Repository navigation
Conversation
Spec and ADR drafts for NIW2-312, from the 2026-10-12 security, quality and scalability audit (umbrella NIW2-302). Status: proposed, not implemented. Refs: NIW2-312 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
csdev19
deleted the
feature/niw2-312-upgrade-hono-and-harden-the-dependency-and-release-pipeline
branch
October 12, 2026 17:13
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Refs NIW2-312. Spec:
design/supply-chain-hardening.md. ADRs: 0018 (dependency version policy), 0019 (what the release pipeline trusts).Decisions
honogoes to^4.13.13: 0 advisories, against 38 at 4.12.3.dependencies.bunandgithub-actions, weekly and grouped.NPM_TOKEN, with Node 24 in the publish job. An ordered cut-over checklist keeps a release from breaking.verifyjob on the tagged SHA, plus a production audit and a pack-and-install smoke test.validate.ymlruns onrelease-please--*branches and becomes a required check.verifycovers every workspace.ADR-0019 supersedes the "Tokens" section of ADR-0010 and contradicts its addendum. The spec explains both.
Open questions
catalog:entries, switch to Renovate or bump those by hand? Recommendation: try Dependabot first.production, at the cost of one click per release? Recommendation: yes.oxfmtfrom 0.19 to 0.72, which costs one reflow commit? Recommendation: yes.auditinverify, or only in CI? Recommendation: CI only.Status
This PR contains only the design spec and ADR drafts. It is opened as a draft so the design is not lost. The implementation will land on this same branch after the open questions are answered. Everything is "proposed, not implemented".
Part of the 2026-10-12 audit, umbrella NIW2-302. Specs were written by Fable agents against a read-only export of
mainatee34302. The ADR numbers (0014–0026) are assigned across all eight audit PRs.decisions/index.mdis not edited in these PRs, to avoid eight-way conflicts; add the index rows when each PR is promoted.🤖 Generated with Claude Code