Fix: Enforce documentation supply-chain quality gates and dependency security,strict TypeScript boundaries and eliminate unbounded any usage - #643
Open
magqqgq wants to merge 3 commits into
Conversation
…security,strict TypeScript boundaries and eliminate unbounded any usage ### Description This PR addresses CI/CD reliability, code formatting drift, and vulnerable supply-chain dependencies within the `docs` repository, as identified in the workspace-wide security audit and strict type-safety issues in the `docs` repository, specifically targeting the browser wallet boundaries and MDX component maps, as identified in the workspace-wide security audit. **Vulnerabilities & Security Defects Remediated:** * **CI Dependency-Install Contract:** Updated the shared `base-setup` action to use `pnpm install --frozen-lockfile` after restoring the cache. This ensures strict, deterministic dependency installations across all independent CI jobs. * **Mutating Format Job and Spell-Check:** Removed the mutating format step in CI (`format:js`). Replaced it with the strictly validated check-only mode (`format:js:check`) and actively re-enabled the previously disabled spell-check job utilizing updated project dictionaries (`cspell/project-words.txt`). * **Build Validation Bypass:** Eliminated the `ignoreDuringBuilds: true` bypass from `next.config.mjs`, enforcing that ESLint fully validates production builds before completion. * **Vulnerable JavaScript Dependencies:** Mitigated findings from `pnpm audit-prod` by directly upgrading Next.js and PostCSS versions, and enforcing patched versions for transitive dependencies (such as `cross-spawn`, `dompurify`, `sharp`, `lodash-es`) using the `pnpm.overrides` configuration. * **Formatter Drift:** Formatted drifting source files (e.g., `theme.config.tsx`) using the repository's native Prettier configuration to comply deterministically with the new CI format check. **Quality & Security Defects Remediated:** * **Untyped Browser Wallet Boundary (`global-env.d.ts`, `src/utils/networks.ts`):** Removed all instances of `(window as any).ethereum` and ambient `ethereum: any`. The browser wallet interaction is now secured behind a strict EIP-1193 interface. Additionally, `eth_chainId` responses are strictly validated at runtime, and `chainChanged` event listeners are properly cleaned up upon component unmount to prevent memory leaks. * **Untyped MDX Component Map (`src/types/mdx.d.ts`):** Replaced the overly permissive `ComponentType<any>` with `ComponentType<never>`. This eliminates the unbounded `any` escape hatch while maintaining full compatibility with the existing MDX component wrapper prop types.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
This PR addresses CI/CD reliability, code formatting drift, and vulnerable supply-chain dependencies within the
docsrepository, as identified in the workspace-wide security audit and strict type-safety issues in thedocsrepository, specifically targeting the browser wallet boundaries and MDX component maps, as identified in the workspace-wide security audit.Vulnerabilities & Security Defects Remediated:
base-setupaction to usepnpm install --frozen-lockfileafter restoring the cache. This ensures strict, deterministic dependency installations across all independent CI jobs.format:js). Replaced it with the strictly validated check-only mode (format:js:check) and actively re-enabled the previously disabled spell-check job utilizing updated project dictionaries (cspell/project-words.txt).ignoreDuringBuilds: truebypass fromnext.config.mjs, enforcing that ESLint fully validates production builds before completion.pnpm audit-prodby directly upgrading Next.js and PostCSS versions, and enforcing patched versions for transitive dependencies (such ascross-spawn,dompurify,sharp,lodash-es) using thepnpm.overridesconfiguration.theme.config.tsx) using the repository's native Prettier configuration to comply deterministically with the new CI format check. Quality & Security Defects Remediated:global-env.d.ts,src/utils/networks.ts): Removed all instances of(window as any).ethereumand ambientethereum: any. The browser wallet interaction is now secured behind a strict EIP-1193 interface. Additionally,eth_chainIdresponses are strictly validated at runtime, andchainChangedevent listeners are properly cleaned up upon component unmount to prevent memory leaks.src/types/mdx.d.ts): Replaced the overly permissiveComponentType<any>withComponentType<never>. This eliminates the unboundedanyescape hatch while maintaining full compatibility with the existing MDX component wrapper prop types.