[jamesyong-42]

truffle's Security Audit checked Go (govulncheck), cargo-deny and cargo-audit, but nothing read pnpm-lock.yaml. main therefore carried 107 npm advisories unseen: 2 critical (tar, proxy-addr), 63 high, 34 moderate and 8 low. #233's push audit found them.

This PR adds a pnpm audit job and clears every high and critical advisory. After it, pnpm audit --audit-level=high exits 0, with 4 advisories left below the gate.

The job (ci: commit)

• pnpm-audit in security-audit.yml runs pnpm audit --audit-level=high against the lockfile alone. Nothing is installed, so no package script runs.
• Every workspace importer counts, including the examples and benchmark/app.
• Pull requests that touch any package.json, pnpm-lock.yaml or pnpm-workspace.yaml now run the workflow, alongside its existing triggers.

Where the high and critical findings came from (main dc9db0d)

Importer	Paths	Through
examples/playground	48	electron-builder 25 (tar 6, @xmldom/xmldom, app-builder-lib, builder-util-runtime, brace-expansion, form-data, tmp, http-cache-semantics, …), electron 41, electron-vite beta (browserslist)
benchmark/app	7	vite 8.0.8 (vite, postcss, nanoid, source-map-js)
root	5	@typescript-eslint, through eslint (brace-expansion 5)
crates/truffle-napi	3	@napi-rs/cli 3.6.2 (js-yaml 4.1.1)
examples/express-over-mesh	2	express 4.21 (proxy-addr, critical; body-parser)

The bumps (chore(deps): commit)

• examples/playground:
  • electron ^41.2.2 → ^44.9.3 (resolves 44.10.0). The 41 line has an advisory patched only at ≥42.11.16. From 42 on, electron unpacks with @electron-internal/extract-zip instead of extract-zip, which has no patched version.
  • electron-builder ^25.1.8 → ^26.18.0 (app-builder-lib ≥26.15.0; tar 7.5.22).
  • electron-vite 6.0.0-beta.1 → ^6.0.0.
• @napi-rs/cli 3.6.2 → 3.10.9 (js-yaml 5.5.0). It still builds the napi 3.15 family from chore(deps): move the napi crates together (napi 3.15.0, napi-derive 3.6.13) #235. It regenerates crates/truffle-napi/index.d.ts with one added declaration, __napiBindingTarget: 'native' | 'wasm32-wasi' | 'wasm32-wasip1'. The generated index.js loader is gitignored but ships in @vibecook/truffle-native, and from the next release it is 3.10.9's loader, which exports that constant.
• In range (pnpm update raised the floors to what it resolved): vite ^8.3.5; express ^4.22.3 (proxy-addr 2.0.8, body-parser 1.20.9); @typescript-eslint/eslint-plugin, @typescript-eslint/parser and typescript-eslint ^8.72.1.
• Now resolved: tar 7.5.22, @xmldom/xmldom 0.8.15, js-yaml 4.3.2 and 5.5.0, brace-expansion 1.1.21, 2.1.7 and 5.0.12, browserslist 4.29.5, http-cache-semantics 4.3.0, source-map-js 1.2.2, postcss 8.5.32, nanoid 3.3.20, form-data 4.0.6, tmp 0.2.7, builder-util-runtime 9.7.0.
• No pnpm.overrides. The lockfile was regenerated by pnpm, never edited by hand.
  • The steps: install --lockfile-only, update, then a remove and re-add of electron-builder, then dedupe.
  • The re-add is there because electron-builder's auto-installed electron-builder-squirrel-windows peer stayed locked at 25.1.8 through update, and it kept the whole app-builder-lib 25 tree alive.

Left below the gate

Severity	Package	Through	Patched
low	esbuild 0.27.7	benchmark/app > vite	≥0.28.1
moderate	vitest / @vitest/mocker 4.1.4 (2 advisories)	root > vitest	≥4.1.12

Tests

Run locally on 2026-10-27 (macOS arm64, pnpm 10.20.0) as CI check runs them. Every step exited 0:

• pnpm install --frozen-lockfile --ignore-scripts
• pnpm run release:check, pnpm run lint, pnpm run format:check
• pnpm run build: all six packages, including napi build --platform --release with CLI 3.10.9 and the playground's electron-vite build
• pnpm run test
• pnpm --filter @vibecook/example-playground typecheck
• pnpm audit --audit-level=high: exit 0, with 4 vulnerabilities (1 low, 3 moderate)

A choice for review

electron 44 rather than 45. 45.0.0 was published on 2026-10-21. 42.11.18, 43.8.3, 44.9.3 and 45.0.0 all came out that day with the same fixed dependency set, so 44 is the mature line that clears the audit.

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}