# Dependency advisory refresh and bounded remediation — 24 October 2026

The live NuGet and npm audits were refreshed against the actual locked graph. Original failing
results remain under `.artifacts/p9-requal-01/security-before-pins/`; successor results are under
`.artifacts/p9-requal-01/security/`. These are package-presence findings, not a reproduced exploit
or proof of application reachability. No production package, service or image was changed.

| Finding | Before | Minimal correction | Successor |
| --- | --- | --- | --- |
| P9-REQUAL-SEC01 | MimeKit4.17.0 resolves Pkcs8.0.1; high and moderate denial-of-service advisories | Direct Pkcs8.0.2 security floor, preserving supported8.x API; refresh API and both test-project locks | Live API NuGet graph reports no vulnerable packages |
| P9-REQUAL-SEC02 | Next16.3.8 matches critical/high advisories | Pin Next and matching ESLint config16.4.1; matching Next compiler/environment packages change together | Live npm policy passes, zero reported vulnerabilities |
| P9-REQUAL-SEC03 | Dev-only ESLint hooks chain resolves Zod4.5.4 | Override4.6.6, within existing compatible4.x range | Live npm policy passes; no exception bypass |
| P9-REQUAL-SEC04 | Sidecar Linux hash lock contains reported advisories across eight packages, including upload parsers and ML dependencies | No broad parser/ML transition attempted; separately validated remediation required | OPEN; exact-pin advisory coverage also INCOMPLETE |

The additional [Python review](PYTHON_SECURITY.md) queries all49 exact Linux lock pins. Its
[machine-readable evidence](python-advisories.json) records98 queries,97 successful responses and
one PyPI404 for the vendor-local `torch==2.6.0+cpu` release; the exact OSV query succeeds. The249
provider records group into109 sets of published aliases across eight packages. These are not109
independent CVEs or reproduced exploits. Published records include critical/high labels. The
untrusted-upload path reaches the PDF/image libraries; existing limits do not close these findings.
Major parser/ML compatibility, model integrity and complete release validation are separate work.
The sidecar source, hash lock and configured model remain unchanged. Overall security is **OPEN**.

The current static export does not run the Next server's image optimizer, Server Actions or
`use cache`. Existing Sharp0.35.5 also satisfies the published image-optimizer workaround. Those
facts bound exposure; they do not erase the package advisory or justify keeping a vulnerable
development-server dependency. No hostile denial-of-service or RCE payload was executed.

Primary advisory records:

- [Pkcs signature verification CPU exhaustion](https://github.com/advisories/GHSA-846f-f764-76mx)
  and [Windows envelope decoding](https://github.com/advisories/GHSA-2fmv-rv2c-59x7):8.0.2 is patched.
- [Next image optimization](https://github.com/advisories/GHSA-2464-fhr4-w9xw),
  [Server Actions](https://github.com/advisories/GHSA-p3m5-59mp-jv5r) and
  [typed-array cache result](https://github.com/advisories/GHSA-673q-mjm6-r5xr).
- [Zod collection validation](https://github.com/advisories/GHSA-mrhx-c7xc-m3w5):4.6.6 is patched.

No unrelated package versions changed. Installation used the existing lock with lifecycle scripts
disabled; production static build, full types/lint, backend1,123/1,123, frontend934/934 in105 suites
and MariaDB32/32 pass after the pins. Complete browser/PDF successors and the final source/report
manifest remain separately accounted in the final validation ledger. Earlier pre-pin passing runs
are retained as superseded evidence rather than added to these totals.

Existing offline supply-chain/evaluator/browser-runtime/ingress/SMTP/dependency-policy/extension
guards pass. Tracked-secret scanning and SBOM generation pass. Those checks are narrower than an
application security certification or a clean Python advisory gate. The inherited temporary dev-advisory policy expires on
1November2026UTC; it was neither broadened nor extended, and the current npm audit uses no exception.
Production still requires independent ingress, deployed identity, storage/recovery, provider,
monitoring and human release qualifications.