Problem
The required security-audit gate (and its audit-lockfile matrix) is failing on every open PR because newly-disclosed high-severity advisories in shared lockfiles are not yet baselined or patched. The gate job reports:
Required PR gates did not pass: biome,security-audit
audit-lockfile (root) reports 3 unbaselined high+ production advisories in package-lock.json:
audit-lockfile also fails for blog-site, pro-test, and scripts lockfiles (root/blog-site/pro-test/scripts red; consumer-prices-core/docker-runtime green).
Why this is untracked / not PR-specific
These are transitive dependencies. They surface on any PR re-run today regardless of the PR's diff — e.g. PR #5393 (an analytics-only change touching 3 non-lockfile files) fails security-audit identically. Older PR runs (e.g. #5371) show the audit green only because they ran before the advisories were published.
Remediation
npm audit reports fix available via npm audit fix for all three (no --force, so semver-compatible, non-breaking):
Impact
Blocks merge of all open PRs until resolved. Best fixed in one dedicated lockfile-remediation PR rather than bundled into unrelated feature/fix branches (avoids cross-PR lockfile conflicts across the active worktrees).
Problem
The required
security-auditgate (and itsaudit-lockfilematrix) is failing on every open PR because newly-disclosed high-severity advisories in shared lockfiles are not yet baselined or patched. The gate job reports:audit-lockfile (root)reports 3 unbaselined high+ production advisories inpackage-lock.json:parse(){}expansionaudit-lockfilealso fails forblog-site,pro-test, andscriptslockfiles (root/blog-site/pro-test/scripts red; consumer-prices-core/docker-runtime green).Why this is untracked / not PR-specific
These are transitive dependencies. They surface on any PR re-run today regardless of the PR's diff — e.g. PR #5393 (an analytics-only change touching 3 non-lockfile files) fails
security-auditidentically. Older PR runs (e.g. #5371) show the audit green only because they ran before the advisories were published.Remediation
npm auditreportsfix available via npm audit fixfor all three (no--force, so semver-compatible, non-breaking):npm audit fixin the repo root (and inblog-site/,pro-test/,scripts/), committing only the resultingpackage-lock.jsonchanges.BASELINE_ADVISORIES_BY_LOCKFILEin.github/scripts/audit-production-dependencies.mjswould suppress fixable high-severity DoS advisories and should be reserved for advisories with no upstream fix (the [SECURITY] consumer-prices-core: zlib1g integer-overflow CVE has no Debian fix — accept-risk vs. rebuild decision #4364 zlib pattern).Impact
Blocks merge of all open PRs until resolved. Best fixed in one dedicated lockfile-remediation PR rather than bundled into unrelated feature/fix branches (avoids cross-PR lockfile conflicts across the active worktrees).