Repository navigation
Fix docs build dependencies and guard the remaining SVG advisory - #415
Conversation
rmcdaniel
left a comment
rmcdaniel
left a comment
There was a problem hiding this comment.
Security source review at 7365a812c3e1f308fe6292c3e47313aeaa73774a found one control gap before acceptance.
dependencyParents() inspects only each lock entry's dependencies. A root devDependency, or a nested optionalDependencies / peerDependencies declaration, can consume the same single hoisted deepmerge copy while the asserted parent list still reports only @svgr/plugin-svgo. That bypasses the stated sole-consumer re-review gate.
Please make the deepmerge consumer scan cover dependencies, devDependencies, optionalDependencies, and peerDependencies, with negative controls for at least root-dev and nested-optional declarations (and peer as supported).
The bounded disposition itself is otherwise supported: GitHub's advisory records 4.2.0–4.3.1 affected with no patched version, and the exact npm 8.1.0 tarball independently matches the recorded entrypoint SHA-256 and contains no deepmerge import or call. No production incident or operator action follows.
|
Final source correction — 2026-10-29 19:53:14 UTC Head Final focused qualification passed 19:49:39 UTC: 21 dependency cases, three actual browser-launch controls, toolchain checks and The resulting audit has zero high/moderate/critical findings and five low package rows: the unfixed Original-head normal full qualification 40942910555 succeeded at 19:51:48 UTC before the follow-up push. Final-head normal checks and Security delta review remain pending. #413 stays open through protected merge, exact Pages deployment acceptance and cleanup. |
rmcdaniel
left a comment
rmcdaniel
left a comment
There was a problem hiding this comment.
Security follow-up for final head c5301bdab3165ba6d0ee414ac4f5cd58acfea2c7 / tree 5530b4b76061426b0c16c571c0d69bcfcf287ff8: the consumer-graph finding is resolved with no new source finding.
The one-commit delta from 7365a812 changes only the graph helper and tests. It now scans normal, development, optional, and peer dependency declarations; negative controls cover the existing normal consumer plus root-dev, nested-optional, and nested-peer cases. Those three new controls fail against the prior scanner and all 21 controls pass on the final scanner. The exact npm tarball still matches the recorded entrypoint digest and contains no deepmerge import or call.
The bounded disposition remains accurate: the audit is still affected, the static published site has no request-time Node path, and graph/version/source changes force re-review. Final-head normal CI and deployed static-site acceptance remain the delivery gates.
|
|
Security final acceptance for immutable head |
The documentation build and development server retain five dependencies below their available compatible security fixes. Update
undici,body-parser,fast-uri,qsandserialize-javascriptwithout changing parent majors or the five maintained patches. The dependency preflight now checks every root and nested copy, with regression cases for each old version.The unfixed
deepmergefinding remains explicit. Its sole declaring package,@svgr/plugin-svgo, does not import or call it in the reviewed published entrypoint. The recorded disposition requires the exact dependency graph, locked version and installed entrypoint hash; version, consumer or source drift requires renewed review. This does not classify the affected dependency as fixed or the audit as clean.The consumer scan includes ordinary, development, optional and peer dependency declarations. Root-development, nested-optional and nested-peer controls fail against the original scanner and pass with the correction. Existing image, cache and browser-floor assertions retain their semantics inside named tests.
Validation on Node 24.22.1: clean
npm ciapplied all five patches; all 21 dependency controls, three actual browser-launch controls, Node-toolchain checks andnpm testpassed. The full eight-locale static build and bounded loopback start passed with the unchanged dependency/runtime files. The resulting audit contains none of the five corrected packages and retains only the low-severitydeepmergeadvisory with four parent rollups. All 11 final-head checks and six normal main source/publication runs passed. Protected merge7f1679269a8b15065517587d11bd75894eb4e2e5deployed through normal publisher 40944728127 to exact gh-pages artifacte139c5851f4f61fdf6446254c94fcbb587880ed3; Pages built it at 20:03:39 UTC. Four live routes and all three CSS/JavaScript assets matched that artifact byte for byte at 20:03:53–20:03:57 UTC. Delivery evidence is recorded in #413.Refs #413. Includes the undici update proposed in #414; its existing check results remain independent.