cesnimda
3.0 KiB
Dependency advisory refresh and bounded remediation — 24 October 2026
The live NuGet and npm audits were refreshed against the actual locked graph. Original failing
results remain under .artifacts/p9-requal-01/security-before-pins/; successor results are under
.artifacts/p9-requal-01/security/. These are package-presence findings, not a reproduced exploit
or proof of application reachability. No production package, service or image was changed.
| Finding | Before | Minimal correction | Successor |
|---|---|---|---|
| P9-REQUAL-SEC01 | MimeKit4.17.0 resolves Pkcs8.0.1; high and moderate denial-of-service advisories | Direct Pkcs8.0.2 security floor, preserving supported8.x API; refresh API and both test-project locks | Live API NuGet graph reports no vulnerable packages |
| P9-REQUAL-SEC02 | Next16.3.8 matches critical/high advisories | Pin Next and matching ESLint config16.4.1; matching Next compiler/environment packages change together | Live npm policy passes, zero reported vulnerabilities |
| P9-REQUAL-SEC03 | Dev-only ESLint hooks chain resolves Zod4.5.4 | Override4.6.6, within existing compatible4.x range | Live npm policy passes; no exception bypass |
The current static export does not run the Next server's image optimizer, Server Actions or
use cache. Existing Sharp0.35.5 also satisfies the published image-optimizer workaround. Those
facts bound exposure; they do not erase the package advisory or justify keeping a vulnerable
development-server dependency. No hostile denial-of-service or RCE payload was executed.
Primary advisory records:
- Pkcs signature verification CPU exhaustion and Windows envelope decoding:8.0.2 is patched.
- Next image optimization, Server Actions and typed-array cache result.
- Zod collection validation:4.6.6 is patched.
No unrelated package versions changed. Installation used the existing lock with lifecycle scripts disabled; production static build, full types/lint, backend1,123/1,123, frontend934/934 in105 suites and MariaDB32/32 pass after the pins. Complete browser/PDF successors and the final source/report manifest remain separately accounted in the final validation ledger. Earlier pre-pin passing runs are retained as superseded evidence rather than added to these totals.
Existing offline supply-chain/evaluator/browser-runtime/ingress/SMTP/dependency-policy/extension guards pass. Tracked-secret scanning and SBOM generation pass. Those checks are narrower than an application security certification. The inherited temporary dev-advisory policy expires on 1November2026UTC; it was neither broadened nor extended, and the current npm audit uses no exception. Production still requires independent ingress, deployed identity, storage/recovery, provider, monitoring and human release qualifications.