fix(security): establish canonical npm, PDF.js, Nanoid, and Undici baseline - #783
fix(security): establish canonical npm, PDF.js, Nanoid, and Undici baseline#783seonghobae wants to merge 64 commits into
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughWalkthroughnpm 10.9.8을 manifest와 CI에 고정하고 frozen lockfile 검증을 추가했습니다. PDF.js 6.2.108과 Undici 7.29.0을 고정했습니다. PDF 입력을 복사된 메모리 바이트와 동일 출처 워커로 제한하고 관련 테스트와 운영 문서를 추가했습니다. Changes공급망 및 PDF 보안 기준
Estimated code review effort: 3 (Moderate) | ~25 minutes Merge Risk: 🟡 Moderate · up to The PR is not merge-ready because the required exact-head coverage evidence was not published after a failed validation path, and the required independent approval gate is still outstanding. Merge should wait for a successful rerun covering the current head and qualifying approval. Sequence Diagram(s)sequenceDiagram
participant CI
participant npm
participant Lockfile
participant Verify
participant RustCheck
CI->>npm: npm 10.9.8 확인
CI->>npm: frozen npm ci 실행
npm->>Lockfile: package-lock.json 소비
CI->>Lockfile: manifest 및 lockfile diff 검증
Verify->>CI: lock-validation 선행
RustCheck->>CI: lock-validation 선행
Possibly related PRs
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
|
@opencode-agent address Finalize the generated security lock on exact current head CI run Before committing, fail closed unless the generated lock proves all of the following:
Replace the branch lock byte-for-byte with the verified artifact and commit normally. Do not regenerate it locally, hand-edit it, create another branch/PR/workflow/helper, or include the ZIP. The next exact-head CI must reproduce a zero diff before any build/security success is accepted. |
|
/oc Refetch the live pull request and abort without writing unless it is still PR #783 on branch |
|
@coderabbitai review Please review only exact current head |
|
I will limit the review to the new npm-generator metadata regression contract, doctoring, and CHANGELOG changes. I will treat predecessor evidence as historical. I will not infer merge readiness while the central coverage/review prerequisite remains open.
|
![opencode-agent[bot]](https://avatars.githubusercontent.com/in/1549082?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull request overview
OpenCode cannot approve yet because required coverage evidence did not pass.
Review outcome
1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence
-
Problem: The required coverage-evidence job result was
failure, so OpenCode cannot establish approval sufficiency for this head. -
Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.
-
Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports
successwith required evidence or explicit no-source not-applicable evidence. -
Regression test: Keep the approval branch checking
needs.coverage-evidence.result == successbefore posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present. -
Result: REQUEST_CHANGES
-
Reason: coverage-evidence result was
failure, so required test/docstring evidence was not proven for current head6f81f52c193c1e327d078eba7a2ea3bdbfbc87c2. -
Head SHA:
6f81f52c193c1e327d078eba7a2ea3bdbfbc87c2 -
Workflow run: 31872821129
-
Workflow attempt: 1
Coverage evidence
Coverage evidence job did not run or did not publish coverage evidence.
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: ci.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow: ci.yml"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file (6 files)"]
S2 --> I2["repository behavior"]
I2 --> R2["Review risk: Changed file (6 files)"]
R2 --> V2["required checks"]
Evidence --> S3["Docs (2 files)"]
S3 --> I3["operator or user guidance"]
I3 --> R3["Review risk: Docs (2 files)"]
R3 --> V3["docs review"]
Evidence --> S4["Test (2 files)"]
S4 --> I4["regression suite"]
I4 --> R4["Review risk: Test (2 files)"]
R4 --> V4["targeted test run"]
|
Queued @cwl-noema-review for PR #783 at head |
|
Queued @cwl-noema-review for PR #783 at head |
|
Queued @cwl-noema-review for PR #783 at head |
|
Queued @cwl-noema-review for PR #783 at head |
|
Queued @cwl-noema-review for PR #783 at head |
seonghobae
changed the title
|
Queued @cwl-noema-review for PR #783 at head |
|
Queued @cwl-noema-review for PR #783 at head |
|
Queued @cwl-noema-review for PR #783 at head |
|
Queued @cwl-noema-review for PR #783 at head |
|
Queued @cwl-noema-review for PR #783 at head |
There was a problem hiding this comment.
Pull request overview
OpenCode cannot approve yet because required coverage evidence did not pass.
Review outcome
1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence
-
Problem: The required coverage-evidence job result was
failure, so OpenCode cannot establish approval sufficiency for this head. -
Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.
-
Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports
successwith required evidence or explicit no-source not-applicable evidence. -
Regression test: Keep the approval branch checking
needs.coverage-evidence.result == successbefore posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present. -
Result: REQUEST_CHANGES
-
Reason: coverage-evidence result was
failure, so required test/docstring evidence was not proven for current headdae5d3c8d055381d57c0971d8e40456711499476. -
Head SHA:
dae5d3c8d055381d57c0971d8e40456711499476 -
Workflow run: 31908253510
-
Workflow attempt: 1
Coverage evidence
Coverage evidence job did not run or did not publish coverage evidence.
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: ci.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow: ci.yml"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file (6 files)"]
S2 --> I2["repository behavior"]
I2 --> R2["Review risk: Changed file (6 files)"]
R2 --> V2["required checks"]
Evidence --> S3["Docs (2 files)"]
S3 --> I3["operator or user guidance"]
I3 --> R3["Review risk: Docs (2 files)"]
R3 --> V3["docs review"]
Evidence --> S4["Test (2 files)"]
S4 --> I4["regression suite"]
I4 --> R4["Review risk: Test (2 files)"]
R4 --> V4["targeted test run"]
2 participants
Problem
Protected
developcarries three high-severity JavaScript dependency findings and does not make the lockfile generator an enforceable repository contract:[email protected]to the current6.2.108floor; this is intentionally not attributed to the older CVE-2024-4367 / GHSA-wgrm-67xf-hhpq, which affectedpdfjs-dist <=4.1.392and was fixed in4.2.67;[email protected], fixed in3.3.18;[email protected], fixed at this repository boundary in7.29.0; andpeer: truefrom@esbuild/*locations.Atomic baseline
This PR targets protected
developdirectly and combines the npm-generator provenance slice from #782 with the coordinated PDF.js/Nanoid/Undici remediation. It is the intended atomic supply-chain baseline rather than a child stacked on #782.The implementation:
[email protected]as the approved package-lock generator;22.22.3and npm10.9.8before dependency consumption;npm ci --ignore-scripts --no-audit --no-fundin the lock gate, then rejects manifest/lock working-tree drift;npm install,npm update, andnpxmutable-resolution commands from that lock-validation job;pdfjs-distexactly to6.2.108and Undici exactly to7.29.0through the root override;[email protected]in the complete npm-generated lock artifact;@esbuild/*peer metadata and regression-gates every root platform record against silentpeer: trueloss;Provenance boundary
Historical workflow run
31161313485produced the complete npm 10.9.8 lock artifact imported into this branch, with lock SHA-25631dd2661eca864e3da46f86629a2535dc181d01449bd3a50fa3cdbd6c58e7971and zero high-severity npm audit findings at that stage. Historical generation evidence does not substitute for current-head merge evidence.CI makes the narrower claim supported by frozen-install semantics: the committed manifest/lock pair is consumable by the approved toolchain without mutation, public-registry artifacts carry integrity evidence, and known generator-sensitive
@esbuild/*peer metadata remains present. CI intentionally does not re-resolve mutable manifest ranges to claim future byte-for-byte reproduction.Strix finding triage and bounded hardening
Predecessor exact head
6f81f52c193c1e327d078eba7a2ea3bdbfbc87c2failed Strix run31871388084, job95043996826. The artifact was inspected before editing. Its only reported finding asserted XXE in[email protected]throughloadScorePdf, but the supplied PoC returned only the four-byte%PDFheader and explicitly required construction of a real PDF with embedded XML; it did not demonstrate entity expansion, local-file disclosure, network access, or parser output containing an external entity.Pinned PDF.js source was verified rather than treating the scanner claim as authoritative. Current exact head
dae5d3c8d055381d57c0971d8e40456711499476keeps the bounded defense-in-depth contract without suppressing any finding:loadScorePdfexplicitly passesenableXfa: falseanduseWorkerFetch: false; the unit test locks those options together with byte copying and the data-only API boundary; anddocs/doctoring/high-security-pdf-http-baseline.mdrecords the scanner-evidence limitation, upstream XML-parser boundary, explicit parser options, residual parser risk, rollback/evidence requirements, and APA 7 references.The doctoring also corrects a pre-existing citation defect: CVE-2024-4367 / GHSA-wgrm-67xf-hhpq is recorded with its actual affected/fixed range and is no longer misrepresented as evidence that
[email protected]was vulnerable. The6.2.108floor is justified by the repository's current security-tooling contract and exact-head validation, not by that older advisory.Exact-current-head repository evidence
Current exact head:
dae5d3c8d055381d57c0971d8e40456711499476.Protected base:
develop@acdbea6344fe1231c39535b575f4de35e4c607c9.Every visible repository-owned exact-head workflow is terminal-success:
ci;build-baseline;release;security-audit;Security Scan;sbom;SAST Semgrep;bandit; andsecret-scan-gate.Current inline review inspection has zero unresolved actionable threads. The two CodeRabbit findings on credential persistence and the inaccurate changelog coverage claim are resolved in current code; temporary-repair Scorecard threads are resolved/outdated. No repository-owned queued, in-progress, failed, skipped-required, predecessor-head, or protected-base result is being counted as current success.
Central prerequisite and review gate
Central prerequisite
ContextualWisdomLab/.github#1008is now closed unmerged and is historical only. Its current-main replacement isContextualWisdomLab/.github#1020, which explicitly supersedes #1008 and targets protected centralmain@c47afc2dc68488292c1db7c9d6f82dcd5360f181. At the latest refresh, #1020's actual exact head is2f92b585407dd3fa8c38043750015e97f6b73518; its fresh required workflow cycle is queued, so none of that evidence is counted as success and the fix is not yet inherited by protected centralmain.The latest OpenCode review on this exact BandScope head remains
CHANGES_REQUESTEDbecause the historical central coverage-evidence path failed before BandScope coverage evidence could be established. Do not rerun or re-mention reviewer agents merely to reproduce the same dependency failure. After #1020 reaches protected centralmain, regenerate central coverage/review exactly once for the then-current #783 head.There is also no qualifying independent non-author approval for this exact BandScope head. Automated repository checks and author/self evidence do not satisfy that gate.
Exact-head merge gate
Keep unmerged until:
.github#1020reaches protected centralmainand this exact/then-current BandScope head receives terminal-success central coverage/review evidence;After protected merge, close any still-open #782, #751, and #765 entries only when their supersession is proven against the merged tree.
Queued, in-progress, failed, skipped-required, action-required, predecessor-head, protected-base, self/author, wrapper-only, repeated unchanged infrastructure, or administrative-bypass evidence is not success.