[DO NOT MERGE] test: deliberate dependency regression to exercise the DT gate

[tokland]

Deliberate regression. Not for merge. Opened to test the draft Resolving Dependency Vulnerabilities process against a real gate: https://github.com/EyeSeeTea/internal-know-how/pull/1/

Based on #262 rather than master, because master has no Dependency-Track analysis and would make every finding look introduced.

The change

One line removed from package.json:

     "resolutions": {
-        "axios": "1.13.5",
         "glob-parent": "5.1.2",

This models the most ordinary way a vulnerability gets reintroduced: an undocumented resolutions entry looks prunable, so someone prunes it. Nothing in the manifest said why it was there.

Dependency paths after the change

yarn why axios -R:

└─ @eyeseetea/training-app@workspace:.
   ├─ @eyeseetea/d2-api@npm:1.20.0          └─ axios@npm:1.6.4
   ├─ @eyeseetea/feedback-component@npm:0.2.0 └─ axios@npm:0.27.2
   ├─ axios@npm:0.24.0   (direct, package.json declares "axios": "0.24.0")
   └─ wait-on@npm:5.3.0                      └─ axios@npm:0.21.4

One removed line produces four axios versions across four consumers, all behind the advisory floor. Before the change all four resolved to 1.13.5.

Two things this makes concrete for the wiki page:

1. A resolution that reads as inert can be the only thing holding a vulnerable version out — and here it was load-bearing for four separate paths at once.
2. yarn why -R prints post-resolution descriptors. On ci(security): enable Dependency-Track scanning #262 it showed axios@npm:1.13.5 (via npm:1.13.5) and never revealed that package.json declares axios: "0.24.0". The declared constraint is only visible by reading the manifest.

Expected gate behaviour

Base (#262 head) has been scanned: 107 open alert instances, 3 critical / 43 high. The axios instances there are against 1.13.5. This branch should add new instances against 0.21.4 / 0.24.0 / 0.27.2 / 1.6.4 and fail the gate — this time correctly attributed.

Verification

• yarn install clean; yarn why axios -R as above

[tokland]

Result: the full loop, measured

Branch state	instances	crit	high	new crit/high vs base	gate
base (#262 head, resolutions.axios: "1.13.5")	107	3	43	—	—
this branch, axios resolution removed	177	3	79	0 / 37	❌ blocked
this branch, restored as ^1.16.0 + RESOLUTIONS.md	79	3	32	0 / 0	✅ passed

The gate behaved correctly at both steps, with baseline_missing: false throughout. Note the block came entirely from high — zero new criticals, even though four vulnerable axios majors were installed.

The part worth taking to the wiki page

The remediated branch has fewer findings than its own base — 79 vs 107 instances, 32 vs 43 high. The only difference from base is ^1.16.0 instead of the exact 1.13.5, which lets Yarn select 1.20.0. So the exact pin had quietly become the thing holding this tree on a vulnerable patch. That is the risk listed under "exact version" in open decision A.7, observed rather than argued.

Pre-existing breakage this surfaced (not introduced here)

$ yarn wait-on --version
Error [ERR_PACKAGE_PATH_NOT_EXPORTED]: Package subpath './lib/adapters/http'
is not defined by "exports" in .../node_modules/axios/package.json

wait-on@5.3.0 declares axios ^0.21.1; the resolution forces >=1.x, which dropped that subpath from exports. It fails identically on the base branch under the old 1.13.5 pin, so it has been broken for as long as the pin has existed. Install is clean, yarn why looks right, the app runs, the tool is dead — and nothing in CI exercises it.

That is the wiki page's "check the patched release is usable before forcing it" warning happening for real, and it is also the strongest argument in favour of RESOLUTIONS.md: an undocumented pin silently broke a dev tool and left no trace anywhere.

🤖 Generated with Claude Code

https://claude.ai/code/session_01UyMSoPhgMHdJXdAzYBE9aP

[bundlemon]

BundleMon

No change in files bundle size

Groups updated (1)

Status	Path	Size	Limits
✅	Build Folder ./**/*	10.48MB (+5.7KB +0.05%)	+20%

Final result: ✅

View report in BundleMon website ➡️

---

Current branch size history | Target branch size history