Verified and closed hire dependency security updates

Situation

Hire's installed dependency tree included a DOMPurify detached-subtree XSS advisory. Dependency updates needed verification against their actual runtime consumers and current main, without overlapping jobs on shared CI runners or disturbing the primary checkout.

What I did

I closed axios PR #193 and DOMPurify PR #194 strictly serially in one disposable worktree. I verified SendGrid transport behavior with local HTTP requests and DOMPurify sanitization with PostHog's configuration and both vulnerable afterSanitize hook cases. Both received structured @qwestly approvals and SHA-matched squash merges after successful current-head CI. I waited for all postmerge workflows and removed the worktree/session branch.

Result

DOMPurify's npm audit finding disappeared; total installed-tree findings decreased from 7 to 6. Both updates passed 471 tests across 39 files, lint with zero errors (115 existing warnings), and production builds. No external mail was sent. Follow-up brace-expansion #195 and Next.js #196 were also reviewed and squash-merged serially. Normal glob expansion and four adversarial brace payloads passed. Next's production SSR, RSC, JS assets, auth redirects, internal API rejection, image source rejection and next/og PNG rendering passed. Next's audit finding disappeared: the final tree contains four high tooling findings and zero critical findings. These runtime probes establish compatibility, not exhaustive advisory exploit coverage.

Metrics

Metric	Baseline (2026-10-02)	Target	Latest (2026-10-02)
DOMPurify audit findings in hire installed tree	1	0	0
Total npm audit findings in hire installed tree	7	Reduce scoped security findings	4 (4 high, 0 critical)
Verified and merged scoped PRs	0/4	4/4	4/4
Passing test assertions per update	Not measured	No regression	471/471 on each

How to measure

In an isolated qwestly-hire checkout of main, initialize submodules, run clean npm ci, then npm audit --json and inspect vulnerabilities.dompurify and metadata.vulnerabilities. Baseline was axios PR head 768ccfb72fb8b0b903468ed15178703bf05d8256; latest was main 62ec5c3 plus a verification-only cherry-pick of DOMPurify head dc5aa86eae0c7388a34c32c0587cf5b22350aaf3, later squash-merged as 302535ddcfdd78f7281215b9bfe1b6ab4c7f817d. Audit advisories can change over time, so preserve date and lockfile SHA when comparing. Run test:run, lint, and build through the workspace shared-env wrapper. Review bodies retain the precise verification narrative.

Final measurement used main 72e5ce8 plus a verification-only cherry-pick of Next head 3f1154be138ac988e666dc360443eb92943d664a, subsequently squash-merged as 4616301cb2219d791440814298e793dcec258975. The final four audit entries are @next/eslint-plugin-next, braces, fast-glob and micromatch.

Next check: assess remaining tooling findings without regressions. Counts are dependency-tree findings, not proven application exploitability or security incident reductions.

Log

• 2026-10-02 (local date): #193 merged as 62ec5c3c965bcc0e5c8e0a43a1cf626b4dab374d; #194 merged as 302535ddcfdd78f7281215b9bfe1b6ab4c7f817d. All observed triggered workflows terminal, primary main checkout preserved clean.
• 2026-10-03 (UTC): #195 merged as 72e5ce8a5d9534c0e549a43335415c7e115e6095; #196 merged as 4616301cb2219d791440814298e793dcec258975. Each passed 471 tests, production build and lint (115 warnings, zero errors). @qwestly approvals posted; postmerge runs 37094360042 and 37094576168 completed successfully. Both remote branches, new worktree and session branch removed; primary HEAD 578b25a and unrelated /private/tmp/qwestly-hire-p4 preserved. Existing impact entry updated, no duplicate created.