Problem

main is red. The Security CI job fails at Run security audit on every push that touches Rust or CI, unrelated to the diff under test — #6455, #6456, and #6457 all inherited it (tracked by the auto-filed #6462).

Root cause is not a dependency vulnerability. npm retired the legacy pnpm audit endpoints:

ERR_PNPM_AUDIT_BAD_RESPONSE  The audit endpoint (at
https://registry.npmjs.org/-/npm/v1/security/audits/quick) responded with 410:
{"error":"This endpoint is being retired. Use the bulk advisory endpoint instead."}

pnpm v10 (pinned in CI) still calls the legacy path, so pnpm audit exits non-zero even when there is no advisory. xtask deps --web only inspected the exit code, so it counted each of the three frontend dirs (web / dashboard / docs) as a dependency issue → Error: 3 dependency issue(s) found → exit 1.

cargo audit on the Rust side passes cleanly ("no vulnerabilities found"); the failure is entirely the retired audit API.

Fix

run_pnpm_audit (xtask/src/deps.rs) now captures the combined stdout+stderr instead of only the exit code and returns a three-way PnpmAuditOutcome:

• Clean — pnpm reported no advisories (or no manifest present).
• Vulnerable — a genuine advisory; still increments issues and fails the build, unchanged.
• Skipped — the retired-endpoint signature (ERR_PNPM_AUDIT_BAD_RESPONSE, endpoint is being retired, or an audit-context responded with 410); warned and not counted against the build.

An audit-infrastructure outage no longer reads as a vulnerability, while real advisories fail exactly as before. This also removes the broader "audit service down ⇒ CI red" fragility class, not just today's instance.

Verification

• cargo check -p xtask — clean
• cargo clippy -p xtask --all-targets -- -D warnings — zero warnings
• cargo test -p xtask deps:: — 6/6 pass
• cargo fmt -p xtask -- --check — clean

Six unit tests cover the classifier against the verbatim CI 410 body (both the two-endpoint web/dashboard variant and the single-endpoint docs variant), case-insensitivity, a real advisory table (must still fail), clean output, and an unrelated non-audit 410 (must not be swallowed).

Out-of-scope follow-up

This restores CI to green; it does not restore real frontend advisory coverage — with pnpm v10 hitting the retired endpoint, all three dirs currently land on Skipped. Regaining live coverage needs a pnpm version that speaks the bulk advisory endpoint (or pnpm audit --json against the new API), which is a frontend-toolchain change in a different domain. Flagging for a maintainer rather than bundling it here.

Closes #6462