FarmaFinder/docs/security/2026-07-22-dependency-hardening.md

Dependency Hardening Baseline

Baseline date: 2026-07-22 Branch: security/dependency-hardening-2026-07-22 Lockfile: root package-lock.json, installed with npm ci

Toolchain

• Node.js v22.22.1 (the production Dockerfiles target Node 20 and 24)
• npm 9.2.0
• Python 3.14.4
• uv 0.5.9
• Docker 29.6.1
• Docker Compose v5.3.1

The local Node version produces an expected engine warning for @zxing/library@0.23.0, which requires Node 24 or newer. Production and CI must use the declared Node image/version rather than this local Node 22 runtime.

Audit counts

Reports were generated online and saved outside the repository. Counts are advisory snapshots, not a substitute for the CI gate.

Scope	Critical	High	Moderate	Low	Total
Workspace root	3	13	60	3	79
Backend workspace	1	10	41	2	54
Parapharmacy API	0	2	0	1	3
Frontend workspace	1	6	20	1	28
Scraper workspace	0	1	0	0	1

The parapharmacy and scraper reports resolve through the root workspace lockfile. Their package-local audit invocation fails without a package-local lockfile; the workspace-scoped audit is the authoritative current result.

Direct dependency families selected for review

• Backend OpenTelemetry: @opentelemetry/auto-instrumentations-node ^0.52.0, exporters/SDKs primarily on ^0.55.0, resources/API families on ^1.x.
• Backend native dependencies: bcrypt ^5.1.1, sqlite3 ^5.1.6, and connect-sqlite3 ^0.9.16.
• Parapharmacy: mongoose ^8.8.0, puppeteer ^22.0.0; current installed Puppeteer is 22.15.0.
• Scraper: puppeteer ^24.40.0, puppeteer-extra ^3.3.6, and stealth plugin ^2.11.2.
• Frontend: vite ^5.0.8, vitest ^1.6.0, vite-plugin-pwa ^1.3.0, and Grafana Faro/OpenTelemetry packages on the ^1.x family.

Upgrade order and known risks

1. Resolve Python dependencies and audit them independently.
2. Pin runtime images and verify lockfile-enforced Docker builds.
3. Upgrade backend OpenTelemetry as one family, then native bcrypt/SQLite packages.
4. Upgrade parapharmacy Mongoose/fast-uri and scraper Puppeteer separately.
5. Upgrade frontend Vite/Rollup/esbuild/Vitest without enabling Vitest UI.
6. Re-run all audits and record any residual advisory with production reachability, mitigation, owner, and expiry/review date.

Do not run npm audit fix --force: the baseline reports breaking-version fixes for several families, including OpenTelemetry, SQLite, and Vite/Vitest. Each such upgrade requires its own compatibility test and commit.