Security Audit failed on a newly-published advisory, GHSA-2m8v-j782-fhvr
(socket.io-parser "Zero-attachment Memory Exhaustion", high). It affected both
projects transitively via socket.io / socket.io-client. Patched to 4.2.7 in both
lockfiles; no direct dependency versions changed.
Also adds the gate that should have caught the previous two CI failures before
they reached GitHub:
- scripts/ci-preflight.sh runs every gate from .github/workflows/ci.yml
(frontend and backend lint/type-check/build, plus both prod-dependency audits
with the same audit-ci flags and allowlist) and additionally the backend Jest
suite, which CI does not currently run. It runs all gates rather than failing
fast, so one invocation surfaces every problem. ~35s.
- scripts/claude-push-gate.sh wires that into a Claude Code PreToolUse hook so a
`git push` is refused while any gate fails, with the failure detail returned
inline. Non-push commands and --dry-run pass straight through.
Verified: with the fix reverted, the gate correctly denied the push and reported
"backend: lint FAIL"; with it restored, all 9 gates pass and both audit-ci
invocations exit 0.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
