commented Aug 6, 2026

Uh oh!

github-actions Bot commented Aug 6, 2026

Uh oh!

github-actions Bot commented Aug 6, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

rubenvdlinde commented Aug 6, 2026

The problem

The change

Trade-off, stated explicitly

Uh oh!

github-actions Bot commented Aug 6, 2026

Quality Report — ConductionNL/softwarecatalog @ 7ab245d

Uh oh!

github-actions Bot commented Aug 6, 2026

Quality Report — ConductionNL/softwarecatalog @ adb6c26

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Quality Report — ConductionNL/softwarecatalog @ `7ab245d`

Quality Report — ConductionNL/softwarecatalog @ `adb6c26`