main red on Codefly supply chain since 2026-10-22: three critical npm advisories in the frontend (next, @sentry/nextjs, dompurify); auto-remediation cannot open PRs #1227

What is wrong

main has been red on the Codefly supply chain job, and therefore on Release gates, since 2026-10-22. Every open PR inherits the red, whatever it touches (seen on #1214 and #1216, which change no frontend dependency). No open issue or PR covers it.

The job runs npm audit --omit=dev --audit-level=high on module/services/frontend/code and reports three critical advisories in production dependencies (run 39966074783, job 120463883346, 2026-10-23):

Why the auto-remediation did not fix it

The Dependency audit auto-remediation workflow runs on main (run 39948020117, 2026-10-23 11:43 UTC), commits the lockfile change on chore/dep-audit-remediation, then fails at PR creation:

pull request create failed: GraphQL: GitHub Actions is not permitted to create or approve pull requests (createPullRequest)

That is a repository setting (Actions → General → Workflow permissions → "Allow GitHub Actions to create and approve pull requests"), not a workflow bug. Note also that its audit fix step reported "No transitive advisories to remediate; lockfiles unchanged", so even with permission it would not have moved the three direct dependencies above.

What to do

One PR on main:

1. Bump next, @sentry/nextjs and dompurify (and whatever else npm audit names once those move) to the first fixed versions in module/services/frontend/code, regenerating package-lock.json with npm, never by hand. If the frontend kit (@codefly-dev/ui, @codefly-dev/saas-ui) pins any of these, follow the kit-version gate's rule for the bump.
2. Run the same audit the job runs locally, on both frontend and marketing, and show it clean.
3. Prove the frontend still builds and the starter still runs locally (codefly run, sign-in reaches the portal) before opening the PR; say in the body what was not verified.
4. Docs: if any document names the Next.js major or a pinned version, update it in the same PR.

Separately, the owner decides whether to enable "Allow GitHub Actions to create and approve pull requests" on this repo so the auto-remediation workflow can open its PRs, or to retire that workflow. Not part of the PR.

Evidence

• main supply-chain failures since 2026-10-22; the two drafts above red on the same job with no dependency change.
• Advisory list: https://github.com/codefly-dev/module-saas-starter/actions/runs/39966074783/job/120463883346
• Remediation refusal: https://github.com/codefly-dev/module-saas-starter/actions/runs/39948020117