CRA Phase 1 closeout — vendor-CVE watch doc, retention verified, docs-site deps current #226

Merged

enricobuehler merged 2 commits from worktree-cra-phase1-closeout into main 2026-08-14 16:37:36 +00:00

Conversation 0 Commits 2 Files Changed 6

+629 -218

2 Commits

Author	SHA1	Message	Date
enricobuehler	42848c56b7	docs(compliance): the vendor-CVE watch the technical file will cite — and the SBOM learns we ship Bun ... compliance/vendored-components.md records, per vendored/bundled component, where the pin lives, how it updates, and which feed to watch — the CRA Art. 13(5) due-diligence evidence (S4 in the roadmap). Retention verified while writing it: Gitea serves the full release history v0.17.x -> current, stable sysext feeds publish KEEP=0, flatpak rsyncs without --delete. The manual SBOM fragment gains the bundled Bun 1.3.14 runtime (portable bun.exe in the Windows installer for the console + plugin runner — it was in no lockfile and no SBOM) and stops hardcoding the gamescope patch count at 3 when the series is at 9. SECURITY.md gets the one sentence Annex I Part II asks for: security fixes are free, prompt, and ride patch releases — which the stable channel already did, unwritten.	2026-08-14 18:14:32 +02:00
enricobuehler	39b9e9e276	chore(docs-site): current deps all around — the 67 leftover advisories all live inside @unom/ui's payload chain ... bun update (fumadocs 16.14, tanstack ~1.170, react 19.2) plus @unom/ui 0.8.16 -> 0.9.2 and @unom/app-ui 0.1 -> 0.2.1. Build, tsc --noEmit and a served smoke test all pass. The audit stays non-blocking: every remaining advisory is pinned inside @unom/ui's own dependency tree (@payloadcms/* -> fast-uri/ image-size/sharp, next 16.x, sass -> immutable) — nothing bumpable from this lockfile, and overrides would fork what the CMS actually ships. The comment in audit.yml now names that blocker instead of the stale dompurify/node-tar list.	2026-08-14 18:14:29 +02:00