|
| 1 | +# Security hotfix receipt |
| 2 | + |
| 3 | +Base: `ff8b8906c6807953336609cc7f464e7e4ef3cf7b` |
| 4 | +Branch: `sync/security-20261101` |
| 5 | + |
| 6 | +## Changes |
| 7 | + |
| 8 | +- Pinned `graph-ui` Vite from 6.4.3 to 6.4.5 in the manifest and lockfile. |
| 9 | +- Pinned Vitest from 4.1.11 to 4.1.12 and the existing Monaco DOMPurify |
| 10 | + override from 3.4.16 to 3.4.17 after the locked dependency audit found them |
| 11 | + affected; both use the minimum advisory-fixed versions. |
| 12 | +- Updated the hash-pinned PyPI publishing toolchain from certifi 2026.7.22 to |
| 13 | + 2026.10.19 using the sdist and wheel hashes published by PyPI. |
| 14 | +- No unrelated dependencies changed. |
| 15 | + |
| 16 | +## Advisory and registry evidence (checked 2026-11-01) |
| 17 | + |
| 18 | +- [GHSA-8g5g-mxqh-grgj](https://github.com/advisories/GHSA-8g5g-mxqh-grgj) |
| 19 | + affects Vite 6.4.4 and is fixed in 6.4.5. The advisory describes query |
| 20 | + parameters bypassing `server.fs.deny` for network-exposed dev servers. |
| 21 | +- [GHSA-rq7h-c2jc-7f22](https://github.com/advisories/GHSA-rq7h-c2jc-7f22) |
| 22 | + and [GHSA-9jrq-w75r-8gcw](https://github.com/advisories/GHSA-9jrq-w75r-8gcw) |
| 23 | + list affected Vite 6.x versions through 6.4.3. The fork's starting pin was |
| 24 | + 6.4.3; the hotfix moves it to 6.4.5. |
| 25 | +- [GHSA-6q48-6c7w-9gw2](https://github.com/advisories/GHSA-6q48-6c7w-9gw2) |
| 26 | + marks certifi versions before 2026.10.18 affected and 2026.10.18 patched; |
| 27 | + the advisory says 2026.10.19 restores unaffected emSign roots. The publishing |
| 28 | + environment uses this pinned certifi build. |
| 29 | +- [GHSA-qxg6-89mg-rqv8](https://github.com/advisories/GHSA-qxg6-89mg-rqv8) |
| 30 | + and [GHSA-xp26-3454-mjgp](https://github.com/advisories/GHSA-xp26-3454-mjgp) |
| 31 | + affect Vitest through 4.1.11; npm audit identifies 4.1.12 as the compatible |
| 32 | + fix. |
| 33 | +- DOMPurify 3.4.16 is affected by |
| 34 | + [GHSA-cg2g-xh64-v4q7](https://github.com/advisories/GHSA-cg2g-xh64-v4q7) and |
| 35 | + [GHSA-mrv2-3pqr-j5jr](https://github.com/advisories/GHSA-mrv2-3pqr-j5jr); |
| 36 | + both advisories list 3.4.17 as fixed. The exact pin applies through the |
| 37 | + pre-existing Monaco override. |
| 38 | +- `npm view vite@6.4.5 version dist.tarball dist.integrity --json` returned |
| 39 | + version 6.4.5, `https://registry.npmjs.org/vite/-/vite-6.4.5.tgz`, and |
| 40 | + integrity `sha512-4enwjFfi4IwtEh0w+jPzpLVOFQiPHmmzPxcHXQOyEur47o6u0jE573DmGpjA+7irXoMLYRZD5ZaFUEneS3abPg==`. |
| 41 | +- PyPI JSON at `https://pypi.org/pypi/certifi/2026.10.19/json` returned the |
| 42 | + sdist SHA-256 |
| 43 | + `035c1e85572b141bf1c3a3eff0e33a8eb74917522f2559075ff8d2fea780a1ae` and |
| 44 | + wheel SHA-256 |
| 45 | + `42d35340cc5b9ba78e818ddbff0c5b1c2b779de448a340fd1b989f5fa8670e1b`. |
| 46 | +- `npm view vitest@4.1.12 version dist.integrity --json` returned version |
| 47 | + 4.1.12 and integrity |
| 48 | + `sha512-5eWdz2yb3ajxWF3C8C4TjkXl7FGm3n2E/VlazALrQHzK7nYMSGFnCZto0bbPNl77AwkOZVLk0YnBAejUu0NiWA==`. |
| 49 | +- `npm view dompurify@3.4.17 version dist.integrity --json` returned version |
| 50 | + 3.4.17 and integrity |
| 51 | + `sha512-B/pSlYVHQ58kqISD/yDjuJ1yfzI34m1gF4lAod2bwSRhiN4K5Cl3H8Af7hqB2PmTL911tdEudnnXn5FnhRoz0w==`. |
| 52 | +- After updating these pins, `npm install --package-lock-only --ignore-scripts` |
| 53 | + reported `found 0 vulnerabilities`. |
| 54 | + |
| 55 | +## Upstream adaptation and exclusion matrix |
| 56 | + |
| 57 | +| Upstream item | Evidence and decision | |
| 58 | +| --- | --- | |
| 59 | +| #2739, merge `a3d266d705b7903552f6f232cd078ed5e0320b7e` | Its two-parent diff updates Vite 6.4.3 to 6.4.4 and certifi 2026.7.22 to 2026.10.19, with hashes. Adapted by using the later advisory-fixed Vite 6.4.5 and verified PyPI certifi hashes. | |
| 60 | +| #2861, merge `3b46abec256049427d7523489a21a923c637f4aa` | Its diff updates Vite 6.4.4 to 6.4.5 and Vitest 4.1.11 to 4.1.12. Adapted both security-relevant updates; the live npm audit independently confirms the Vitest fixed version. | |
| 61 | +| #2757, merge `869fc2b54ca98bf12e6f0408e68ad05d4a0468ea` | Exact merge diff touches graph-ui architecture/browser-ai source, handtest tooling, and CodeQL tests. It does not modify `src/ui/http_server.c` or `src/ui/httpd.c`. This fork serves frontend assets only through exact lookup in compiled `cbm_embedded_lookup`; request paths are matched raw, with no filesystem asset resolution. The applicable filesystem boundary is POST `/api/index`: it resolves the submitted directory with `cbm_canonical_path`, checks the resolved path against workspace authorization, stores that exact canonical path, and escapes policy errors into JSON. Existing tests cover percent-encoded route rejection, lexical `..` handling with outside-root refusal, resolved-root storage, controlled errors, and symlink-to-sensitive-root refusal (`httpd_path_match_matrix`, `ui_server_index_start_refuses_root_outside_allowed`, `ui_server_index_start_stores_resolved_root`, `ws_manifest_link_to_sensitive_directory_refused`). The separate file-picker browse endpoint intentionally lists user-selected directories and is not the asset server or indexing authorization boundary. | |
| 62 | +| #1786, merge `8c7b3bd76e8cc0e23f5c570dafeb0ddff5c4d6fd` | Merge is not an ancestor of the fork base. Current `workspace.c` compares both slash forms as separators in Windows canonical containment and normalizes canonical Windows paths. Sensitive-root grants still require exact explicit approval. Kept current behavior; native Windows execution remains unverified. | |
| 63 | +| #2017, merge `a3831c979547d33adaa36998dca2b004d735fc84` | Merge is not an ancestor of the fork base. Current breadth policy denies volume and too-shallow roots; there is no broad-root override. Preserved this default-deny policy; no opt-in added. | |
| 64 | +| #2664, break-glass merge `5966b7f0` | Reviewed the merge diff: it removes compressed-size and expanded-byte ceilings in the upstream wrapper paths while retaining namespace/member checks. This fork retains finite limits in npm/PyPI/Go wrappers: 256 MiB archive, 64 members, 256 MiB per member, and 512 MiB expanded. This dependency-only PR retains those bounds. Parent integration review measured the new 13A production binary at 289 MiB, exceeding the old 256 MiB per-member limit. The integration batch must raise that finite member ceiling consistently and verify legitimate release compatibility; preserving the old limit is not evidence that larger releases install. | |
| 65 | + |
| 66 | +## Validation and limitations |
| 67 | + |
| 68 | +- `npm ci --ignore-scripts`, `npm run build`, and |
| 69 | + `npm audit --audit-level=moderate` passed after all UI pins; npm audit reports |
| 70 | + zero vulnerabilities. Vite emitted only its existing large-chunk advisory. |
| 71 | +- `scripts/test.sh --suites httpd`: 96 passed, 1 skipped (Windows-only test). |
| 72 | +- `scripts/test.sh --suites workspace`: 27 passed, including the POSIX |
| 73 | + symlink-to-sensitive-root case. Native Windows execution remains unverified. |
| 74 | +- Vite, Vitest, DOMPurify manifest/lock pins and both PyPI certifi artifact |
| 75 | + hashes matched registry metadata. |
| 76 | +- `npm run test:unit`: 3,813 passed, 156 failed across 14 files. Failures share |
| 77 | + `window.localStorage` being undefined in jsdom. The run used Node 26.9.0; |
| 78 | + dependency attribution and the supported-runtime baseline were not established |
| 79 | + by that run. Parent is investigating the runtime interaction. No test |
| 80 | + configuration change is included in this scoped hotfix. |
| 81 | +- Parent reran the failing file with `NODE_OPTIONS=--no-webstorage npm run |
| 82 | + test:unit -- src/galaxy/GalaxyPanel.layers.test.tsx`: 5 passed. The full |
| 83 | + `NODE_OPTIONS=--no-webstorage npm run test:unit` then passed all 3,969 tests |
| 84 | + in 310 files. This isolates the Node 26 global Web Storage interaction; |
| 85 | + no product/test configuration was changed. The unqualified run's failures |
| 86 | + remain recorded above rather than being attributed to dependency changes. |
| 87 | +- Native Windows tests were not run on this Linux host. |
| 88 | +- Jenkins full venue gate remains pending for the parent workflow. |
| 89 | +- Codebase Memory structural search was unavailable: `codebase-memory-cli |
| 90 | + projects --json` and `codebase-memory-cli status --project |
| 91 | + cbm-security-20261101 --json` both failed with |
| 92 | + `secure CLI coordination could not be created (cache-resolve)`. The failed |
| 93 | + probe left Git porcelain unchanged. Actionable issue for parent backlog: |
| 94 | + diagnose secure coordination cache resolution for this indexed worktree. |
0 commit comments