fix(security): pin compatible patched dependency versions

2026-10-24 09:05:23 +02:00
parent 75cd04cfc2
commit 780b9bc64f
8 changed files with 116 additions and 68 deletions
@@ -26,3 +26,6 @@ Production-only gates do not automatically veto Phase9. Conditional Phase10 requ
 - Ruling: use the clean existing checkout on the explicitly requested dedicated branch; retain installed tooling and historical raw evidence, without creating another checkout or asking for routine confirmation.
 - Pre-flight: CI transport changes may affect fixture guards; keep default loopback protection and require verified private lifecycle before adding any CI-service endpoint. Performance source is separate; execute its workload without other qualification workloads.
 - Task1: started. Task2: started. Task3: started. Task4/5: pending.
+- Task2: complete safe workflow checkpoint `75cd04c`; fresh hosted847 explicitly BLOCKED at first isolation gate. Merged host socket/network are unknown infrastructure, not permission to execute Docker.
+- Ruling: live audits reproduced vulnerable Pkcs/Next/Zod locks; apply compatible narrow pins and refresh locked graphs, then supersede affected pre-pin results. No application flow/API/schema change or policy bypass.
+- Post-pin checkpoint: NuGet/npm audits clear, backend1123, frontend934/105suites, MariaDB32, types/lint/static build pass. Frozen1042 runtime inputs recorded before full browser lanes. Independent review found missing P9-V02 register row; repaired, with56 unique findings including3 new security items.