security-updates

# Security Updates for Photofield The project has four dependency trees to audit: | Area | Type | Package File | |------|------|-------------| | **api** | Go | `go.mod` / `go.sum` | | **ui** | npm | `ui/package.json` | | **docs** | npm | `docs/package.json` | | **e2e** | npm | `e2e/package.json` | ## Process ### Step 1: Scan current state ```bash go version govulncheck ./... 2>&1 cd ui && npm audit 2>&1 cd ../docs && npm audit 2>&1 cd ../e2e && npm audit 2>&1 ``` Record before-counts for the final report. ### Step 2: Apply updates per area #### API (Go) ```bash cd <root> go get -u go go get -u ./... go mod tidy govulncheck ./... 2>&1 | grep -E "(vulnerabilit|affected)" ``` - Go stdlib upgrades require `toolchain goX.Y.Z` in `go.mod` to auto-download. #### UI / Docs / E2E (npm) ```bash cd <area> npm audit 2>&1 npm install <pkg>@latest ``` If transitive dependencies (e.g. `esbuild`, `postcss`, `rollup`) have vulns with no fix in their own tree, add an `overrides` field to `package.json`: ```json "overrides": { "<package>": "<version>" } ``` Always run `npm audit` again to verify. ### Step 3: Build verification All areas must build cleanly: ```bash go build ./... && go test ./... -short 2>&1 cd ui && npx vite build 2>&1 cd ../docs && npx vitepress build 2>&1 cd ../e2e && npx playwright test 2>&1 ``` Non-blocking warnings to ignore: - `govulncheck` reporting vulns in imported packages not called by code - Chunk size warnings - Tree-shaking annotation warnings from transitive dependencies ### Step 4: Final audit report ```bash echo "=== API ==="; go version && govulncheck ./... 2>&1 | grep -E "(vulnerabilit|affected|No vulnerabilities)" echo "=== UI ==="; cd ui && npm audit 2>&1 echo "=== DOCS ==="; cd ../docs && npm audit 2>&1 echo "=== E2E ==="; cd ../e2e && npm audit 2>&1 ``` Report as a table: ``` | Area | Before | After | Status | |------|--------|-------|--------| | API (Go) | X | Y | ✅/⚠️ | | UI (npm) | X | Y | ✅/⚠️ | | DOCS (npm) | X | Y | ✅/⚠️ | | E2E (npm) | X | Y | ✅/⚠️ | ``` ### Step 5: Commit ```bash cd <root> git add -A git status git diff --cached --stat git commit -m "chore: apply security updates" ``` One commit per logical change (e.g. one for Go, one for npm areas). ### Step 6: Document remaining vulnerabilities For any vulns that could not be fixed, note why: ```markdown | Area | Vulns | Reason | |------|-------|--------| | UI | 1 low | Upstream — latest package version has no patch | | Docs | 3 | Locked by transitive dependency chain — fix in newer major version | ``` ## Important Notes - Always run `govulncheck` and all builds after changes. - Work on the `security-update` branch. - Accept breaking API changes in tests or build tools when they resolve critical vulns. - Document unfixable vulns and whether a newer major version (alpha/beta) resolves them — but do not upgrade to alpha/beta unless explicitly requested.