security-updates

name	security-updates
description	Check and apply security updates across the photofield project (api/Go, ui/npm, docs/npm, e2e/npm). Use when the user asks to update dependencies, patch vulnerabilities, run a security audit, or check for breakage from version upgrades.
version	1.0.0
platforms	["linux"]

Security Updates for Photofield

The project has four dependency trees to audit:

Area	Type	Package File
api	Go	go.mod / go.sum
ui	npm	ui/package.json
docs	npm	docs/package.json
e2e	npm	e2e/package.json

Process

Step 1: Scan current state

go version
govulncheck ./... 2>&1
cd ui && npm audit 2>&1
cd ../docs && npm audit 2>&1
cd ../e2e && npm audit 2>&1

Record before-counts for the final report.

Step 2: Apply updates per area

API (Go)

cd <root>
go get -u go
go get -u ./...
go mod tidy
govulncheck ./... 2>&1 | grep -E "(vulnerabilit|affected)"

• Go stdlib upgrades require toolchain goX.Y.Z in go.mod to auto-download.

UI / Docs / E2E (npm)

cd <area>
npm audit 2>&1
npm install <pkg>@latest

If transitive dependencies (e.g. esbuild, postcss, rollup) have vulns with no fix in their own tree, add an overrides field to package.json:

"overrides": { "<package>": "<version>" }

Always run npm audit again to verify.

Step 3: Build verification

All areas must build cleanly:

go build ./... && go test ./... -short 2>&1
cd ui && npx vite build 2>&1
cd ../docs && npx vitepress build 2>&1
cd ../e2e && npx playwright test 2>&1

Non-blocking warnings to ignore:

• govulncheck reporting vulns in imported packages not called by code
• Chunk size warnings
• Tree-shaking annotation warnings from transitive dependencies

Step 4: Final audit report

echo "=== API ==="; go version && govulncheck ./... 2>&1 | grep -E "(vulnerabilit|affected|No vulnerabilities)"
echo "=== UI ==="; cd ui && npm audit 2>&1
echo "=== DOCS ==="; cd ../docs && npm audit 2>&1
echo "=== E2E ==="; cd ../e2e && npm audit 2>&1

Report as a table:

| Area | Before | After | Status |
|------|--------|-------|--------|
| API (Go) | X | Y | ✅/⚠️ |
| UI (npm) | X | Y | ✅/⚠️ |
| DOCS (npm) | X | Y | ✅/⚠️ |
| E2E (npm) | X | Y | ✅/⚠️ |

Step 5: Commit

cd <root>
git add -A
git status
git diff --cached --stat
git commit -m "chore: apply security updates"

One commit per logical change (e.g. one for Go, one for npm areas).

Step 6: Document remaining vulnerabilities

For any vulns that could not be fixed, note why:

| Area | Vulns | Reason |
|------|-------|--------|
| UI | 1 low | Upstream — latest package version has no patch |
| Docs | 3 | Locked by transitive dependency chain — fix in newer major version |

Important Notes

• Always run govulncheck and all builds after changes.
• Work on the security-update branch.
• Accept breaking API changes in tests or build tools when they resolve critical vulns.
• Document unfixable vulns and whether a newer major version (alpha/beta) resolves them — but do not upgrade to alpha/beta unless explicitly requested.