Build/runtime hardening and dependency security updates by toasterbook88 · Pull Request #286 · koala73/worldmonitor

toasterbook88 · 2026-02-24T00:19:45Z

This PR batches maintenance work validated locally:

Simplify RSS freshness update to static import
Refine Vite vendor chunking for map stack and reduce chunk warning noise
Shim Node child_process paths for browser bundling warnings
Filter the known third-party onnxruntime eval warning to keep build logs actionable
Patch transitive fast-xml-parser vulnerability via npm override

Validation run:

npm run typecheck
npm run build
npm audit (0 vulnerabilities)
npm run test:sidecar
npm run test:e2e:runtime
npm run test:e2e:full
npm run test:e2e:tech
npm run test:e2e:visual:full
npm run test:e2e:visual:tech

vercel · 2026-02-24T00:19:49Z

@toasterbook88 is attempting to deploy a commit to the Elie Team on Vercel.

A member of the Team first needs to authorize it.

Copilot

Pull request overview

This PR hardens the build/runtime pipeline by reducing noisy Vite build warnings, adding browser shims for Node-only transitive imports, simplifying RSS freshness tracking, and patching a transitive dependency vulnerability via npm overrides.

Changes:

Add Vite aliases and browser shim modules to avoid child_process-related bundler warnings from transitive dependencies.
Refine Rollup manual chunking for ML and geospatial (map/deck) dependencies and raise the chunk-size warning threshold.
Replace a dynamic import in RSS freshness tracking with a static import, and add an npm override to force a patched fast-xml-parser.

Reviewed changes

Copilot reviewed 5 out of 6 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
vite.config.ts	Adds aliases for Node-only modules, tunes chunking strategy, and reduces chunk-size warning noise.
src/shims/child-process.ts	Introduces a browser-safe shim for Node’s `child_process` import surface.
src/shims/child-process-proxy.ts	Shims loaders.gl’s Node-only ChildProcessProxy to prevent browser build warnings.
src/services/rss.ts	Simplifies freshness recording by switching to a static `dataFreshness` import.
package.json	Adds an npm override to force a patched `fast-xml-parser` version.
package-lock.json	Locks updated transitive versions (`fast-xml-parser`, `strnum`) consistent with the override.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-02-24T00:22:48Z

    "youtubei.js": "^16.0.1"
+  },
+  "overrides": {
+    "fast-xml-parser": "^5.3.6"


The override uses a caret range (^5.3.6), which means a future npm install could pick up a newer (untested) fast-xml-parser 5.x version and change the dependency graph unexpectedly. If the goal is specifically to pin a patched version for a known vulnerability, consider overriding to an exact version (e.g. the lockfile’s 5.3.7) for maximum reproducibility.

Suggested change

"fast-xml-parser": "^5.3.6"

"fast-xml-parser": "5.3.7"

Copilot · 2026-02-24T00:22:48Z

+export function spawn(): never {
+  throw new Error('child_process.spawn is not available in browser environments.');
+}
+
+export default { spawn };


The shimmed spawn export has a zero-arg signature, which is narrower than Node’s child_process.spawn and can break type-checking (or runtime call sites) if any dependency calls it with arguments. Consider accepting the usual (command, args?, options?) (or a ..._args: unknown[] rest param) and still throwing, so the shim is drop-in compatible while remaining browser-safe.

Copilot · 2026-02-24T00:22:49Z

+  async start(): Promise<{}> {
+    throw new Error('ChildProcessProxy is not available in browser environments.');
+  }
+
+  async stop(): Promise<void> {}
+
+  async exit(_statusCode: number = 0): Promise<void> {}


ChildProcessProxy.start() is declared as Promise<{}> but always throws, and stop()/exit() are currently silent no-ops. To avoid masking unexpected runtime usage (and to make the type contract clearer), consider making all three methods throw with a Promise<never>/never-style return (or at least have stop/exit throw as well).

Suggested change

async start(): Promise<{}> {

throw new Error('ChildProcessProxy is not available in browser environments.');

}

async stop(): Promise<void> {}

async exit(_statusCode: number = 0): Promise<void> {}

async start(): Promise<never> {

throw new Error('ChildProcessProxy is not available in browser environments.');

}

async stop(): Promise<never> {

throw new Error('ChildProcessProxy is not available in browser environments.');

}

async exit(_statusCode: number = 0): Promise<never> {

throw new Error('ChildProcessProxy is not available in browser environments.');

}

toasterbook88 · 2026-02-24T01:00:09Z

FYI: the only failing checks on this PR are Vercel authorization contexts (external to code changes in this fork).\n\nLocal validation for this branch is green:\n- npm run typecheck\n- npm run build\n- npm audit (0 vulnerabilities)\n- npm run test:sidecar\n- npm run test:e2e:runtime\n- npm run test:e2e:full\n- npm run test:e2e:tech\n- npm run test:e2e:visual:full\n- npm run test:e2e:visual:tech

toasterbook88 · 2026-02-24T02:03:47Z

Triage note (February 24, 2026): current failing checks on this PR are Vercel authorization status contexts (Vercel - worldmonitor variants) rather than code or test failures. The same pattern appears across multiple open PRs, so this likely needs repo or team-level Vercel GitHub integration reauthorization to unblock checks globally.

toasterbook88 · 2026-02-24T02:08:18Z

Validation note (February 24, 2026): local build passes on this branch (npm run build succeeded: tsc && vite build, 0 errors). Remaining blockers appear to be (1) branch conflict against current base and (2) Vercel authorization status-context failures.

vercel · 2026-02-24T08:02:47Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
worldmonitor	Ready	Preview, Comment	Feb 24, 2026 8:03am

toasterbook88 · 2026-02-24T16:35:08Z

Update (February 24, 2026): rebased this PR branch onto current base branch, resolved conflicts, and force-pushed branch codex/noninterfering-maint-20260224 to c0214d9. Local validation: npm run build passes. Remaining check failures are still Vercel authorization contexts.

## What's Changed ### Performance - perf: defer YouTube/map init and stagger data loads to reduce blocking time (#287) ### Features - feat: universal country detection — CII scoring for all countries (#344) - feat: add Mexico as CII hotspot for cartel/security monitoring (#327) - feat: add Mexico and LatAm security feeds for instability coverage (#325) - feat: add category pills and search filter to Panels tab (#322) - feat: consolidate settings into unified tabbed modal (#319) - feat: add Island Times (Palau) RSS feed (#317) - feat: add AI Flow settings popup for web-only AI provider control (#314) - feat: optional channels with tab-based region browse UI (#295) - feat: custom channel management (#282) - feat: add Bild RSS feed scoped to German locale (#312) ### Bug Fixes - fix: suppress notification sound when popup alerts are disabled - fix: prevent entity conflation in pane summarization (#341) - fix: add Mexico to COUNTRY_BOUNDS and COUNTRY_ALIASES (#338) - fix: make OpenSky cache TTLs env-configurable (#333) - fix: serialize OpenSky requests with global 429 cooldown (#332) - fix: replace RSSHub feeds with native/Google News alternatives (#331) - fix: OpenSky auth resilience — retry, IPv4, no negative cache on auth fail (#329) - fix: add CARTO and OpenStreetMap attribution to map (#323) - fix: add drag cleanup handlers and suppress click after drag-drop (#315) - fix: replace HTML5 drag API with mouse events for WKWebView (#313) - fix: open channel settings as inline modal instead of separate window (#311) - fix: sync YouTube live panel mute state with native player controls (#285) - fix: strip Ollama reasoning tokens from summaries (#299) - fix: open external links in system browser on Tauri desktop (#297) - fix: add User-Agent and Cloudflare 403 detection to secret validation (#296) - fix: infra cost optimizations round 2 (#275) - fix: enforce military bbox filtering (#284) - fix: infrastructure cost optimizations across caching, polling, batching (#283) - fix: circuit breaker persistent cache with safety fixes (#281) - fix: immediately refresh stale services when tab regains focus (#277) ### Security - Security hardening: SSRF protection, auth gating, and token generation (#343) - Harden Railway relay auth, caching, and proxy routing (#320) - Build/runtime hardening and dependency security updates (#286) - fix: harden embed postMessage origin check (#302)

## What's Changed ### Performance - perf: defer YouTube/map init and stagger data loads (#287) ### Features - feat: universal country detection — CII scoring for all countries (#344) - feat: add Mexico as CII hotspot (#327) - feat: add Mexico and LatAm security feeds (#325) - feat: add category pills and search filter to Panels tab (#322) - feat: consolidate settings into unified tabbed modal (#319) - feat: optional channels with tab-based region browse UI (#295) - feat: custom channel management (#282) ### Bug Fixes - fix: suppress notification sound when popup alerts are disabled - fix: prevent entity conflation in pane summarization (#341) - fix: add Mexico to COUNTRY_BOUNDS and COUNTRY_ALIASES (#338) - fix: OpenSky cache TTLs, serialization, and auth resilience (#329-#333) - fix: replace RSSHub feeds with native/Google News alternatives (#331) - fix: replace HTML5 drag API with mouse events for WKWebView (#313) - fix: sync YouTube mute state with native player controls (#285) - fix: strip Ollama reasoning tokens from summaries (#299) - fix: infra cost optimizations (#275, #283) - fix: circuit breaker persistent cache (#281) - fix: immediately refresh stale services on tab focus (#277) ### Security - Security hardening: SSRF protection, auth gating, token generation (#343) - Harden Railway relay auth, caching, and proxy routing (#320) - Build/runtime hardening and dependency security updates (#286)

…346) * fix: suppress notification sound when popup alerts are disabled Badge playSound() was firing on new findings regardless of the "Pop up new alerts" toggle. Gate sound on popupEnabled so both the modal and audio respect the user preference. * chore: bump version to 2.5.7 with changelog ## What's Changed ### Performance - perf: defer YouTube/map init and stagger data loads (#287) ### Features - feat: universal country detection — CII scoring for all countries (#344) - feat: add Mexico as CII hotspot (#327) - feat: add Mexico and LatAm security feeds (#325) - feat: add category pills and search filter to Panels tab (#322) - feat: consolidate settings into unified tabbed modal (#319) - feat: optional channels with tab-based region browse UI (#295) - feat: custom channel management (#282) ### Bug Fixes - fix: suppress notification sound when popup alerts are disabled - fix: prevent entity conflation in pane summarization (#341) - fix: add Mexico to COUNTRY_BOUNDS and COUNTRY_ALIASES (#338) - fix: OpenSky cache TTLs, serialization, and auth resilience (#329-#333) - fix: replace RSSHub feeds with native/Google News alternatives (#331) - fix: replace HTML5 drag API with mouse events for WKWebView (#313) - fix: sync YouTube mute state with native player controls (#285) - fix: strip Ollama reasoning tokens from summaries (#299) - fix: infra cost optimizations (#275, #283) - fix: circuit breaker persistent cache (#281) - fix: immediately refresh stale services on tab focus (#277) ### Security - Security hardening: SSRF protection, auth gating, token generation (#343) - Harden Railway relay auth, caching, and proxy routing (#320) - Build/runtime hardening and dependency security updates (#286)

…oala73#346) * fix: suppress notification sound when popup alerts are disabled Badge playSound() was firing on new findings regardless of the "Pop up new alerts" toggle. Gate sound on popupEnabled so both the modal and audio respect the user preference. * chore: bump version to 2.5.7 with changelog ## What's Changed ### Performance - perf: defer YouTube/map init and stagger data loads (koala73#287) ### Features - feat: universal country detection — CII scoring for all countries (koala73#344) - feat: add Mexico as CII hotspot (koala73#327) - feat: add Mexico and LatAm security feeds (koala73#325) - feat: add category pills and search filter to Panels tab (koala73#322) - feat: consolidate settings into unified tabbed modal (koala73#319) - feat: optional channels with tab-based region browse UI (koala73#295) - feat: custom channel management (koala73#282) ### Bug Fixes - fix: suppress notification sound when popup alerts are disabled - fix: prevent entity conflation in pane summarization (koala73#341) - fix: add Mexico to COUNTRY_BOUNDS and COUNTRY_ALIASES (koala73#338) - fix: OpenSky cache TTLs, serialization, and auth resilience (koala73#329-koala73#333) - fix: replace RSSHub feeds with native/Google News alternatives (koala73#331) - fix: replace HTML5 drag API with mouse events for WKWebView (koala73#313) - fix: sync YouTube mute state with native player controls (koala73#285) - fix: strip Ollama reasoning tokens from summaries (koala73#299) - fix: infra cost optimizations (koala73#275, koala73#283) - fix: circuit breaker persistent cache (koala73#281) - fix: immediately refresh stale services on tab focus (koala73#277) ### Security - Security hardening: SSRF protection, auth gating, token generation (koala73#343) - Harden Railway relay auth, caching, and proxy routing (koala73#320) - Build/runtime hardening and dependency security updates (koala73#286)

* Simplify RSS freshness update to static import * Refine vendor chunking for map stack in Vite build * Patch transitive XML parser vulnerability via npm override * Shim Node child_process for browser bundle warnings * Filter known onnxruntime eval warning in Vite build * test: add loaders XML/WMS parser regression coverage * chore: align fast-xml-parser override with merged dependency set --------- Co-authored-by: Elie Habib <[email protected]>

…oala73#346) * fix: suppress notification sound when popup alerts are disabled Badge playSound() was firing on new findings regardless of the "Pop up new alerts" toggle. Gate sound on popupEnabled so both the modal and audio respect the user preference. * chore: bump version to 2.5.7 with changelog ## What's Changed ### Performance - perf: defer YouTube/map init and stagger data loads (koala73#287) ### Features - feat: universal country detection — CII scoring for all countries (koala73#344) - feat: add Mexico as CII hotspot (koala73#327) - feat: add Mexico and LatAm security feeds (koala73#325) - feat: add category pills and search filter to Panels tab (koala73#322) - feat: consolidate settings into unified tabbed modal (koala73#319) - feat: optional channels with tab-based region browse UI (koala73#295) - feat: custom channel management (koala73#282) ### Bug Fixes - fix: suppress notification sound when popup alerts are disabled - fix: prevent entity conflation in pane summarization (koala73#341) - fix: add Mexico to COUNTRY_BOUNDS and COUNTRY_ALIASES (koala73#338) - fix: OpenSky cache TTLs, serialization, and auth resilience (koala73#329-koala73#333) - fix: replace RSSHub feeds with native/Google News alternatives (koala73#331) - fix: replace HTML5 drag API with mouse events for WKWebView (koala73#313) - fix: sync YouTube mute state with native player controls (koala73#285) - fix: strip Ollama reasoning tokens from summaries (koala73#299) - fix: infra cost optimizations (koala73#275, koala73#283) - fix: circuit breaker persistent cache (koala73#281) - fix: immediately refresh stale services on tab focus (koala73#277) ### Security - Security hardening: SSRF protection, auth gating, token generation (koala73#343) - Harden Railway relay auth, caching, and proxy routing (koala73#320) - Build/runtime hardening and dependency security updates (koala73#286)

toasterbook88 added 4 commits February 23, 2026 17:36

Simplify RSS freshness update to static import

dd6ea5a

Refine vendor chunking for map stack in Vite build

a4e9738

Patch transitive XML parser vulnerability via npm override

3436306

Shim Node child_process for browser bundle warnings

9cedae5

Copilot AI review requested due to automatic review settings February 24, 2026 00:19

Copilot started reviewing on behalf of toasterbook88 February 24, 2026 00:20 View session

Copilot AI reviewed Feb 24, 2026

View reviewed changes

Filter known onnxruntime eval warning in Vite build

53e3acf

koala73 added 3 commits February 24, 2026 07:52

test: add loaders XML/WMS parser regression coverage

6e8cda5

Merge origin/main into codex/pr-286-review

6128706

chore: align fast-xml-parser override with merged dependency set

109eb24

vercel Bot deployed to Preview – worldmonitor February 24, 2026 08:03 View deployment

koala73 merged commit 708d4b7 into koala73:main Feb 24, 2026
2 of 5 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Build/runtime hardening and dependency security updates#286

Build/runtime hardening and dependency security updates#286
koala73 merged 8 commits into
koala73:mainfrom
toasterbook88:codex/noninterfering-maint-20260224

toasterbook88 commented Feb 24, 2026 •

edited

Loading

Uh oh!

vercel Bot commented Feb 24, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Feb 24, 2026

Uh oh!

Copilot AI Feb 24, 2026

Uh oh!

Copilot AI Feb 24, 2026

Uh oh!

toasterbook88 commented Feb 24, 2026

Uh oh!

toasterbook88 commented Feb 24, 2026

Uh oh!

toasterbook88 commented Feb 24, 2026

Uh oh!

vercel Bot commented Feb 24, 2026 •

edited

Loading

Uh oh!

Uh oh!

toasterbook88 commented Feb 24, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

toasterbook88 commented Feb 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

vercel Bot commented Feb 24, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Feb 24, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 24, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 24, 2026

Choose a reason for hiding this comment

Uh oh!

toasterbook88 commented Feb 24, 2026

Uh oh!

toasterbook88 commented Feb 24, 2026

Uh oh!

toasterbook88 commented Feb 24, 2026

Uh oh!

vercel Bot commented Feb 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

toasterbook88 commented Feb 24, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

toasterbook88 commented Feb 24, 2026 •

edited

Loading

vercel Bot commented Feb 24, 2026 •

edited

Loading