cesnimda
12 lines
2.0 KiB
Markdown
12 lines
2.0 KiB
Markdown
# Dependency advisory addendum
|
|
|
|
29 October 2026. Evidence is point-in-time and separate from the sealed source-diff scan.
|
|
|
|
The solution-wide transitive NuGet audit completed using the installed .NET 9 SDK. It reports one distinct moderate advisory, repeated for the API and its unit-test consumer: inherited `MySqlConnector` 2.4.0, [GHSA-473q-m89c-ghf8](https://github.com/advisories/GHSA-473q-m89c-ghf8). The advisory affects versions before 2.6.1 when `VerifyCA`/`VerifyFull` is used without a configured CA and authentication can send a password before certificate verification. Its stated workarounds include a configured CA or a local connection. This is an existing dependency, not introduced by the A/B/C/D changes.
|
|
|
|
Evidence: `.artifacts/pre-phase10-ux/integration-nuget-audit-02.json`. The first invocation used an unsupported SDK option and performed no audit; that retained attempt is `integration-nuget-audit-01.json`. Neither file is relabelled as a clean dependency result.
|
|
|
|
The isolated MariaDB lane explicitly uses loopback with `SslMode=None`; it does not test this TLS mode or establish deployed TLS safety. Production configuration and services were not inspected or changed. Required release-owner action: establish whether deployed connection/authentication settings meet the advisory preconditions, then qualify an upgraded connector or enforce an appropriate trusted CA before production acceptance. Any driver change must independently rerun real MariaDB migration, transactions and RD21 tests; it is not bundled into a running frozen UX regression.
|
|
|
|
Other recorded audits: production npm has zero known advisories; full npm retains five low-severity development-tool entries. The 48-dependency Python import lock has zero reported known vulnerabilities. Source and artifacts for these checks are in `.artifacts/pre-phase10-ux/integration-independent-01/`. These results do not prove absence of unknown vulnerabilities, qualify parser fuzzing or close production infrastructure/model/cache debt. Security/privacy remains CONDITIONAL and production NO-GO.
|