[nirnatan]

Why

Security Audit fails on every run because of follow-redirects 1.16.1 (GHSA-mrwp-f3q8-3g9p, high). The fix, 1.16.2, can't be installed yet: the Wix npm gateway returns E403 for it while it's inside the gateway's age block for new versions. No lockfile can pass both npm ci and the audit until then, so the red check only adds noise and uses CI minutes. This came up in the GitHub Actions minutes thread as a workflow that fails constantly.

Change

• New .github/scripts/audit-gate.mjs reads npm audit --omit=dev --json. For each high/critical advisory it asks the gateway which versions it serves; the full packument omits the versions it blocks. It then looks for one newer than the installed version and outside every advisory range.
  • Fix is served: the job fails and names the version to bump to.
  • Fix not served yet: a warning plus a ⏳ line in the job summary. The gate fails again on its own once the gateway serves the fix.
  • Gateway unreachable, or audit returned no report: the job fails.
• security-audit.yml saves the gateway IP before the existing unpin step removes it from /etc/hosts, then runs the script instead of npm audit --audit-level=high. The report-only full audit is unchanged.
• Uses npm's bundled semver, so no new dependency.

Verified

Tested locally with sample npm audit --json files and the lockfile from #369:

Case	Result
follow-redirects@1.16.1, 1.16.2 blocked by the gateway	warning, exit 0
Fake critical on axios@1.13.0 (gateway serves 1.13.5)	error naming 1.13.5, exit 1
Gateway unreachable	exit 1
npm audit error, no report	exit 1

The real npm audit call wasn't run locally (it needs the gateway bypassed), so this PR's CI run is the end-to-end check.

Note

CI is expected to fail until the Wix gateway serves follow-redirects 1.16.2 (it's inside the gateway's age block, so probably next week). Until then, npm ci fails with E403 on follow-redirects-1.16.2.tgz, the same as on main. Once the gateway serves it, CI should pass without changes and this PR can merge, so the next blocked fix shows as a warning instead of a failing job.

🤖 Generated with Claude Code

[github-actions]

🚀 Package Preview Available!

---

Install this PR's preview build with npm:

npm i @base44-preview/sdk@0.8.59-pr.371.d7ccde1

Prefer not to change any import paths? Install using npm alias so your code still imports @base44/sdk:

npm i "@base44/sdk@npm:@base44-preview/sdk@0.8.59-pr.371.d7ccde1"

Or add it to your package.json dependencies:

{
  "dependencies": {
    "@base44/sdk": "npm:@base44-preview/sdk@0.8.59-pr.371.d7ccde1"
  }
}

• 📦 Preview Package: @base44-preview/sdk@0.8.59-pr.371.d7ccde1
• 🔗 View this commit on GitHub

---

_{Preview published to npm registry — try new features instantly!}