fix(security): consolidate 20 PRs and remediate dependency and code scanning findings

[atulmgupta]

Consolidation

All 20 source PR heads are preserved as merge parents and verified ancestors. Lock conflicts were regenerated from combined manifests (never discarded). Original PRs remain open; this replacement supersedes their intent and does not merge main.

Source PR	Immutable included head	Intent
#82	df1b11a	chore(deps-dev): Bump @typescript-eslint/eslint-plugin from 8.59.1 to 8.66.0 in /web
#84	6dfaa0e	chore(deps-dev): Bump eslint-plugin-i18next from 6.1.4 to 6.1.5 in /web
#85	666288a	chore(deps-dev): Bump eslint-plugin-boundaries from 6.0.2 to 7.1.0 in /web
#86	75eef0e	chore(deps-dev): Bump jsdom from 29.0.1 to 30.0.1 in /web
#87	d1f3a90	chore(deps): Bump github.com/go-chi/httprate from 0.9.0 to 0.16.0
#88	2004296	chore(deps): Bump @tanstack/react-query from 5.91.3 to 5.101.4 in /web
#89	3de8033	chore(deps): Bump github.com/jackc/pgx/v5 from 5.7.4 to 5.10.0
#90	c9f3c93	chore(deps): Bump github.com/prometheus/client_golang from 1.19.0 to 1.24.1
#92	554b4c1	chore(deps): Bump github.com/caarlos0/env/v11 from 11.4.0 to 11.4.1
#93	4f1cdad	chore(deps): Bump google.golang.org/api from 0.271.0 to 0.294.0
#96	bf08d07	chore(deps): Bump golang from 1.25-alpine to 1.27-alpine
#97	bf4f065	chore(deps): Bump node from 20-alpine to 26-alpine
#98	a870ca9	chore(deps): Bump nginx from 1.30.4-alpine3.24 to 1.31.4-alpine3.24
#101	e844654	chore(deps-dev): bump mermaid from 11.13.0 to 11.17.2 in /docs
#122	75b0148	test: raise coverage on teslasync CLI, backup, schema, chaos-runner
#125	679a627	chore(deps): bump aquasecurity/trivy-action from 0.33.1 to 0.36.0
#126	7700a93	chore(deps): bump azure/setup-helm from 4 to 5
#127	4f0b4a8	chore(deps): bump actions/download-artifact from 4 to 8
#128	e6ecc53	chore(deps): bump github/codeql-action/init from 4.33.0 to 4.38.0
#129	f1b53c7	chore(deps): bump sigstore/cosign-installer from 3.9.1 to 4.1.2

Security remediation

• Refreshed npm locks and aligned Go OpenTelemetry 1.45, React Router 7.18+, Vite 6.4.3 / Vitest 4.1.11; Node 26 CI/build compatibility.
• Private command-proxy TLS trust anchors and hostname verification, scoped to the proxy transport; Compose and Helm trust mounts and migration documentation.
• Always-Secure auth cookies, cryptographic chat/voice session IDs, bounded pool conversion, contained SPA existence checks.
• Prototype-key guards, JSON-safe source generation, Markdown escaping, shell-free build subprocesses, and linear comment scanning.
• Existing URL allowlist, typed BSON values, pagination caps and non-rendering audit heuristics are preserved, not weakened.

Validation (complete)

Actual local output/results:

• Web and docs npm audit: found 0 vulnerabilities (both).
• All open GitHub npm advisory ranges checked against every matching lockfile copy: GitHub advisory ranges still affected in npm lockfiles: 0.
• Go 1.27.1 govulncheck: No vulnerabilities found. / Your code is affected by 0 vulnerabilities. Three advisory-bearing required modules are not called by this code.
• Go race tests passed for TLS trust/SAN failures, Secure cookies, pool bounds, API/chatbot, CLI/backup/schema, NHTSA allowlists, typed BSON, pagination caps, route generation, AI tools and database fakes.
• Go 1.27-compatible golangci-lint v2: 0 issues. Existing v1 analyzer scope, architecture rules and baseline exceptions are preserved (not weakened); v2 merges gosimple into staticcheck and changes diagnostic identifier quoting.
• npx tsc --noEmit: TSC_EXIT=0.
• Full frontend lint/audit chain: FRONTEND_LINT_EXIT=0.
• Layout/sidebar/report/kiosk: 70 passed; jsdom/TripReplayMap: 22 passed; dashboard grid: 13 passed; SignalExplorer: 7 passed; generated route freshness: 6 passed; prior security regression group: 134 passed; PWA/build identity: 35 passed.
• Route registry: 9 critical routes exist in 264 application routes.
• Docs production build passed. Helm lint: 1 chart(s) linted, 0 chart(s) failed; API + automation + canary trust mount rendering: CA_SECRET_REFERENCES=3.
• Config parity: 0 error(s), 64 advisory(ies) (existing drift); supply-chain: 0 error(s), 0 advisory(ies).
• Modified page audit: zero violations; Chatbot page 1115→1108 lines, panel references 5→5. No hooks/endpoints removed or changed.
• Immutable source ancestry recheck: SOURCE_HEADS=20 PRESERVED=20.

All five deployment images built successfully (FINAL_COMPOSE_BUILD_EXIT=0). Strict private-map startup validation passed at 398.3 KB ≤ 400 KB. The final committed-source rebuild passed again, including the reduced duplication gate and all GitHub workflows. The unchanged 400KB startup budget is addressed through on-demand sidebar variants, tours, and report/kiosk overlays—not a budget increase or removed content. All required checks passed; this replacement is ready for review, not merged.

Code-scanning dispositions

Seven alerts were dismissed only as evidenced false positives, with explanations recorded on each alert:

• chore(deps-dev): bump tailwindcss from 3.4.19 to 4.2.2 in /web #17/chore(deps-dev): Bump @typescript-eslint/parser from 7.18.0 to 8.57.1 in /web #18: external pagination is already clamped to ≤500 before allocation; cap regressions pass.
• chore(deps): Bump codecov/codecov-action from 4 to 5 #20: VIN is a typed string value in a structured BSON filter, never parsed as an operator document.
• chore(deps): bump docker/setup-buildx-action from 3 to 4 #21: exact NHTSA scheme/host/path allowlist; userinfo/query/fragment rejected and redirects disabled; hostile URL regression cases pass.
• Add GitHub Copilot custom instructions for repo-wide and path-specifi… #25/Feature/fleet telemetry mqtt subscriber #26: offline tag stripping is a boolean accessibility heuristic, not HTML sanitization/rendering.
• Feature/drive session enhancements #32: stored values are translated page labels (“API Keys”, “Secret Rotation”), not credentials or secret values.
  The other 26 findings receive code fixes; they are not dismissed.

Deployment notes and closure boundary

Self-signed command proxies now require provisioned trusted CA/public certificate and correct DNS SAN; see docs/guide/remote-commands.md. Trust-only mounts are wired across Compose, API, automation and Helm canaries. Authenticated development uses HTTPS because session cookies are always Secure.

Default-branch Dependabot and CodeQL findings only auto-close after this branch is merged and default-branch analysis completes. No scans disabled and no true findings dismissed. Original PRs remain open and are superseded by the immutable source table above. This PR does not merge main.

Integration evidence added after the first complete CI cycle

• Full security workflow succeeded on a hosted runner; its branch analysis exposed two remaining analyzer boundaries, now fixed without suppressions: adjacent prototype-key guards and a fixture represented without misleading escaped interpolation.
• ARC lacked file and libatomic.so.1; the security workflow now installs these CodeQL runtime prerequisites rather than skipping analysis.
• The dependency duplication inventory was refreshed for patched versions and tightened: 35→26 duplicated package families, 41→29 extra copies, and zero bundled duplicate implementations. No new duplicated family was accepted. import-in-the-middle is pinned to compatible, audit-clean 3.4.0 (within OTel’s ^3.0.0 range) to share lexer 2.3.2 with Vitest rather than introducing lexer major 3.
• The forced-colors baseline was incorrectly a normal dark-mode image. The corrected high-contrast Windows capture was visually inspected and identical across all three CI retries (SHA256 70a7ef392bf239ad73393afd637816146c14aea72578de03a84bc00569ce39ad). Only that image changed; screenshot thresholds remain unchanged. Local browser download timed out, so final screenshot comparison is validated by Windows CI, not claimed as locally passing.
• Startup ownership + audit contract regressions: 121 passed; prototype insertion regressions: 2 passed; TypeScript: TSC_EXIT=0; npm audit still found 0 vulnerabilities.

Final gate — 95730ef

• GitHub check summary: 65 successful, 3 skipped, 1 neutral, 0 failed, 0 pending. Skips are the duplicate CI CodeQL job (the Security workflow ran CodeQL), optional authenticated production smoke, and main/nightly-only AI evaluation jobs.
• Complete CI watcher: FINAL_CI_EXIT=0; all five Docker CI jobs passed.
• Final local deployment rebuild: FINAL_COMPOSE_BUILD_EXIT=0 (API, web and three workers).
• Final private-map build: FINAL_BUILD_EXIT=0 FINAL_BUDGET_EXIT=0; startup 398.3 KB; dependency and bundled-duplication gates both pass.
• Current PR CodeQL analysis 1807947640 has 0 results and no analysis error, and PR-ref open findings are 0. Its analyzed merge commit 330be602c24cf216c2ccd73b4733af12eeee9e93 explicitly includes final head 95730ef9fe4dea6e45f1fcf1d601a0a67ca6ab12. The earlier manual branch-ref analysis is historical, not the final PR result.
• Final source verification: SOURCE_HEADS=20 PRESERVED=20; ORIGINAL_PRS_STILL_OPEN=20; working tree clean.
• Default-branch alerts remain 89 Dependabot / 26 CodeQL until merge and default-branch reanalysis. Seven evidenced false positives were dismissed as documented above; no true issue was dismissed and main was not merged.

[Copilot]

One or more custom setup steps configured for this repository failed during this Copilot code review run:

Verify TypeScript build

Setup steps run before each review. If the review above is missing context, or no review was posted at all, the failing step above may be the cause. See the workflow run for failure details, fix your setup steps configuration, and re-request a review.

Note

You can configure setup steps for Copilot code review separately from Copilot cloud agent with a copilot-code-review.yml file. Read the docs for details.

[Copilot]

Copilot review overview

🟡 Changes recommended

There are correctness/style-gate issues in the changed code (notably goimports grouping in internal/api/aichatbot/handler.go and Go toolchain drift in ops-gate.yml) that should be fixed before approval.

Get a fresh assessment by requesting another Copilot review.

Review effort: Lite
Findings: 1 · 2

Open (3)

• Group Go imports by standard, third-party, and local packages · New
• Use go.mod toolchain version for CI Go setup · New
• Write temporary CA files under t.TempDir() · New

What changed in this PR

Consolidates a large set of dependency/security PRs into a single branch, remediating code-scanning findings across the Go backend, React frontend, CI workflows, and deployment manifests (Compose/Helm), with a focus on safer subprocess execution, stronger TLS/cookie defaults, and toolchain alignment (Go 1.27 / Node 26).

Changes:

• Hardened security boundaries (command-proxy TLS trust anchors + hostname verification, always-Secure auth/impersonation cookies, prototype-key guards, safer codegen escaping).
• Updated frontend build/test/tooling contracts (Vite 6/Vitest 4 adjustments, route-registry generation switched to JSON-quoted values, refreshed i18n catalog structure).
• Modernized CI/deploy plumbing (Node 26 across workflows, CodeQL/runtime prerequisites, Helm/Compose wiring for command-proxy trust mounts, updated container base images).

File	Description
web/​vite.config.ts	Switches to execFileSync for safer script execution; adds Vitest args for Node 26 storage behavior.
web/​src/​main.tsx	Removes React Router future flag usage.
web/​src/​lib/​__tests__/​routeRegistryFreshness.test.ts	Aligns freshness expectations with JSON-quoted route registry output.
web/​src/​i18n/​known-missing-keys.json	Updates known-missing key allowlist.
web/​src/​i18n/​en/​shell.json	Moves presentation-related strings out of shell catalog.
web/​src/​i18n/​en/​runtime-manifest.json	Reorders/adjusts runtime namespace manifest entries.
web/​src/​i18n/​en/​locale-detail-presentation.json	Adds a dedicated presentation locale detail catalog.
web/​src/​features/​trips/​components/​TripReplayMap.test.tsx	Adjusts style assertion to avoid brittle matcher behavior.
web/​src/​features/​telemetry/​pages/​SignalExplorerPage.test.tsx	Makes per-page assertion more direct/robust via re-query.
web/​src/​features/​system/​pages/​ChatbotPage.tsx	Uses crypto.randomUUID-based session ID generation.
web/​src/​features/​dashboard/​components/​__tests__/​DashboardGrid.test.tsx	Updates layout test shim from offsetWidth to clientWidth.
web/​src/​features/​dashboard/​components/​__tests__/​DashboardGrid.mobile.test.tsx	Same clientWidth test shim adjustment for mobile breakpoint tests.
web/​src/​components/​layout/​Layout.test.tsx	Makes sidebar/presentation assertions async to match rendering timing.
web/​src/​components/​feedback/​runtime.ts	Re-exports Skeleton from feedback runtime barrel.
web/​src/​components/​feedback/​ReleaseNotes.test.tsx	Escapes regexp metacharacters in dynamic version queries.
web/​src/​components/​ai/​AIVoiceMode.tsx	Uses crypto.randomUUID-based voice session IDs.
web/​src/​App.tsx	Lazily loads TaskOnboardingHost under a Suspense boundary.
web/​src/​__tests__/​viteTransformConfig.test.ts	Updates expected Vite devDependency major to 6.x.
web/​src/​__tests__/​startupProviders.contract.test.ts	Updates provider-mount contract to include Suspense boundary.
web/​src/​__tests__/​qualityGates.contract.test.ts	Adds regression coverage for metacharacter handling and long-comment scanning.
web/​scripts/​generate-route-registry.mjs	Generates JSON-quoted registry entries (safer escaping).
web/​scripts/​check-vite-deprecations.mjs	Passes Node flag for webstorage behavior during vitest probe.
web/​scripts/​check-pwa-contract.mjs	Adjusts shortcut validation to match JSON-quoted registry output.
web/​scripts/​check-e2e-route-registry.mjs	Parses JSON-quoted production registry paths safely.
web/​scripts/​audit-virtualization.mjs	Avoids regex backtracking by stripping comments before JSX-position scan; escapes callback names.
web/​eslint.config.js	Updates boundaries plugin config shape (rules → policies).
web/​e2e/​mockApi.ts	Accounts for forced-colors mode in theme assertions.
web/​bundle-duplication-baseline.json	Tightens duplication baseline by removing an allowed identical-implementation entry.
scripts/​i18n-validate-keys.test.mjs	Adds node:test coverage for prototype-key guard + null-prototype behavior.
scripts/​i18n-validate-keys.mjs	Exports setNested, blocks prototype segments, uses null-prototype dicts; guards main() execution.
ops/​config/​parity.yaml	Updates config parity baseline list (drops TESLA_COMMAND_PROXY_URL entry).
internal/​tesla/​client.go	Replaces insecure proxy TLS skip-verify with CA-based trust scoping for command proxy.
internal/​tesla/​client_tls_test.go	Adds TLS trust/hostname verification coverage for command proxy client.
internal/​integrations/​nhtsa/​communications_bulk_test.go	Adds additional hostile URL allowlist regression cases.
internal/​database/​worker/​fakes_test.go	Aligns reflection pointer kind checks with updated style.
internal/​database/​observability/​fakes_test.go	Same reflection pointer kind check change.
internal/​database/​database.go	Adds early validation of pool bounds before connecting.
internal/​database/​database_pool_bounds_test.go	Tests invalid pool-bounds rejection behavior.
internal/​database/​audit/​fakes_test.go	Same reflection pointer kind check change.
internal/​config/​config.go	Adds TESLA_COMMAND_PROXY_CA_FILE wiring into TeslaConfig.
internal/​auth/​session_tracker.go	Forces Secure cookies unconditionally; removes TLS-detection helper.
internal/​auth/​secure_cookies_test.go	Adds coverage that auth cookies remain Secure regardless of forwarded proto/local HTTP.
internal/​auth/​impersonation.go	Forces impersonation cookies Secure unconditionally.
internal/​api/​webvitals/​routetemplates_test.go	Updates web route parsing to handle JSON-quoted registry paths safely.
internal/​api/​router.go	Hardens SPA fallback file existence check using http.Dir Open/Stat.
internal/​api/​aichatbot/​handler.go	Switches to UUID-based session IDs; adjusts imports accordingly.
internal/​ai/​tools/​validate.go	Uses updated reflection pointer-kind checks for tag validation walking.
internal/​ai/​tools/​schema.go	Uses updated reflection pointer-kind checks for schema generation.
helm/​teslasync/​values.yaml	Adds commandProxy CA file/secret values.
helm/​teslasync/​templates/​deployment.yaml	Wires command-proxy trust mounts/volumes into API pod.
helm/​teslasync/​templates/​deployment-canary.yaml	Same trust mount/volume wiring for canary API deployment.
helm/​teslasync/​templates/​deployment-automation-worker.yaml	Same trust mount/volume wiring for automation worker.
helm/​teslasync/​templates/​configmap.yaml	Adds TESLA_COMMAND_PROXY_CA_FILE env var rendering.
helm/​teslasync/​templates/​_helpers.tpl	Adds helper templates for optional CA secret mount/volume.
docs/​scripts/​generate-feature-catalogue.mjs	Escapes backslashes and normalizes newlines for Markdown table output safety.
docs/​package.json	Updates mermaid version and forces vite override for docs toolchain alignment.
docs/​guide/​remote-commands.md	Documents command-proxy TLS trust and new env var naming.
docs/​guide/​local-development.md	Updates local dev minimums (Go 1.27.1+, Node 26+).
Dockerfile.web	Bumps builder Node base and nginx runtime image digest.
Dockerfile.ocpp-server	Bumps Go builder image to 1.27-alpine.
Dockerfile.notification	Bumps Go builder image to 1.27-alpine.
Dockerfile.fleet-telemetry	Bumps Go builder image to 1.27-bookworm.
Dockerfile.export-worker	Bumps Go builder image to 1.27-alpine.
Dockerfile.automation	Bumps Go builder image to 1.27-alpine.
Dockerfile	Bumps Go and Node builder images to Go 1.27 / Node 26.
docker-compose.yml	Adds command-proxy trust mount + env wiring for API and automation worker.
cmd/​routetemplategen/​generate.go	Supports parsing JSON-quoted route registry paths safely; tightens invalid char checks.
cmd/​routetemplategen/​generate_test.go	Updates tests for JSON-quoted paths and escaped edge cases.
cmd/​chaos-runner/​main.go	Preserves last concrete recovery failure over deadline-exceeded noise.
.github/​workflows/​security.yml	Installs CodeQL prereqs; uses go-version-file; bumps Node, CodeQL, govulncheck.
.github/​workflows/​release.yml	Bumps Trivy, download-artifact, cosign-installer, setup-helm.
.github/​workflows/​perf.yml	Bumps Node to 26 for perf workflow.
.github/​workflows/​ops-gate.yml	Updates setup-helm (but still pins Go version).
.github/​workflows/​helm-ci.yml	Updates setup-helm major to v5.
.github/​workflows/​frontend-quality.yml	Bumps Node to 26; updates download-artifact major.
.github/​workflows/​docs.yml	Bumps Node to 26 for docs build.
.github/​workflows/​deploy-rollback.yml	Updates download-artifact to v8.
.github/​workflows/​ci.yml	Bumps Node to 26; bumps golangci-lint to v2; updates download-artifact; adds i18n-validate-keys tests; sets NODE_OPTIONS for vitest shards/merge.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.