ci: fail on high/critical vulnerabilities

Backstage pulls js-cookie 2.x (via react-use) and adm-zip 0.6.0 (via
module-federation), and their ranges keep yarn from reaching the patched
versions. Resolutions force them so the audit gate starts green.

Author: tembleking

.github/workflows/ci.yaml

@@ -20,6 +20,9 @@ jobs:
       - name: Install dependencies
         run: yarn install --immutable
 
+      - name: Audit
+        run: just audit
+
       - name: Lint
         run: just lint
 

justfile

@@ -42,4 +42,4 @@ check-unused:
 
 # Checks for vulnerabilities
 audit: install
-    yarn npm audit
+    yarn npm audit --all --recursive --severity high

package.json

@@ -29,7 +29,9 @@
   "resolutions": {
     "@types/react": "^18.0.0",
     "@types/react-dom": "^18.0.0",
-    "@testing-library/react": "^16.0.0"
+    "@testing-library/react": "^16.0.0",
+    "adm-zip": "^0.6.1",
+    "js-cookie": "^3.0.6"
   },
   "dependencies": {
     "@backstage/core-components": "^0.18.14",

yarn.lock

@@ -7448,10 +7448,10 @@ __metadata:
   languageName: node
   linkType: hard
 
-"adm-zip@npm:0.6.0":
-  version: 0.6.0
-  resolution: "adm-zip@npm:0.6.0"
-  checksum: 10c0/440f37590c62255226f1db4cb1a5a618879347f5106ad5b9a24c67c20f9a54bd5b4efcd2b35af858e39c7885d05f4bd35f4c2f42378c98d13f779be380bc9ae4
+"adm-zip@npm:^0.6.1":
+  version: 0.6.1
+  resolution: "adm-zip@npm:0.6.1"
+  checksum: 10c0/78233c6fbfd418dd605ef3c4c6a656406a49f81f716f2850d565f5e55915f18b99f4fdaf15436d77c73536da0915eeca33adab8055872a983b0ac7d07664cd25
   languageName: node
   linkType: hard
 
@@ -14170,10 +14170,10 @@ __metadata:
   languageName: node
   linkType: hard
 
-"js-cookie@npm:^2.2.1":
-  version: 2.2.1
-  resolution: "js-cookie@npm:2.2.1"
-  checksum: 10c0/ee67fc0f8495d0800b851910b5eb5bf49d3033adff6493d55b5c097ca6da46f7fe666b10e2ecb13cfcaf5b88d71c205ce00a7e646de791689bfd053bbb36a376
+"js-cookie@npm:^3.0.6":
+  version: 3.0.8
+  resolution: "js-cookie@npm:3.0.8"
+  checksum: 10c0/421912a4a55535bda32b3059835864e1182c3af5b4516df00a060edc1fa5a53d38bb8d5a91d5d305e396206f4fd11e829f17850aa5aa8164118c04d8ebf1ff5d
   languageName: node
   linkType: hard