Triage: 54 LOW/MEDIUM dependency findings restored to code scanning by full-severity Trivy

[izzywdev]

Triage pass accompanying the full-severity restore (branch claude/trivy-restore-full-severity).

Why these are appearing now

harden-gate's filesystem Trivy scan was CRITICAL,HIGH only. ci.yml ran an identical filesystem scan with no severity filter, and it was the one that carried LOW/MEDIUM into the Security tab. When ci.yml's duplicate SARIF upload was removed (it raced harden-gate under a shared SARIF tool identity), LOW and MEDIUM filesystem findings silently stopped producing alerts.

That was a real coverage regression arriving as a side effect of a de-duplication. Restoring full severity brings them back. None of these are new vulnerabilities — they were always present, they just stopped being reported.

Scope

Scanned at the exact config now restored: --severity UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL --scanners vuln --ignore-unfixed. Everything below is fixable — unfixed CVEs are excluded, so each line has a real upgrade target.

	count
CRITICAL	2
HIGH	41
MEDIUM	46
LOW	8
Newly surfaced (MEDIUM+LOW)	54

CRITICAL/HIGH were already reported before this change and are unaffected.

Worklist — newly surfaced, by package

Concentrated rather than scattered: the top 4 packages account for 29 of the 54.

package	sev	installed	fix ≥	CVEs	manifests
axios	LOW/MED	1.11.0	1.18.0	17	1
tar	MED	6.2.1, 7.5.16	7.5.21	4	2
react-router	MED	6.30.1	7.18.0 ⚠️ major	4	1
undici	MED	7.28.0	7.29.0	4	1
ip-address	MED	10.2.0	10.2.2	2	2
lodash	MED	4.17.21	4.18.0	2	1
body-parser	LOW	1.20.2–1.20.3	1.20.6	1	6
uuid	MED	9.0.1	11.1.1 ⚠️ major	1	2
qs	MED	6.13.0	6.15.2	1	1
validator	MED	13.12.0	13.15.20	1	1
ws	MED	8.17.1	8.20.1	1	1
morgan	MED	1.10.1	1.11.0	1	1
follow-redirects	MED	1.15.9	1.16.0	1	1
@remix-run/router	MED	1.23.0	1.23.3	1	1
@tootallnate/once	LOW	1.1.2	3.0.1	1	1

By manifest

findings	manifest
23	fuzefront-website/frontend/package-lock.json
12	backend/package-lock.json
9	package-lock.json (root)
6	fuzefront-website/backend/package-lock.json
1 each	sdk, services/billing-service, services/email-service, services/sms-service

Nearly half sit in fuzefront-website/, which is separate from the platform runtime — worth deciding whether it warrants the same urgency as backend/ and root.

Suggested sequencing

1. axios 1.11.0 → 1.18.0 — one bump clears 17 of 54, single manifest. Highest value by a wide margin.
2. tar → 7.5.21 — also clears the 2 CRITICAL CVE-2026-59873 hits (root package.json already has a tar: >=7.5.16 override; it needs raising to >=7.5.21).
3. undici, ip-address, lodash, qs, validator, ws, morgan, follow-redirects, @remix-run/router — all patch/minor, low risk, mechanical.
4. react-router 6.30.1 → 7.18.0 and uuid 9 → 11 — ⚠️ major bumps, do not batch with the rest. react-router v7 is a breaking migration and this repo is the Module-Federation host, so it needs its own PR and a real-Chromium check per ui-runtime-validation.
5. body-parser → 1.20.6 — LOW, spans 6 manifests; mostly transitive via express.

Caveats

• Scanned with a cached vulnerability DB dated 2026-08-16 (the live DB pull returned ghcr.io: DENIED in this environment). Counts are ~3 days stale and CI's fresh DB may differ. Re-run against a current DB before working the list.
• Counts are per-CVE-per-manifest; the same CVE in two lockfiles counts twice.
• .trivyignore is honoured by the CI scan and by this scan.

Related

• Restore PR: claude/trivy-restore-full-severity
• feat(ci): add gate-toolchain — enforce the Node 24 / React 19 floor #647 — where the de-duplication happened
• ci: absorb runner action-download outages without masking real failures #741 — CI infra-flake retry (unrelated failure class)