security(frontend): three high npm advisories fail the audit gate on every PR — and the known remedy predates axios #17841

What

The Dependency Security Scan check fails on origin/main's frontend lockfile, so every PR inherits the red regardless of what it changes. Observed on PR #17711, whose own changed files are five Python requirements files and which therefore cannot have caused it.

Gate output, verbatim:

security scan gate: Frontend dependency audit (npm audit) — 3 unallowed finding(s) at or above 'high'
FAIL — 3 unallowed finding(s) at severity high or worse.
Findings judged by this gate (first 10):
- axios           [high] 1.0.0 - 1.19.0
- brace-expansion [high] 4.0.0 - 5.0.11
- undici          [high] 8.0.0 - 8.10.1

All three are present in origin/main's autobot-frontend/package-lock.json. axios is pinned at exactly 1.19.0 — the top of its own advisory range — so the remedy is a bump above 1.19.0, not a re-resolve.

For contrast, the Python half of the same check passes, which is how the scope was isolated: pip-audit reports "Found 6 known vulnerabilities in 2 packages … PASS — 0 unallowed finding(s) at any severity, with 5 recorded allowance(s)."

The known remedy is incomplete

A verified fix exists on branch wip-frontend-advisories-13400: brace-expansion to 5.0.12 and undici to 8.11.2, measured as three vulnerabilities to zero.

That measurement is stale — it predates axios. Applied as-is it would clear two of the three findings and leave the gate red, because the gate fails on any unallowed finding at or above high. So the branch needs axios raised above 1.19.0 before it closes this.

The branch is additionally blocked at pre-push on a vue-tsc budget of 103s against a 102s ceiling — that is #17451, not a defect in the fix.

Acceptance criteria

• axios is above 1.19.0, brace-expansion above 5.0.11, and undici above 8.10.1 in autobot-frontend/package-lock.json.
• npm audit --audit-level=moderate in autobot-frontend reports 0 findings at high or worse, and the Dependency Security Scan check passes on a PR that changes nothing else.
• Every workspace carrying a package-lock.json is covered, not autobot-frontend alone — the gate discovers workspaces from git ls-files and repo_tests/npm_audit_covers_its_workspaces_test.py asserts that set, so a second workspace holding any of these three must be fixed in the same pass or named here as out of scope with a reason.
• No advisory is cleared by adding a package-keyed allowance. A --allow-id naming a package rather than an advisory admits whatever advisory appears in that package next; the gate's own comments record it failing for exactly that reason once already. An allowance is acceptable only per-advisory and only with evidence that no reachable fix exists.

Relationships, and why this is a new issue rather than a retitle

• security(frontend): browserslist high-severity advisories fail the npm audit gate on every frontend PR #15467 — "security(frontend): browserslist high-severity advisories fail the npm audit gate". Same gate, different package set. Widening it to cover axios/brace-expansion/undici would make its history read as though browserslist had always been this, so it stays as filed and is linked instead.
• ci: the Security Scan check cannot fail on a security finding — every audit step ends in || true #13400 (closed) — "the Security Scan check cannot fail on a security finding — every audit step ends in || true". This issue exists downstream of that fix: the gate can now fail, and these are the findings it catches. Worth reading before anyone proposes silencing the gate.

Why it matters beyond one PR

This is a base red, so it holds the whole queue rather than one branch. #17711 is currently blocked by it with its own work complete and correct. It is the second such cause in flight — #17837 (fakeredis 2.39 dropped aioredis.FakeServer) fails every python-suite run and is being unblocked by #17840. Both argue for fixing base once and re-running the queue rather than diagnosing per-PR.

Note on reading the gate's output

The error line says "3 unallowed" while the step summary's early lines name only two packages; the full set appears under Findings judged by this gate (first 10). Searching the log for the two advisories already known returns two and hides axios, which is how it stayed unnamed. Read the Findings judged by this gate block rather than the first lines that mention a package.

Filed from a read-only audit session; left unmilestoned because frontend work has no theme under the current ruling that no new milestone opens until the existing ones finish.