[CI][SECURITY] The dependency audit gate never runs — 19 high advisories accumulated behind a SKIPPED job

[dcccrypto]

Summary

playground has 19 high-severity dependency advisories. The CI gate that would
have caught them exists, runs pnpm audit --audit-level=high, and never
executes — so the check reports green while the findings accumulate.

This is the #2447 pattern again, but on the security audit rather than the test
suites, which is why it has been invisible for longer.

The gate, and why it is dead

# .github/workflows/test.yml:270
- name: Run security audit
  run: pnpm audit --audit-level=high

That step is inside the security-tests job (test.yml:242). Every PR shows:

Unit Tests: SKIPPED   Integration Tests: SKIPPED
Security Tests: SKIPPED   Coverage Gate: SKIPPED
✅ Merge Gate: SUCCESS

security-tests is gated on packages/*, which no longer exists on playground
or main — the file says so itself, a few lines below the job:

The app's own suite (2702 tests). Every other test job above is gated on
packages/*, which no longer exists on playground or main …

#2450 fixed that for the app suite. security-tests was left behind, and it
is the job carrying the dependency audit.

Current findings

pnpm audit --audit-level=high on playground:

44 vulnerabilities found
Severity: 3 low | 23 moderate | 18 high (1 ignored)

(19 high before #2501, which closes brace-expansion.)

High findings span:

package	likely remediation
brace-expansion	override — done in #2501
fast-uri	override
ip-address	override
postcss	override
socket.io-parser	override
undici	may need a transitive-parent upgrade
sharp	likely a real upgrade
next	framework upgrade — needs its own assessment

I have deliberately not bundled these. next and sharp are not one-line
overrides, and an override that pins a framework transitively is its own risk.

Suggested direction

1. Make the gate run. Whatever security-tests becomes, the audit step needs
   to execute on PRs — otherwise this recurs silently. Note it will fail
   immediately, so it likely wants to land after (or alongside) the override
   batch, or start non-blocking with a deadline.
2. Batch the override-able ones (fast-uri, ip-address, postcss,
   socket.io-parser) — mechanical, one PR.
3. Assess next / sharp / undici separately — real upgrades with real
   blast radius.

Note on overrides as a mitigation

brace-expansion illustrates the failure mode worth designing against: the repo
already had an override (>=5.0.7 <6), added for an earlier advisory. A newer
advisory then raised the patched floor past it, and the <6 ceiling guaranteed
the pin could not drift forward on its own. An override is a point-in-time
assertion; it does not stay true. Ceilings on security floors are worth avoiding,
and a running audit is what catches the ones that go stale anyway.

Same class was live in percolator-indexer (fixed in indexer#193) — and there it
was CI-blocking, because that repo's audit gate does run.

[dcccrypto]

Tried my own suggestion (2) — "batch the override-able ones" — and it does not
work as written. Recording the result rather than leaving the advice standing
untested.

What I ran

Overrides applied on top of #2501: fast-uri >=3.1.5, postcss >=8.5.18,
socket.io-parser >=4.2.7, ip-address >=10.3.1, undici >=7.29.0.

The audit improvement is real:

before:  44 vulnerabilities — 18 high
after:   20 vulnerabilities —  6 high   (only `next` and `sharp` remain)

But the app test suite collapses. Controlled comparison, identical procedure each
time (rm -rf app/node_modules && cd app && pnpm install && npx vitest run):

tree	test files discovered
playground (control)	282
playground + batch	4
playground + batch − postcss	4
playground + brace-expansion only (#2501)	282 ✓
playground + brace-expansion + undici	4

undici >=7.29.0 is the culprit. Overriding it breaks vitest's test discovery
outright — the run reports 4 passed and exits 0, which is the dangerous part:
it looks like a passing suite, not a broken one. I nearly recorded "51 passed"
as a green result before the file count caught my eye.

What this means for the issue

• fix(deps): raise the brace-expansion floor to >=5.0.9 #2501 is unaffected — re-verified in isolation at 282 files / 2919 tests,
  identical to control. That PR stands.
• Suggestion (2) needs splitting: fast-uri, socket.io-parser, ip-address
  (and probably postcss) still look mechanical, but undici belongs with
  next and sharp in the "needs a real upgrade, not an override" bucket. It
  is almost certainly a transitive dep of Next's fetch layer, and forcing a minor
  bump under it is not free.
• I have not confirmed the four-without-undici combination passes; I stopped at
  the bisect. Worth one run before anyone batches them.

The broader point this sharpens

This is the second time in one investigation that a check reported success while
measuring almost nothing — first security-tests reporting SKIPPED-as-green, now
vitest reporting 4 passed on a broken resolution. Both are the same failure
class this issue is about: a green signal that isn't measuring what you think.
Worth a floor assertion in CI — fail if the discovered test-file count drops below
an expected threshold — so a resolution change can't silently empty the suite.

[dcccrypto]

Verified fixed — closing. The audit gate runs in CI:

.github/workflows/test.yml:270
- name: Run security audit
  run: pnpm audit --audit-level=high

with a note at :266 that the thresholds must match pnpm.auditConfig / SECURITY-DEPS.md, so the gate and the documented policy cannot drift apart silently.