fix(security): pin compatible patched dependency versions

2026-10-24 09:05:23 +02:00
parent 75cd04cfc2
commit 780b9bc64f
8 changed files with 116 additions and 68 deletions
@@ -26,3 +26,6 @@ Production-only gates do not automatically veto Phase9. Conditional Phase10 requ
 - Ruling: use the clean existing checkout on the explicitly requested dedicated branch; retain installed tooling and historical raw evidence, without creating another checkout or asking for routine confirmation.
 - Pre-flight: CI transport changes may affect fixture guards; keep default loopback protection and require verified private lifecycle before adding any CI-service endpoint. Performance source is separate; execute its workload without other qualification workloads.
 - Task1: started. Task2: started. Task3: started. Task4/5: pending.
+- Task2: complete safe workflow checkpoint `75cd04c`; fresh hosted847 explicitly BLOCKED at first isolation gate. Merged host socket/network are unknown infrastructure, not permission to execute Docker.
+- Ruling: live audits reproduced vulnerable Pkcs/Next/Zod locks; apply compatible narrow pins and refresh locked graphs, then supersede affected pre-pin results. No application flow/API/schema change or policy bypass.
+- Post-pin checkpoint: NuGet/npm audits clear, backend1123, frontend934/105suites, MariaDB32, types/lint/static build pass. Frozen1042 runtime inputs recorded before full browser lanes. Independent review found missing P9-V02 register row; repaired, with56 unique findings including3 new security items.
@@ -0,0 +1,39 @@
+# Dependency advisory refresh and bounded remediation — 24 October 2026
+
+The live NuGet and npm audits were refreshed against the actual locked graph. Original failing
+results remain under `.artifacts/p9-requal-01/security-before-pins/`; successor results are under
+`.artifacts/p9-requal-01/security/`. These are package-presence findings, not a reproduced exploit
+or proof of application reachability. No production package, service or image was changed.
+
+| Finding | Before | Minimal correction | Successor |
+| --- | --- | --- | --- |
+| P9-REQUAL-SEC01 | MimeKit4.17.0 resolves Pkcs8.0.1; high and moderate denial-of-service advisories | Direct Pkcs8.0.2 security floor, preserving supported8.x API; refresh API and both test-project locks | Live API NuGet graph reports no vulnerable packages |
+| P9-REQUAL-SEC02 | Next16.3.8 matches critical/high advisories | Pin Next and matching ESLint config16.4.1; matching Next compiler/environment packages change together | Live npm policy passes, zero reported vulnerabilities |
+| P9-REQUAL-SEC03 | Dev-only ESLint hooks chain resolves Zod4.5.4 | Override4.6.6, within existing compatible4.x range | Live npm policy passes; no exception bypass |
+
+The current static export does not run the Next server's image optimizer, Server Actions or
+`use cache`. Existing Sharp0.35.5 also satisfies the published image-optimizer workaround. Those
+facts bound exposure; they do not erase the package advisory or justify keeping a vulnerable
+development-server dependency. No hostile denial-of-service or RCE payload was executed.
+
+Primary advisory records:
+
+- [Pkcs signature verification CPU exhaustion](https://github.com/advisories/GHSA-846f-f764-76mx)
+  and [Windows envelope decoding](https://github.com/advisories/GHSA-2fmv-rv2c-59x7):8.0.2 is patched.
+- [Next image optimization](https://github.com/advisories/GHSA-2464-fhr4-w9xw),
+  [Server Actions](https://github.com/advisories/GHSA-p3m5-59mp-jv5r) and
+  [typed-array cache result](https://github.com/advisories/GHSA-673q-mjm6-r5xr).
+- [Zod collection validation](https://github.com/advisories/GHSA-mrhx-c7xc-m3w5):4.6.6 is patched.
+
+No unrelated package versions changed. Installation used the existing lock with lifecycle scripts
+disabled; production static build, full types/lint, backend1,123/1,123, frontend934/934 in105 suites
+and MariaDB32/32 pass after the pins. Complete browser/PDF successors and the final source/report
+manifest remain separately accounted in the final validation ledger. Earlier pre-pin passing runs
+are retained as superseded evidence rather than added to these totals.
+
+Existing offline supply-chain/evaluator/browser-runtime/ingress/SMTP/dependency-policy/extension
+guards pass. Tracked-secret scanning and SBOM generation pass. Those checks are narrower than an
+application security certification. The inherited temporary dev-advisory policy expires on
+1November2026UTC; it was neither broadened nor extended, and the current npm audit uses no exception.
+Production still requires independent ingress, deployed identity, storage/recovery, provider,
+monitoring and human release qualifications.