Repository navigation
[security] pinned dependency review needed #256
Description
Pinned dependency review
Date: 2026-10-29
Pins: 31 in api/package.json overrides
Flagged: 1
Pins that are themselves vulnerable
Each of these was pinned to FIX an advisory. The pinned version has since become the VULNERABLE version of another one.
@hono/node-server@1.19.15
- Advisory: GHSA-rmxm-3fg6-px4f (CVE-2026-118663) - medium
- Summary: @hono/node-server:
serveStaticdecodes the request path a second time, leading to bypass of middleware on static paths - Move to:
2.1.3(smallest patched version at or above the current pin)
Why this needs a human
Dependabot does not manage the overrides block. These pins are frozen: the dependency tree cannot float off them, so they will never self-heal and no bot will propose the change.
What to do
- Edit the version in
api/package.jsonoverrides. - Check the target is at least 7 days old (
npm view <pkg> time --json). If it is younger, do NOT take it - add aClass: quarantine-windowentry to.trivyignorewithFix-available-fromset to publish date + 7 days, and take the fix on that date. - Regenerate the lockfile with the regen-lockfile workflow. Do NOT run
npm install --package-lock-onlyon a corp-managed device - it rewritesresolvedto an internal feed and downgradesintegrityfrom sha512 to sha1. - Commit the regenerated lockfile, and drop any
.trivyignoreentry the fix retires in the same commit.
Close this issue once the pins are updated. The workflow re-runs on schedule and will reopen if anything regresses.
Pinned dependency review
Date: 2026-10-29
Pins: 8 in web/package.json overrides
Flagged: 0
All 8 pinned versions are clear of known advisories. No action required.
Auto-generated by .github/workflows/dependency-pins-review.yml run #75.
Activity
pranems commentedon Oct 28, 2026
Exact published release image scan - 2026-10-28
The two HIGH findings are now confirmed in the published 0.55.60 image,
not inferred from dependency PR #255's separate test image.
ghcr.io/pranems/scimserver@sha256:316a645f021b5c9b833c295d94248e7df00ee37aa13d6d5614e55f9f04c83a4b.database container was started.
the release checksum:
1051f49cb22d5284f43425f72aad9cda63ca12ceb92e7caa06903490c82dc9bf.2026-10-28T19:18:03.419608319Z, downloaded2026-10-28T23:01:41.3023961Z.existing unchanged
.trivyignore, exit code 1 on findings.This is a scanner result, not a proof of exploitability.
body-parser@2.3.02.4.0for the installed 2.x linemulter@2.4.02.5.0Both occur under
app/node_modulesin the scanned image. The report's imageconfig identity is
sha256:87bb5f4d8ffa3da5e89a33c063a4b554fa51b3f0270e6a8e9426e1577b3d9f5f;this is not the registry manifest digest above.
Package-control hold
Read-only approved-feed probes on this date returned
E404fornpm view body-parser@2.4.0andnpm view multer@2.5.0.The registry remains
https://packagefeedproxy.microsoft.io/npm/.Client
min-release-age=undefineddoes not mean proxy quarantine is absent.The approved package time documents also did not expose those versions.
GitHub independently reports releases on 22 October:
2026-10-22T11:36:33Z.2026-10-22T11:57:23Z.These are GitHub release timestamps, not verified npm publication timestamps.
The exact feed restriction and npm eligibility dates therefore remain
unconfirmed. No public-registry bypass, installation, lockfile regeneration,
manifest change, new suppression or quarantine exception was performed.
Next action
Recheck the approved feed on 30 October, verify actual npm publication age
and compatibility, then use the existing CI-only regeneration workflow for
the smallest exact-pin change. Reject unrelated lockfile churn. Validate the
installed graph, request-parser behavior and fresh final image scan before
clearing the release hold. If the feed still rejects a version, retain the
hold and use the approved package-support route rather than another registry.
Local receipts are retained under
test-results/release-resume-20261028/, including the Trivy JSON/log,database metadata, official checksums, image identity and both advisory JSON
responses. No customer data or credentials were used.
This updates only the two confirmed HIGH runtime-image findings; it does not
close the other API/web pins listed in this issue. The earlier 24 October
branch scan PASS remains historical evidence, not current security clearance.
pranems commentedon Oct 29, 2026
Merged request-body remediation and remaining pin review
PR #258 is normally merged as
80460d59bd23afe97ea10f5ca947b2baed3ba8e6,preserving all constituent commits. Product version is 0.55.61.
The exact body-parser 2.4.0 / multer 2.5.0 corrections and compatible shared
iconv-lite 0.7.3 override are in master. Real npm inventory exits zero.
Authoritative merged-source run 40885913248
passed validation, image boot/discovery smoke and the existing HIGH/CRITICAL
scan gate. API units: 6,220; HTTP: 2,514 passed plus 42 existing skips; web: 1,655.
Actual body-parser and multer scan rows each report zero findings under that
existing policy, including its unchanged documented exceptions and
ignore-unfixed=true.Merged-source immutable image:
ghcr.io/pranems/scimserver@sha256:b5d11a2e9af42088edfad51eb2bcc534d8a32bf273efcf7ca7a19f3ce1a63e96.Only a unique test tag was published, not
latest. Nothing was deployed.Keep this issue open. Its current six API and thirteen web advisory
records concern five other pins. A read-only inventory of authenticated
CI-generated locks confirms all five packages are actually locked.
Web seroval 1.6.3 is not development-only in that metadata; undici 7.29.1 is.
Neither classification alone proves deployed absence or exploitability.
Approved-feed publication-time and exact-version metadata now establish
seroval 1.6.11 and undici 7.30.1 are available, sha512 and already more than
seven days old (10.84 and 13.74 days at observation). The seven HIGH web
advisory records need an independent compatible remediation and fresh proof.
No installation, lock generation, quarantine bypass or new suppression was
performed for this classification. Other API pin changes still need
compatibility assessment, especially the proposed major-version change for
@hono/node-server.Passing this bounded image gate is not all-severity security clearance,
performance admission, customer-data proof or release/deployment approval.
pranems commentedon Oct 29, 2026
Web-only progress is published in draft PR #259, not merged or deployed.
At exact head
d0f988e73de9d058fea3fb5e9f52778cc56f4bad, Seroval is1.6.11 and Undici is 7.30.1. Authenticated CI-only locks change only those
two web packages; the API package graph and overrides remain unchanged.
All six manifest/every-occurrence/actual-owner regressions pass. A clean
approved-feed web installation has a valid full
npm ls --allinventory(exit 0). The advisory checker reports zero web findings across eight pins.
Normal protected Validate passed 28/28 gates; exact-tip source/PR
image boot/discovery smoke, configured Trivy, CodeQL and docs checks pass.
Hosted review is still required: GitHub acknowledges
@copilotrequestsbut has not exposed an actual review or pending reviewer. PR #259 remains
draft.
Keep this issue OPEN. The six API advisory records remain independent.
The unchanged API graph also retains full-inventory override-context errors
for
debug,get-intrinsicandcall-bind-apply-helpersafter cleanrestore; a passing top-level inventory is not full-tree clearance.
Neither image-scan success nor this dependency patch certifies browser
exploitability, repository-wide security or release readiness.
pranems commentedon Oct 29, 2026
Current checkpoint: product 0.55.62 is published in draft PR #259 at d97fa7e. The documentation-only follow-up explains the reproduced UTC conversion defect. Protected push passed 25/25 gates. Exact-tip source image run 40908681644, PR image 40908692938, CodeQL 40908693080 and documentation 40908693006 all pass. Both image runs report 6,220 API units, 2,514 HTTP passes plus 42 existing skips and 1,661 web tests; boot/discovery and the existing configured Trivy gate pass. No merge or deployment occurred. Real final-head review remains missing despite acknowledged requests; the PR stays draft.
Correction to my earlier publication-age prose: approved-feed raw UTC strings were correct. PowerShell's automatic UTC DateTime followed by implicit date-to-text conversion into DateTimeOffset.Parse lost the UTC identity and assumed local -06:00, shifting derived instants six hours forward. Correct ages at the ORIGINAL observations are Seroval 11.09368 days, Undici 13.98904 days, qs 14.69045 days, fast-uri 9.65898 days and the Hono adapter 30.35414 days. These are historical observation ages, not their age now. Typed UTC conversion and two seven-day boundary assertions confirm all five remain eligible; no adoption decision changed. Old derived records remain failed evidence, not authoritative UTC metadata.
This does not close #256: six independent API advisory records remain. Full API npm inventory also exits 1 with unchanged override-context errors for debug 4.4.3, get-intrinsic 1.3.0 and call-bind-apply-helpers 1.0.2 before and after clean restore. Full web inventory exits 0; targeted/top-level API success does not clear full-tree errors. Neither passing CodeQL nor the configured image scan is repository-wide security clearance.
github-actions commentedon Oct 30, 2026
All pinned versions are now clear of known advisories. Closing automatically.