cesnimda
50 lines
4.1 KiB
Markdown
50 lines
4.1 KiB
Markdown
# Dependency advisory refresh and bounded remediation — 24 October 2026
|
|
|
|
The live NuGet and npm audits were refreshed against the actual locked graph. Original failing
|
|
results remain under `.artifacts/p9-requal-01/security-before-pins/`; successor results are under
|
|
`.artifacts/p9-requal-01/security/`. These are package-presence findings, not a reproduced exploit
|
|
or proof of application reachability. No production package, service or image was changed.
|
|
|
|
| Finding | Before | Minimal correction | Successor |
|
|
| --- | --- | --- | --- |
|
|
| P9-REQUAL-SEC01 | MimeKit4.17.0 resolves Pkcs8.0.1; high and moderate denial-of-service advisories | Direct Pkcs8.0.2 security floor, preserving supported8.x API; refresh API and both test-project locks | Live API NuGet graph reports no vulnerable packages |
|
|
| P9-REQUAL-SEC02 | Next16.3.8 matches critical/high advisories | Pin Next and matching ESLint config16.4.1; matching Next compiler/environment packages change together | Live npm policy passes, zero reported vulnerabilities |
|
|
| P9-REQUAL-SEC03 | Dev-only ESLint hooks chain resolves Zod4.5.4 | Override4.6.6, within existing compatible4.x range | Live npm policy passes; no exception bypass |
|
|
| P9-REQUAL-SEC04 | Sidecar Linux hash lock contains reported advisories across eight packages, including upload parsers and ML dependencies | No broad parser/ML transition attempted; separately validated remediation required | OPEN; exact-pin advisory coverage also INCOMPLETE |
|
|
|
|
The additional [Python review](PYTHON_SECURITY.md) queries all49 exact Linux lock pins. Its
|
|
[machine-readable evidence](python-advisories.json) records98 queries,97 successful responses and
|
|
one PyPI404 for the vendor-local `torch==2.6.0+cpu` release; the exact OSV query succeeds. The249
|
|
provider records group into109 sets of published aliases across eight packages. These are not109
|
|
independent CVEs or reproduced exploits. Published records include critical/high labels. The
|
|
untrusted-upload path reaches the PDF/image libraries; existing limits do not close these findings.
|
|
Major parser/ML compatibility, model integrity and complete release validation are separate work.
|
|
The sidecar source, hash lock and configured model remain unchanged. Overall security is **OPEN**.
|
|
|
|
The current static export does not run the Next server's image optimizer, Server Actions or
|
|
`use cache`. Existing Sharp0.35.5 also satisfies the published image-optimizer workaround. Those
|
|
facts bound exposure; they do not erase the package advisory or justify keeping a vulnerable
|
|
development-server dependency. No hostile denial-of-service or RCE payload was executed.
|
|
|
|
Primary advisory records:
|
|
|
|
- [Pkcs signature verification CPU exhaustion](https://github.com/advisories/GHSA-846f-f764-76mx)
|
|
and [Windows envelope decoding](https://github.com/advisories/GHSA-2fmv-rv2c-59x7):8.0.2 is patched.
|
|
- [Next image optimization](https://github.com/advisories/GHSA-2464-fhr4-w9xw),
|
|
[Server Actions](https://github.com/advisories/GHSA-p3m5-59mp-jv5r) and
|
|
[typed-array cache result](https://github.com/advisories/GHSA-673q-mjm6-r5xr).
|
|
- [Zod collection validation](https://github.com/advisories/GHSA-mrhx-c7xc-m3w5):4.6.6 is patched.
|
|
|
|
No unrelated package versions changed. Installation used the existing lock with lifecycle scripts
|
|
disabled; production static build, full types/lint, backend1,123/1,123, frontend934/934 in105 suites
|
|
and MariaDB32/32 pass after the pins. Complete browser/PDF successors and the final source/report
|
|
manifest remain separately accounted in the final validation ledger. Earlier pre-pin passing runs
|
|
are retained as superseded evidence rather than added to these totals.
|
|
|
|
Existing offline supply-chain/evaluator/browser-runtime/ingress/SMTP/dependency-policy/extension
|
|
guards pass. Tracked-secret scanning and SBOM generation pass. Those checks are narrower than an
|
|
application security certification or a clean Python advisory gate. The inherited temporary dev-advisory policy expires on
|
|
1November2026UTC; it was neither broadened nor extended, and the current npm audit uses no exception.
|
|
Production still requires independent ingress, deployed identity, storage/recovery, provider,
|
|
monitoring and human release qualifications.
|