[piyushsinghgaur1]

Closes #83

Refresh package-lock.json via npm audit fix to resolve HIGH/CRITICAL Trivy findings.

Root package: @remix-run/router, brace-expansion, browserslist, lodash, lodash-es, minimatch.
cdk/: brace-expansion, minimatch, semver.

Verification: lint and build pass.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rohit-sourcefuse]

Thanks for cleaning these up. The root lockfile is in good shape: trivy goes from 13 HIGH findings on main to 0, npm ls --package-lock-only is clean in the root and in cdk/, and lint, tsc --noEmit and the build pass. Moving off the old Snyk workflow also drops the unpinned snyk/actions/iac@master and actions/checkout@master.

Requesting changes for two things.

1. The new trivy check can't fail, which is why it's green here (details inline). The workflow points at trivy.yml, which isn't in the repo. trivy-action passes that path as TRIVY_CONFIG, and trivy silently falls back to its defaults when that file is missing, including exit code 0. I reproduced it with trivy 0.66: with a missing config it reports HIGH findings and exits 0, and with a real config it exits 1.

2. The description says cdk/ brace-expansion, minimatch and semver are fixed, but cdk/ still has the same 17 HIGH findings as main. All of them are copies bundled inside cdktf 0.15.5 (inBundle in the lockfile), so npm audit fix and overrides can't replace them. I checked cdktf 0.21.0, the latest release, and it still bundles brace-expansion 2.0.1 and minimatch 5.1.6, so upgrading doesn't clear them either. Once the check works, these 17 will fail it. The inline suggestion ignores those CVEs for cdk/package-lock.json only, with the reason written down, so the root lockfile stays fully checked.

With the config and ignore file from the inline comment, I ran trivy on a checkout of this branch and it exits 0. On main it exits 1 with the 13 root HIGH findings, so the check does catch what this PR fixes.

Smaller things, fine to do here or later:

• The README badge still points at snyk.yaml, so it will show as broken. It could point at trivy.yaml, and the unused .snyk file can go.
• The lockfile change is a near-full refresh rather than a targeted fix. For example, storybook goes from 7.2 to 7.6 and react-router from 6.4 to 6.30, both inside the existing ranges. That's fine if it's intended, but a line in the description would help anyone bisecting later.
• Snyk also ran on pushes to branches, while this only runs on PRs to main. Adding push: branches: [main] would keep main scanned after merges.

[rohit-sourcefuse]

trivy.yml doesn't exist in the repo, so this check passes whatever it finds. trivy-action exports this path as TRIVY_CONFIG. When the file comes from that env var and is missing, trivy logs only a debug line and runs with its defaults: all severities and exit code 0. Locally with trivy 0.66, a missing config file reports HIGH findings and still exits 0.

The catalog workflow this was copied from points at trivy.yaml, and that repo has the file at its root. Here that would be:

          trivy-config: '${{ github.workspace }}/trivy.yaml'

with a trivy.yaml at the repo root:

format: table
exit-code: 1
severity:
  - HIGH
  - CRITICAL
scan:
  scanners:
    - vuln
    - secret
vulnerability:
  ignore-unfixed: true
ignorefile: .trivyignore.yaml

and a .trivyignore.yaml next to it for the copies bundled inside cdktf, which can't be upgraded (see the review summary):

# These copies are bundled inside cdktf (inBundle in cdk/package-lock.json), so
# npm overrides and audit fix cannot replace them. cdktf 0.21.0, the last
# release, still bundles brace-expansion 2.0.1 and minimatch 5.1.6. cdk/ only
# runs at deploy time. Remove these once cdk/ moves off cdktf.
vulnerabilities:
  - id: CVE-2022-25883
    paths: ["cdk/package-lock.json"]
    statement: semver 7.3.8 bundled in cdktf
  - id: CVE-2026-13149
    paths: ["cdk/package-lock.json"]
    statement: brace-expansion bundled in cdktf
  - id: CVE-2026-14257
    paths: ["cdk/package-lock.json"]
    statement: brace-expansion bundled in cdktf
  - id: CVE-2026-69152
    paths: ["cdk/package-lock.json"]
    statement: brace-expansion bundled in cdktf
  - id: CVE-2026-102276
    paths: ["cdk/package-lock.json"]
    statement: brace-expansion bundled in cdktf
  - id: CVE-2026-102278
    paths: ["cdk/package-lock.json"]
    statement: brace-expansion bundled in cdktf
  - id: CVE-2026-26996
    paths: ["cdk/package-lock.json"]
    statement: minimatch bundled in cdktf
  - id: CVE-2026-27903
    paths: ["cdk/package-lock.json"]
    statement: minimatch bundled in cdktf
  - id: CVE-2026-27904
    paths: ["cdk/package-lock.json"]
    statement: minimatch bundled in cdktf

I ran this config against a checkout of this branch and it exits 0. Against main it exits 1 on the 13 root HIGH findings, and without the ignore file it exits 1 on the cdk/ ones.

The comments at the top of this file ("basic workflow to help you get started", "only for the master branch") came over from the catalog and could go as well.

[piyushsinghgaur1]

using same in catalog repo
and trivy was throwing security issue in this branch also i have fixed in the commit