Dependency, license, and vulnerability audit.

DOCS-102 records the release-time package evidence for the Gatsby docs site and .NET Playwright automation, including the original vulnerability baseline, DOCS-115 remediation status, license posture, private-feed warnings, and owner decisions that must stay current before final launch acceptance.

Audit Snapshot

Audit date

August 27, 2026

DOCS-102 recorded the original baseline; DOCS-115 records same-day remediation evidence.

npm audit

0 findings after DOCS-115

The DOCS-102 baseline had 42 findings; unused image plugins and scoped overrides clear the current audit.

NuGet audit

0 vulnerable packages

Public NuGet source check found no vulnerable packages for the Playwright xUnit automation project.

Launch posture

Vulnerability blocker remediated

Private-feed, install-script, and license acceptance remain final launch owner decisions.

Command Evidence

Release-time audit commands and the owner decision each result drives
Command	Result	Decision
`node --version`	v24.18.0	Records the local audit runtime.
`npm --version`	11.16.0	Records the npm CLI used for audit and registry metadata checks.
`npm exec gatsby -- --version`	Gatsby CLI 5.16.0 and Gatsby 5.16.1.	Confirms the docs site Gatsby toolchain version.
`npm audit --json --audit-level=low`	DOCS-102 baseline: 42 vulnerabilities with 22 high-severity findings.	Launch blocker until Gatsby dependency risk is remediated or accepted by security and release owners.
`npm audit --json --audit-level=low after DOCS-115`	0 known vulnerabilities after package removal and overrides.	Gatsby npm vulnerability blocker is remediated unless advisory data changes before DOCS-104.
`npm explain @parcel/reporter-dev-server @parcel/core`	Parcel reporter and core both resolve through the 2.16.4 override family.	Keep Parcel overrides coherent rather than overriding the reporter alone.
`npm audit fix --package-lock-only --dry-run --json`	0 package changes, peer warnings, and install-script packages.	Requires manual dependency remediation instead of force-fixing the lockfile.
`dotnet list Automation/Stornamics.DocsWebsite.Automation/Stornamics.DocsWebsite.Automation.csproj package --vulnerable --include-transitive --source https://api.nuget.org/v3/index.json`	No vulnerable packages reported from the public NuGet source.	No public NuGet vulnerability blocker found.
`dotnet list Automation/Stornamics.DocsWebsite.Automation/Stornamics.DocsWebsite.Automation.csproj package --deprecated --source https://api.nuget.org/v3/index.json`	xunit 2.9.3 reported as legacy; xunit.v3 suggested.	Track as release hygiene unless QA or security escalates it.

Direct npm Package Baseline

Post-remediation direct package versions from docs.stornamics.com/package.json
Package	Version	License	Disposition
`@types/node`	24.13.3	MIT	No vulnerability surfaced; major update to 26.4.0 needs Node support review.
`@types/react`	18.3.31	MIT	No vulnerability surfaced; major update to 19.2.18 belongs with React 19 review.
`gatsby`	5.16.1	MIT	Retained as the static-site generator with audited transitive overrides.
`prettier`	3.9.6	MIT	Dev dependency; no vulnerability surfaced.
`react`	18.3.1	MIT	No vulnerability surfaced; major update to 19.2.8 needs Gatsby compatibility review.
`react-dom`	18.3.1	MIT	No vulnerability surfaced; major update to 19.2.8 needs Gatsby compatibility review.
`typescript`	7.0.2	Apache-2.0	No vulnerability surfaced.

npm Vulnerability Clusters

DOCS-102 vulnerability groups and the DOCS-115 remediation disposition
Cluster	Representative packages	Affected path	Required disposition
Gatsby build graph	gatsby, gatsby-core-utils, gatsby-cli, gatsby-page-utils, gatsby-link, Gatsby plugin utilities	Direct Gatsby dependency with unused image plugins removed	DOCS-115 applies scoped overrides and validates the static build.
GraphQL code generation chain	@graphql-codegen/*, @graphql-tools/relay-operation-optimizer, immutable, lodash	Gatsby transitive packages	Resolved through immutable and lodash overrides in the committed lockfile.
Image and file processing	sharp, file-type, inherited libvips CVEs	Unused direct image, manifest, sharp, filesystem, and transformer plugins removed	No docs source image pipeline is configured; residual transitive packages are overridden to audited versions.
Routing and build serialization	path-to-regexp, serialize-javascript, webpack, uuid	Gatsby transitive packages	Resolved through route, serialization, uuid, and webpack overrides.
Local CLI and temporary files	tmp, external-editor, inquirer, yurnalist, cookie	Gatsby CLI and build tooling	Resolved for known advisories; install-script posture remains a supply-chain review item.

npm License Posture

Original DOCS-102 transitive license count from 1123 installed npm package/version pairs
License group	Count	Disposition
MIT	973	Permissive and expected across Gatsby and React packages.
ISC	62	Permissive; acceptable pending legal review.
Apache-2.0	28	Permissive with notice and patent terms.
BSD-2-Clause and BSD-3-Clause	47	Permissive with attribution and no-endorsement review.
CC0-1.0, Unlicense, 0BSD, and OR-expression permissive groups	8	Legal should accept the chosen permissive option.
BlueOak-1.0.0	1	Less common permissive license; legal should explicitly accept.
CC-BY-4.0	1	Requires attribution review before final launch acceptance.
MPL-2.0	1	Weak copyleft; legal should confirm source-disclosure obligations do not affect docs artifacts.
NOASSERTION	2	Resolve linkfs 2.1.0 and valid-url 1.0.9 before final launch.

.NET Automation Baseline

Playwright xUnit package versions and public NuGet audit posture
Package	Version	License	Disposition
`coverlet.collector`	10.0.1	MIT	No public NuGet vulnerability reported.
`coverlet.msbuild`	10.0.1	MIT	No public NuGet vulnerability reported.
`Microsoft.NET.Test.Sdk`	18.8.1	MIT	No vulnerability reported; 18.9.0 is available.
`Microsoft.Playwright`	1.62.0	MIT	No public NuGet vulnerability reported.
`xunit`	2.9.3	Apache-2.0	No vulnerability reported; deprecated as legacy with xunit.v3 suggested.
`xunit.runner.visualstudio`	3.1.5	Apache-2.0	No vulnerability reported; 4.0.0 is available.
`Automation transitive packages`	5.0.0 to 18.8.1	MIT or Apache-2.0	No public NuGet vulnerability reported; test platform transitive updates are available.

Warnings And Follow-Up

Private Feed Warning

Configured-source NuGet checks returned 401 Unauthorized from the private Nexus feed. Public NuGet-only checks completed, but launch evidence must either authenticate the private feed or record that the docs automation project expects no private packages.

Install Scripts

npm output still surfaces Gatsby graph install-script packages such as lmdb, @parcel/watcher, msgpackr-extract, core-js, fsevents, @swc/core, Gatsby, and Gatsby CLI. Release builds should use a trusted lockfile, clean CI worker, and reviewed package source policy.

Remediation Status

DOCS-115 reduces the current npm audit to zero known vulnerabilities. Final launch acceptance still owns private-feed, install-script, and license decisions.

Owner Decisions Required

Decisions required before the final launch acceptance report
Owner	Decision	Blocking rule
Security reviewer	Accept the DOCS-115 clean npm audit evidence and decide whether install-script posture needs explicit allowlisting.	P1 only if the post-remediation audit regresses or supply-chain controls reject the install-script posture.
Docs platform reviewer	Keep the Gatsby and Parcel override family coherent and avoid reintroducing unused image plugins without full validation.	P1 if the remediated package graph cannot be reproduced from the committed lockfile.
Legal reviewer	Accept or reject residual package license posture from DOCS-102.	Blocks only if legal rejects an unresolved license row.
Docs QA reviewer	Rerun source validators, Gatsby build, generated route assets, and Playwright after dependency changes.	P1 if validation or browser automation regresses.
Release owner	Confirm DOCS-115 lands in the launch candidate or reopen RG-012 if advisory data changes.	Blocks DOCS-104 if the remediation is absent or stale.

Production CDN, DNS, cache, and rollback plan
Available: DOCS-101
Cutover, cache, invalidation, rollback, owner, and go/no-go evidence model for production launch.
Launch QA
Available: DOCS-090
Launch validation lanes, browser coverage, blocker rules, and owner work still needed before final signoff.
Post-launch triage
Available: DOCS-091
First-30-day support, issue template, failed-search, broken-journey, stale-page, and severity handling.
Support bundle and privacy page
Available: DOCS-056
Evidence redaction, privacy review, support bundle boundaries, and safe escalation expectations.