Repository navigation

build(node): pin npm integrity and Node 22/jsdom 30 compatibility - #896

Draft

seonghobae wants to merge 168 commits into

developfrom

fix/node-22-22-2-jsdom-30-779

Commits on Aug 7, 2026
- test(supply-chain): require deterministic npm lock generator
  seonghobae
  committed
  4294ddc
- fix(supply-chain): pin npm lock generator metadata
  seonghobae
  committed
  afb20be
- ci(supply-chain): prove npm version and lock reproduction
  seonghobae
  committed
  e64c229
- docs(supply-chain): record npm generator provenance
  seonghobae
  committed
  ebbde9b
- docs(changelog): record npm generator contract
  seonghobae
  committed
  694ca83
- fix(supply-chain): avoid serializing npm into runtime engines
  seonghobae
  committed
  90dc2a0
- test(supply-chain): keep npm enforcement out of runtime engines
  seonghobae
  committed
  fecc36b
- docs(supply-chain): separate npm generator from runtime engines
  seonghobae
  committed
  9eb83c3
- ci(supply-chain): publish deterministic lock reproduction evidence
  seonghobae
  committed
  5609b88
- test(supply-chain): require preserved lock reproduction evidence
  seonghobae
  committed
  032314d
- test(security): require coordinated PDF.js and Undici baseline
  seonghobae
  committed
  0263ad4
- test(security): disable PDF expression evaluation
  seonghobae
  committed
  2cbf767
- fix(security): pin the patched Undici transitive version
  seonghobae
  committed
  475de96
- fix(security): pin the patched PDF.js release
  seonghobae
  committed
  deb74ac
- fix(security): disable PDF expression evaluation
  seonghobae
  committed
  dc90d5b
- docs(security): record coordinated PDF and HTTP remediation
  seonghobae
  committed
  b23b957
- docs(changelog): record coordinated security remediation
  seonghobae
  committed
  2e99f72
- fix(security): anchor the Undici override to an exact root floor
  seonghobae
  committed
  8f50fe4
- test(security): bind exact root floor and npm package locations
  seonghobae
  committed
  e2c0c2d
- ci(pr783): import exact npm 10.9.8 lock artifact
  seonghobae
  committed
  dd93f96
- fix(score): align PDF.js boundary with 6.2.108 API
  seonghobae
  committed
  dd8d1ac
- test(score): prove the supported data-only PDF.js boundary
  seonghobae
  committed
  988dc1d
- docs(security): record the supported PDF.js 6.2.108 boundary
  seonghobae
  committed
  a39e37f
- docs(changelog): describe the supported patched PDF boundary
  seonghobae
  committed
  6b753e6
- ci(pr783): rerun lock import after supported API repair
  seonghobae
  committed
  b773653
- ci(pr783): publish the verified lock from the bounded importer
  seonghobae
  committed
  01cb39e
- ci(pr783): fetch complete lineage for verified lock publication
  seonghobae
  committed
  ad558ac
- fix(security): import verified npm 10.9.8 lock
  github-actions[bot]
  committed
  83865dc
- test(ci): preserve canonical npm provenance formatting
  seonghobae
  committed
  e6b48ca
- ci(pr783): diagnose Ruff import ordering
  seonghobae
  committed
  3edf173
- style(ci): normalize security test imports
  seonghobae
  committed
  2345219
- style(ci): normalize npm provenance test imports
  seonghobae
  committed
  dc7e8b4
- chore(ci): remove completed Ruff diagnostic
  seonghobae
  committed
  c5ee630
- ci(pr783): finalize exact Ruff formatting
  seonghobae
  committed
  f0c9ad1
- chore(ci): remove temporary branch writer
  seonghobae
  committed
  102a89f
- style(test): apply Ruff formatting to security contracts
  seonghobae
  committed
  d4887ec
- style(test): finish Ruff formatting for npm provenance
  seonghobae
  committed
  459abdd
Commits on Aug 11, 2026
- fix(security): refresh vulnerable npm transitive pins
  seonghobae
  committed
  ace4257
- fix(deps): restore manifest-lock consistency
  seonghobae
  committed
  63d0ae6
Commits on Aug 14, 2026
- ci: add one-shot canonical lock repair for PR 783
  seonghobae
  committed
  6bba612
- fix(deps): regenerate canonical npm 10.9.8 lock
  github-actions[bot]
  committed
  ef938fa
- ci: retrigger exact-head validation after canonical lock generation
  seonghobae
  committed
  a48ff96
- ci: add one-shot Ruff formatter for PR 783
  seonghobae
  committed
  fd9389a
- style(test): apply canonical Ruff formatting
  github-actions[bot]
  committed
  afba132
- ci: retrigger exact-head validation after canonical Ruff formatting
  seonghobae
  committed
  e214e96
- fix(test): verify canonical hoisted PDF.js lock record
  seonghobae
  committed
  0cd6836
- ci: add final one-shot Ruff formatter for PR 783
  seonghobae
  committed
  f4a5a19
- style(test): apply final canonical Ruff formatting
  github-actions[bot]
  committed
  219267e
- chore(ci): retrigger exact-head protected checks
  seonghobae
  committed
  db7b1c1
- fix(ci): validate npm lock without mutable resolution
  seonghobae
  committed
  f4d8850
- test(supply-chain): format npm toolchain contract
  seonghobae
  committed
  8a143ab
- test(supply-chain): satisfy ruff formatting gate
  seonghobae
  committed
  b3ac826
- test(supply-chain): format npm toolchain contract
  seonghobae
  committed
  885c037
- test(supply-chain): apply repository Ruff width
  seonghobae
  committed
  de0cd6b
- docs(security): align npm lock provenance with frozen validation
  seonghobae
  committed
  f3cfae4
- fix(ci): disable persisted checkout credentials
  seonghobae
  committed
  de75178
- docs(changelog): correct UI test coverage claim
  seonghobae
  committed
  164e6f2
Commits on Aug 15, 2026
- test(lock): reject esbuild peer metadata drift
  seonghobae
  committed
  07c1dd2
- docs(lock): record esbuild metadata sentinel
  seonghobae
  committed
  ad4551b
- docs(changelog): record lock metadata drift gate
  seonghobae
  committed
  6f81f52
- fix(security): make PDF XML boundary explicit
  seonghobae
  committed
  6665f02
- test(security): lock down PDF parser options
  seonghobae
  committed
  bf5a3a3
- docs(security): record PDF parser hardening evidence
  seonghobae
  committed
  c65f5b1
- docs(security): correct PDF.js advisory attribution
  seonghobae
  committed
  dae5d3c
Commits on Aug 17, 2026
- test(build): require coordinated Node 22.22.2 and jsdom 30 floor
  seonghobae
  committed
  afdecc5
- test(build): align Node floor contract with canonical npm generator
  seonghobae
  committed
  1dbe037
- merge: stack Node compatibility migration on dependency baseline
  seonghobae
  committed
  66c97c2
- build(node): raise supported Node 22 floor
  seonghobae
  committed
  32cf47c
- build(deps-dev): adopt jsdom 30 on coordinated Node floor
  seonghobae
  committed
  f74beb0
- docs(build): publish Node 22.22.2 minimum
  seonghobae
  committed
  2affed5
- test(build): align npm provenance with Node compatibility floor
  seonghobae
  committed
  65d199d
- test(build): require explicit minimum-Node npm bootstrap lane
  seonghobae
  committed
  c721cee
- ci(build): add exact Node 22.22.2 compatibility lane
  seonghobae
  committed
  fcb0b27
- test(build): audit canonical runtime documentation paths
  seonghobae
  committed
  aa527bb
- test(ci): prevent pre-bootstrap npm cache discovery
  seonghobae
  committed
  5b50c59
- fix(ci): bootstrap canonical npm before cache discovery
  seonghobae
  committed
  783112b
- docs(build): reconcile Node floor with npm generator provenance
  seonghobae
  committed
  e004765
- test(ci): require setup-node automatic cache opt-out
  seonghobae
  committed
  b3a3c91
- fix(ci): disable setup-node auto cache before npm bootstrap
  seonghobae
  committed
  feb4136
- test(node): require Corepack npm bootstrap and lock provenance
  seonghobae
  committed
  a256606
- fix(node): harden npm bootstrap and capture lock provenance
  seonghobae
  committed
  9eb5c10
- test(node): assert direct workspace jsdom resolution
  seonghobae
  committed
  6f5d1e4
- fix(ci): keep Node floor lane frozen-install only
  seonghobae
  committed
  0766cdb
- fix(ci): satisfy workflow supply-chain baseline
  seonghobae
  committed
  8596bd1
Commits on Aug 18, 2026
- test(ci): preserve credential-free lock validation in node floor
  seonghobae
  committed
  ce45742
- fix(ci): inherit credential-free lock validation
  seonghobae
  committed
  c07e516
Commits on Aug 29, 2026
Commits on Sep 2, 2026
- build(deps-dev): bump eslint from 10.8.1 to 10.9.1
  dependabot[bot]
  authored
  32bbb8b
Commits on Sep 4, 2026
- chore(node): restack npm compatibility owner on protected develop
  seonghobae
  committed
  fc3d1ec
Commits on Sep 6, 2026
- ⚡ Bolt: [performance improvement] Replace O(N^2) list membership checks with O(1) dictionary key deduplication in chart export
  seonghobae
  committed
  f52dc97
- repair(ci): drop superseded chart note from Ruff owner
  seonghobae
  committed
  0725eb3
- repair(ci): return chart optimization to canonical owner
  seonghobae
  committed
  1d38e8e
- repair(ci): restore protected chart bytes exactly
  seonghobae
  committed
  a7b0030
- Trigger CI retry
  seonghobae
  committed
  340b0a3
- Trigger CI retry
  seonghobae
  committed
  8488a02
Commits on Sep 7, 2026
- Trigger CI retry
  seonghobae
  committed
  8fe6b6d
- build(node): generate canonical jsdom and eslint lock
  seonghobae
  committed
  2a581dd
- chore(node): reconcile consolidated protected workflows
  seonghobae
  committed
  de67a0d
- chore(ci): integrate canonical Ruff repair
  seonghobae
  committed
  1a27cc3
Commits on Sep 17, 2026
- test(node): require bounded fail-closed npm activation
  seonghobae
  committed
  d0738d7
- fix(node): add bounded pinned npm runtime acquisition
  seonghobae
  committed
  da536ed
- fix(build): retry exact Corepack npm acquisition
  seonghobae
  committed
  05dba77
- test(node): align provenance contract with bounded activation helper
  seonghobae
  committed
  b780be8
- docs(node): record bounded pinned npm acquisition RCA
  seonghobae
  committed
  0a01aeb
- test(node): execute bounded npm acquisition failure paths
  seonghobae
  committed
  fa73542
- test(node): prove bounded npm acquisition success and exhaustion
  seonghobae
  committed
  8e0b361
- test(node): reject retries for npm signature failures
  seonghobae
  committed
  4b64860
- fix(node): fail fast on npm provenance errors
  seonghobae
  committed
  02ae089
- fix(node): recognize current Corepack signature failure
  seonghobae
  committed
  61713a2
Commits on Sep 18, 2026
- docs(node): classify npm acquisition trust failures
  seonghobae
  committed
  3983dd2
- test(build): fail closed on unclassified npm acquisition errors
  seonghobae
  committed
  b8fcb79
- fix(build): retry only admitted npm acquisition timeouts
  seonghobae
  committed
  9c39c2a
- test(build): classify retry fixture as ETIMEDOUT
  seonghobae
  committed
  68f71e0
- docs(traceability): fail closed on unknown Corepack failures
  seonghobae
  committed
  f7341ee
- repair(scope): release baseline and formatter ownership
  seonghobae
  committed
  b025062
- test(node): require canonical npm activation in minimum lane
  seonghobae
  committed
  3292884
- fix(ci): reuse pinned npm activation in minimum Node lane
  seonghobae
  committed
  97042e1
- docs(traceability): record single npm activation owner
  seonghobae
  committed
  3b6ddce
- test(node): align minimum-lane contract with npm activation owner
  seonghobae
  committed
  e2420be
- test(node): expose duplicate CI npm activation owners
  seonghobae
  committed
  4830abb
- fix(ci): centralize npm activation in registered CI
  seonghobae
  committed
  99b0707
- docs(node): trace registered CI activation ownership
  seonghobae
  committed
  c010a66
- merge(ci): inherit canonical supply-chain formatter prerequisite
  seonghobae
  committed
  b5dc5bf
- fix(node): align activation regressions with stacked CI owner
  seonghobae
  committed
  78bcc37
- docs(node): record lint RCA and canonical prerequisite stack
  seonghobae
  committed
  636b477
- docs(node): preserve CI visibility across prerequisite ancestry
  seonghobae
  committed
  5c60103
- ci(python): emit Ruff formatter diff on gate failure
  seonghobae
  committed
  81d7cd9
- fix(node): format npm runtime regression tests
  seonghobae
  committed
  239bfc7
- docs(node): record exact-head Ruff failure repair
  seonghobae
  committed
  984d038
- fix(node): keep activation index lint-compatible
  seonghobae
  committed
  8507c21
- docs(node): record lint-width repair
  seonghobae
  committed
  2d9428c
- test(node): align CI provenance contract with activation helper
  seonghobae
  committed
  86b51c6
Commits on Sep 21, 2026
- test(node): require integrity-bound npm packageManager locator
  seonghobae
  committed
  fb73bc9
- fix(node): integrity-pin npm 10.9.9 for Corepack
  seonghobae
  committed
  29361c9
- fix(node): require integrity-bound npm Corepack locator
  seonghobae
  committed
  f0a0c42
- test(node): exercise hashed npm locator in activation harness
  seonghobae
  committed
  bbcdd31
- test(node): keep nontransient failures on hashed npm locator
  seonghobae
  committed
  8feed8a
- test(node): bind npm toolchain contract to artifact integrity
  seonghobae
  committed
  ae07856
- docs(traceability): record npm artifact integrity pin
  seonghobae
  committed
  347530b
- test(node): discover every npm-consuming workflow
  seonghobae
  committed
  ff14b04
- test(node): tolerate reusable workflow call jobs
  seonghobae
  committed
  ce4d526
- docs(node): trace workflow npm consumer discovery
  seonghobae
  committed
  6719ead
- test(ci): reject inline npm runtime activation
  seonghobae
  committed
  628aa96
- fix(ci): route release npm activation through canonical helper
  seonghobae
  committed
  2ddd8b1
- fix(ci): route security npm activation through canonical helper
  seonghobae
  committed
  ab04754
- test(ci): cover every direct npm workflow invocation
  seonghobae
  committed
  df20e63
- docs(traceability): record canonical npm activation path
  seonghobae
  committed
  8113cbf
- style(ci): apply canonical ruff formatting
  seonghobae
  committed
  190a052
- style(ci): format npm integrity regression
  seonghobae
  committed
  a41a2e5
- style(ci): format npm toolchain regression
  seonghobae
  committed
  6366eb6
- docs(traceability): record npm gate RCA and formatter repair
  seonghobae
  committed
  8eb47f7
- test(ci): remove legacy inline npm activation fallback
  seonghobae
  committed
  a990e7c
- docs(traceability): align npm policy regressions
  seonghobae
  committed
  a7500e3
- test(ci): expose shell-wrapped npm consumer blind spots
  seonghobae
  committed
  19ddd51
- fix(ci): detect npm behind shell control flow
  seonghobae
  committed
  dc726ef
- docs(traceability): record shell npm admission boundary
  seonghobae
  committed
  8f03e7f
- test(node): reject mixed integrity timeout acquisition failure
  seonghobae
  committed
  bc26032
- fix(node): prioritize provenance failures over timeout retry
  seonghobae
  committed
  4cee8f5
- docs(node): trace mixed Corepack failure precedence
  seonghobae
  committed
  61195d9
- test(node): catch shell continuation npm command bypass
  seonghobae
  committed
  237ff47
- fix(node): normalize shell continuations before npm admission
  seonghobae
  committed
  eee83e3
- docs(node): trace shell continuation npm admission repair
  seonghobae
  committed
  6763d91
- fix(node): keep npm classifier compatible with macOS bash
  seonghobae
  committed
  2a08003
- test(node): keep package-manager integrity assertion in its owner
  seonghobae
  committed
  e3ecc44
- test(node): lock portable npm timeout classification
  seonghobae
  committed
  4974765
- docs(node): trace hosted npm classifier portability repair
  seonghobae
  committed
  c37835f

Commits

Commits on Aug 7, 2026

Commits on Aug 11, 2026

Commits on Aug 14, 2026

Commits on Aug 15, 2026

Commits on Aug 17, 2026

Commits on Aug 18, 2026

Commits on Aug 29, 2026

Commits on Sep 2, 2026

Commits on Sep 4, 2026

Commits on Sep 6, 2026

Commits on Sep 7, 2026

Commits on Sep 17, 2026

Commits on Sep 18, 2026