Repository navigation
[Security] Root-fix npm ci moderate-vulnerability warning instead of passing it below the high-severity gate #1206
Description
Detection evidence and live ownership
BandScope canonical Resource Admission PR #866 has now reproduced the same npm warning on two exact hosted heads without an intentional dependency-graph change:
- historical exact
881b4001e9634639a05c12c4a0731df7df060fdf,cirun34652560402,ci / build-and-testjob103438030482: cleannpm cireported 3 moderate severity vulnerabilities; - predecessor exact
600792545c8ed1f39f3d30aebf48d3926857a3bb, repositorycirun35690262503,gate / ci / rust-checkjob106663752915: pinned npm 10.9.9 was verified, cleannpm ciadded 377/audited 380 packages and again reported 3 moderate severity vulnerabilities before frontend build/Rust compilation. That job later failed on a stale Tauri source-contract test unrelated to dependencies.
This repeat materially strengthens the warning as a current dependency-graph finding, but neither log includes npm audit --workspaces --json; package/advisory identity must therefore not be guessed from the count alone.
Live #866 has advanced by one ordinary test-only descendant to exact 7156aebd4a745cab4842d15aba319a72c80e1d98 on protected develop@314ddeae7b775a4957594b599358c8255617eb2e and remains Open / Draft / mergeable. The current delta only aligns stale source-string assertions with the already-implemented OwnedProcess API and does not intentionally alter manifests/lockfiles. The new exact-head workflows are running/queued; do not transfer 600792... npm or CI evidence to 7156... as current-head evidence.
Protected repository policy still documents/runs npm audit --workspaces --audit-level=high. That gate is useful for high/critical rejection, but a moderate advisory can remain visible in every clean install while the formal audit gate returns success. The repository policy that warnings/deprecations require root-cause work therefore still applies.
This is dependency/security ownership, not permission to add lockfile churn to #866. #783 established the canonical npm/lock-generator baseline and is already merged; this issue owns the next dependency-security RCA from the then-current protected dependency graph after the Resource Admission source lane is released.
Required RCA
Use the repository-pinned npm generator/runtime and a fresh exact protected checkout to capture clean npm ci plus npm audit --workspaces --json. For each reproduced moderate finding record:
- advisory/GHSA/CVE identity and affected installed version;
- direct vs transitive owner chain and workspace;
- production/runtime vs dev/build/test reachability;
- fixed version and whether it is reachable without a major/contract break;
- why the vulnerable code path is or is not reachable in BandScope;
- minimal compatible remediation and rollback impact.
Do not infer package identity from the repeated summary count alone. If the fresh protected graph no longer reproduces exactly three moderate findings, update this issue with the actual current set and explain the dependency ancestry that changed it.
Acceptance
- Exact advisory/package/owner-chain evidence is committed or linked from primary package/advisory sources.
- Compatible fixes are applied through the canonical dependency owner with the repository-pinned npm version and a reviewable lockfile diff; no unrelated dependency drift.
- No
npm audit fix --force, audit-threshold increase, ignore/suppression, mutable install, or fix(audio): establish canonical local-audio resource policy #866-local lockfile workaround. - A clean
npm cino longer emits the reproduced moderate vulnerability warnings. If an upstream-owned advisory is genuinely not removable yet, keep this issue open with a narrow owner-chain exception, compensating control, upstream fix/version watch and explicit removal condition rather than representing the warning as solved. -
npm audit --workspaces, repository security/supply-chain policy checks, dependency review, SBOM, SAST/CodeQL/OSV/Trivy as applicable, complete workspace tests/build and exact-head independent review pass on the remediation head. - Doctoring/security dependency policy is updated only where the actual accepted boundary changes.
Single-writer boundary
While #866 owns the active BandScope source lane, #1206 remains read-only RCA only. Do not create a dependency branch/PR, commit/push, or edit manifests/lockfiles concurrently. Once #866 is normally integrated or its source lane is explicitly released, one bounded canonical dependency-security implementation may start from the then-current protected develop if the RCA shows a compatible repair.
This issue does not change #866 Resource Admission semantics, lower its 100% coverage requirement, or justify merging #866 with unrelated package-lock changes. It must ultimately reconcile through ordinary protected ancestry before commercial release.
Activity
seonghobae commentedon Sep 11, 2026
@opencode-agent Take #1206 as the canonical dependency-security RCA lane, separate from #866. Current mode is read-only RCA only while the canonical BandScope source writer is active on #866. Do not create a branch/PR, commit, push, edit manifests/lockfiles, or otherwise become a second BandScope source writer until #866 releases the source lane. Start from a fresh protected
developcheckout and use the repository-pinned Node/npm runtime and lock generator only for observation/reproduction.First reproduce the exact warning with clean
npm ci, then runnpm audit --workspaces --json. Record all three current moderate findings by advisory/GHSA/CVE, installed version, direct/transitive owner chain and workspace, production vs dev/build/test reachability, fixed version, and compatibility impact. Do not infer package names from the summary count. The current #866 hosted log proves only the count (3 moderate severity vulnerabilities) and is not enough to name packages or advisories.For this read-only phase, report the exact protected
developSHA, npm/runtime versions, audit JSON identities and owner chains, reachability, compatible remediation candidates, and any upstream blocker back on #1206. Do not runnpm audit fix, do not use--force, do not raise/relax audit thresholds, add ignores/suppressions, or accept unrelated lockfile drift.After the BandScope single-writer source lane is explicitly free, a later owner run may turn this RCA into one bounded canonical dependency-security PR from the then-current protected
develop, only if the audit evidence shows a compatible remediation. That future implementation must use the pinned npm generator, minimal manifest/lock/security-doctoring delta, cleannpm ciwith the current warnings gone, fullnpm audit --workspaces, lock-generator/supply-chain checks, dependency review/SBOM/OSV/Trivy/SAST/CodeQL as applicable, complete workspace tests/build, and exact-head independent review. If any advisory is upstream-blocked or only removable through a breaking contract, keep #1206 open with the exact owner-chain exception, compensating control, upstream fixed-version watch and removal condition instead of forcing an upgrade or claiming resolution.seonghobae commentedon Sep 12, 2026
@cursor read-only RCA only. Fresh protected
develop@314ddeae7b775a4957594b599358c8255617eb2echeckout에서 repository-pinned Node/npm (npm@10.9.9, Node 22.x contract)로 cleannpm ci와npm audit --workspaces --json을 실행해 현재 moderate finding을 실측해 주세요. Branch/PR/commit/push/manifest/lockfile 수정,npm audit fix,--force, ignore/threshold 변경은 금지합니다. 각 finding에 advisory/GHSA/CVE, installed version, direct/transitive owner chain + workspace, prod/runtime vs dev/build/test reachability, fixed version, compatible remediation 가능 여부를 남겨 주세요. Historical3 moderatecount에서 패키지명을 추정하지 말고 현재 protected graph 결과가 다르면 실제 결과와 ancestry 변화를 보고해 주세요.cursor commentedon Sep 12, 2026
You need to increase your spend limit or enable usage-based billing to run background agents. Go to Cursor
seonghobae commentedon Sep 22, 2026
Additional read-only RCA evidence; no dependency/source mutation:
Project Persistence #970 exact source head
2892a43615fc29b119fefb3851d34aa511020965, repositorycirun35704190510, Ubuntuci / build-and-testjob106717643693performed a clean workspacenpm ciand again printed 3 moderate severity vulnerabilities before later failing at the unrelated Ruff format check. This is now a third exact hosted reproduction of the same summary count on a source lane with no intentional dependency-graph change.The log still does not contain
npm audit --workspaces --json, so advisory/package identities remain unproven and I am not guessing them. #1206 remains the canonical dependency-security RCA owner; no package manifest/lockfile edit was added to #970. The new receipt strengthens reproducibility only.seonghobae commentedon Sep 22, 2026
Additional hosted reproduction from an independent product lane: BandScope #910 semantic head
b5594975ae6d3087ca359cf76bcbb220491a7a0c, repositorycirun35731825321, Ubuntuci / build-and-testjob106832987895verified pinned npm 10.9.9, then cleannpm ciadded 384/audited 387 packages and again reported 3 moderate severity vulnerabilities. That job later failed at Ruff formatting of protected-basetest_supply_chain_policy.py; the dependency warning was not causal.This is another count-level reproduction only. The log still lacks
npm audit --workspaces --json, so advisory/package identity must not be inferred. #1206 remains the canonical RCA owner; do not add dependency/lockfile churn to #910 or #866. Fresh #866 exact7156aebd...now has repository CI/build/Security/Semgrep/SBOM plus its Windows/macOS native lane all GREEN, but CodeQL and independent approval remain unsettled, so the source-lane release condition for dependency implementation has not yet been met.seonghobae commentedon Oct 4, 2026
Read-only feasibility handoff 2026-10-04 23:44 KST. Actual inherited lock-only npmSBOM failure now has a same npm10.9.9/Tailwind4.3.3 scratch-validated generator route: CPUwasm32 isolated materialization adds exact6bundledchildren, preserves all509existingrecords/SRI/esbuild26peers; normalmacOSfrozenci and virtualSBOM thenpass. Report /Users/seonghobae/.hermes/cache/scratch/bandscope-sbom-generator-spike-20261004/report-ko.md. Existing896 notified; no productionwriter/dependencyPR/source edit started under1206. Fresh#866 read remainsOPEN7156aebd4a745cab4842d15aba319a72c80e1d98/unmerged, so this issue single-writer boundary is preserved. Installedplatformgraph PASS does not previously proveallplatformSBOM PASS; typedreceipts distinguishboth. StandaloneVitest1134 andUndici1286 remaincanonicalsecurityupdates and must reconcile via protectedancestry, notcopyunmergedlocks. Noauditignore/deletion/paidfallback/permission change ormergeclaim.
seonghobae commentedon Oct 4, 2026
2026-10-05 00:52 KST read-only RCA recovery: provider stream failure did not lose executed receipts. Candidate brace-expansion5.0.12 MIT artifact SRI rechecked; approvednpm10.9.9 scratch generator changed onlyoverride+onecompletebracerecord,519locationsunchanged,26esbuildpeerflags preserved. Frozen install/inputimmutability and scopedls passed. Candidateaudit remainsexit1:UndiciHIGH/jsdomMODERATE, while brace/minimatchfindings disappeared. No boundedupstreamfixture execution occurred (NOT_RUN), so not fullsecurityclearance. #1243/#1244/#1265 actualfiles/body are unrelated, notbraceowners. #1206 remains read-onlywhile#866OPEN7156aebd sourceowned; no newbraceproductionwriter. Evidence /Users/seonghobae/.hermes/cache/scratch/brace-rca-20261004/recovery-report-ko.md and recovery-receipt.json. Next admittedowner mustbindcurrentprotectedgraph, reviewgeneratorcutoffinput, executeboundedfixtures/audit/SBOM/security/WindowsmacOS/review before normalmerge. Separately shadowcombined Vitest/Undici/WASM provedfull522componentSBOMbutauditbrace/minimatch2high and found published1286fixture-rootassumption; thattwo-filetestfix is underindependentreview. No remote orlocalstatusmanufacture/ignores/dismissal/paidfallback.
seonghobae commentedon Oct 5, 2026
Read-only bounded compatibility continuation — 2026-10-05 09:27 KST
The retained official brace-expansion 5.0.12 candidate now has real bounded ordinary upstream compatibility evidence: 183 fixtures (36 selected index assertions + 147 Bash records), each run through ESM and CJS, 366/366 PASS under Node 22.23.3. Each case used a new subprocess, 5-second timeout and 256 MiB heap. Parent independently verified all 366 results, 368 raw subprocess logs and 56 original input hashes; exit 0. Initial preflight group-count failure is preserved and was a harness setup defect, not a product regression. Full upstream suite and heavy DoS/stack/rewrite cases are intentionally NOT_RUN.
Report: /Users/seonghobae/.hermes/cache/scratch/bandscope-brace-bounded-20261005-0900/report-ko.md
Receipt SHA256: b23ed253ebe09db7818aabafb912f63b7f144b4251261514fd575e472f6024ac
Official maintainer archive remains gitHead f3410159d768f56c9d9f4511d3e1b46425fc1099 / SHA256 e57626607779f7b931f3c329f37e316a3e1ec3144e5bd1639d134bb0d979a49d. This is retained-candidate acceptance, not a new registry freshness claim or production fix.
Also re-ran exact published #1286 caffb9a baseline/toolchain tests against original and retained actual nested combined dependency JSON: 75/75 PASS on each. Test SHA256 b05a0beb3c977a5b7ed4db9178a6f9e0ae856fd29555ab10133a1e29ef6fd594. Combined lock SHA256 de374a32e3826d68d20fc4388ede54eb25741df147381f5a8328f04f1ae8f4e2. Earlier incomplete scratch inputs caused 72 PASS/3 FileNotFound failures; adding the unchanged runtime/workflow inputs repaired only the harness. Those failures are preserved and are not product TDD RED.
Fresh #866 remains OPEN/Draft, unmerged, exact 7156aeb. No explicit source-lane release was found. #1206 stays read-only: no production manifest/lock changes, new writer/PR, branch, commit/push, or mutable stacking. Existing candidate Undici HIGH/jsdom MODERATE audit failure and candidate SBOM NOT_RUN remain; combined audit brace/minimatch 2 HIGH remains. Current #1134 failed-review uncommitted edits are preserved. Normal protected ancestry, audit/SBOM/security/platform checks and qualifying independent approval are still required.
Security Notes
Untrusted retained fixtures/artifacts were hash-bound and bounded; argument-array subprocesses used a nonsecret environment and private scratch cwd. No network sandbox certification, private audio, credential reads, license/permission changes, artifact deletion or audit suppression. User/external palette was not read, restored or staged. Evidence execution does not release the owner lane or authorize merge.