[pranems]

Summary

Pin transitive Hono exactly to the smallest eligible patched version, 4.13.11,
for GHSA-5r4p-p66f-jhc7 / CVE-2026-111757, with verified CI-only lockfiles and
coordinated unreleased product patch 0.55.59.

The Medium advisory affects Hono >=4.12.4 and <4.13.11: a second serveStatic
decode can bypass middleware protecting a static prefix. It is not traversal
outside the configured root. The frozen 0.55.58 image demonstrably contains
4.13.7 despite devOptional classification. No direct application import was
found, but absence of an import is not proof of unreachability.

Only Hono changes in the dependency graph. The API/web lockfiles otherwise
change only intended 0.55.58 -> 0.55.59 metadata. Most documentation files
change only mechanically required product-version headers/badge under F1;
the existing release notes, context and supply-chain policy contain the
substantive evidence. No application/UI behavior, root dependencies, workflow,
gate threshold, performance runner or quota changes are included.

Linked Defect / Plan Reference

• DELIVERY_PLAN.md defect ID: Refs [security] pinned dependency review needed #248; this PR remains unmerged and the deployed estate is not declared remediated.
• Audit doc reference: docs/strategy/NPM_SUPPLY_CHAIN_QUARANTINE_POLICY.md, "2026-10-23 Hono exact-patch remediation ([security] pinned dependency review needed #248)".
• ADR (if applicable): N/A, existing override and CI-regeneration seam.

Prerequisite #252 was separately reviewed and normally merged at
fc962a65e03b2a0cb1ad86b96b88c473d6d07b7d. Its hosted review 5628884972 is
COMMENTED with approval recommended/no findings, not human GitHub approval.
The actual configured rules did not require a separate GitHub approval.
Authoritative merged-source Build Test Image 39962553306 and CodeQL
39962437032 passed, producing immutable test-image digest
sha256:93ab5bd73465bdd215eeb2e3471022188d854d97a730d50b752c17e00eb238b0.
That old-dependency image is not patched-Hono proof.

The ordinary master merge 62bf4d1e preserves the four original Hono commits.
The inherited timezone files are byte-identical to current master; no other
#251 tooling or checkpoint053 fixes enter this PR. Qualification branch/tip
fix/performance-qualification-20261022 / f6f03a523b6370eccc63f1499c3c111dd5cdf200
and all frozen qualification evidence remain preserved.

TDD Process

• RED test written first; observed it fail for the expected reason
  • Original actual-lock assertion failed on 4.13.7, not a manifest string.
  • After bootstrap, before artifact application, the permanent actual-lock
    Jest guard also failed: expected 4.13.11, received 4.13.7; 20 other pin
    checks passed. The actual failing path/name is below.
• GREEN: minimal implementation that turns the test green
  • Apply only the authenticated public-registry CI artifact; restore API
    via approved-registry npm ci without rewriting its lockfile. Actual
    installed routes and every locked Hono occurrence are 4.13.11.
• Refactor (if any) keeps the test green
  • No production refactor. Existing override, pin-checker and artifact route.
• Permanent regression guard added (where applicable - see existing patterns in api/src/security/)
  • api/src/scripts/check-dependency-pins.spec.ts adds the advisory boundary/
    minimal recommendation and an assertion over the actual committed
    lockfile, all Hono occurrences, exact override, public URL and sha512.
  • Test: Hono security remediation (GHSA-5r4p-p66f-jhc7) > locks every actual Hono occurrence to the exact patched override with public provenance.

Feature / Bug-Fix Commit Checklist (standing rule)

Every behavioral change must include all that apply. Tick or strike through with N/A + reason.

• Unit Tests - service-level and controller-level coverage of the new behavior
  • Dependency-only change: pin checker 19 -> 21 cases; full unit total 6,210 -> 6,212. No service/controller behavior changes.
• E2E Tests - end-to-end spec under api/test/e2e/ exercising the feature through HTTP
  • Existing normal protected HTTP suite passes 2,514 tests, 42 existing backend skips; new HTTP behavior coverage is N/A.
• Live Integration Tests - new section in scripts/live-test.ps1 runnable against local + Docker + Azure
  • N/A: no new wire behavior; no deployment/live-state mutation authorized for this PR.
• Feature Documentation - dedicated doc in docs/ with architecture, RFC references, Mermaid diagrams, test coverage
  • Existing supply-chain policy covers advisory, exact artifact, RCA, actual installed proof and design/self-improvement dispositions; no new SCIM architecture or diagram.
• INDEX.md Update - add the new doc reference to docs/INDEX.md
  • N/A for new entry: existing indexed documentation; required product header updated.
• CHANGELOG.md Update - [Unreleased] entry with full test counts and feature summary
  • Includes actual bootstrap/focused totals and explains that final protected/CI totals belong to their own receipts below.
• Session & Context Updates - Session_starter.md and docs/CONTEXT_INSTRUCTIONS.md
• Version Management - bump api/package.json (and any other version refs) when behavior changed
  • Fresh master remains 0.55.58; coordinated planned API/web patch is 0.55.59. Both lockfiles come only from CI. No root version/dependency change.
• Response Contract Tests - API responses contain ONLY documented fields (key allowlist assertion at unit + E2E + live)
  • N/A: no API response or serialization change.

Validation Output

Final source: a39a47b5360f8d30314283949f718179a495b6bf
Version:      0.55.58 -> 0.55.59, unreleased
Hono:         installed + locked + exact override 4.13.11
Focused:      42 / 42 PASS (21 pin + 21 inherited freshness), 4.922s
Unit:         6,210 -> 6,212 PASS (213 suites)
E2E:          2,514 PASS, 42 existing backend skips (118 passing suites)
Lint:         targeted and full API gate PASS, zero errors
Protected:    25 / 25 normal Fast gates PASS, 538.3s
Web:          tsc + production build PASS; CI Vitest 1,655 PASS (124 files)
API audit:    exit 0, all severities zero
Web audit:    exit 1, 3 Moderate packages, 0 High/Critical, unchanged graph
Exact-tip CI: all six listed checks SUCCESS at a39a47b5
Hosted review: 5629802625 COMMENTED, approval recommended, no open issues
Em-dash:      introduced diff clean

Exact commands and results:

• node test-results/hono-security-20261023/dependency-claim.cjs: actual pre-artifact RED on Hono 4.13.7; post-artifact PASS on every locked Hono occurrence.
• npm --prefix api test -- --runInBand --runTestsByPath src/scripts/check-dependency-pins.spec.ts: observed pre-artifact FAIL, expected 4.13.11 versus actual 4.13.7; 20 other cases passed.
• npm --prefix api ci --no-audit --no-fund: PASS, 660 packages installed through the unchanged approved registry; lockfile byte-identical before/after.
• npm --prefix api ls hono @hono/node-server @prisma/dev prisma --all --json: PASS, exit 0; both actual routes below contain 4.13.11.
• npm --prefix api test -- --runInBand --runTestsByPath src/scripts/check-dependency-pins.spec.ts src/modules/endpoint/services/endpoint-cache-freshness.spec.ts: PASS 42/42.
• From api, npx --no-install eslint src/scripts/check-dependency-pins.spec.ts: PASS; editor diagnostics zero.
• npm --prefix api audit --json: PASS, zero vulnerabilities.
• npm --prefix web audit --json: exit 1, three Moderate affected Vitest packages, zero High/Critical. Their two advisories are tracked separately in the policy with owner/target; no unrelated upgrade or waiver is included.
• $env:VITEST_MAX_WORKERS='2'; $env:PREPUSH_MODE='Fast'; git push origin chore/regen-lockfile-hono-security-20261023: PASS all 25 ordinary gates, 538.3s.
• The owning hook ran npm test from api: PASS 6,212/6,212 in 213 suites.
• The owning hook ran npm run test:e2e -- --maxWorkers=2 --testPathIgnorePatterns 'endpoint-scoped-logs.e2e-spec.ts' --testPathIgnorePatterns 'log-config.e2e-spec.ts' under its unchanged InMemory environment: PASS 2,514 tests / 118 suites, 42 existing backend skips.
• git diff --check and introduced-em-dash scan: PASS.

Authenticated CI-only artifact:

Evidence	Identity/result
Regeneration run	39965730441 PASS, exact source 62bf4d1e13781653e3619215240ddd1865a1166c
Artifact	regenerated-lockfiles, ID 12506119257
Downloaded ZIP SHA-256	f2e318928b7aa6e672983ba1acb492bcbd8a73066db5a50355b06e9521b6bf58, matches GitHub artifact digest
Changed packages	Exactly one: Hono 4.13.7 -> 4.13.11; web package entries unchanged
Publication	2026-09-29T06:15:49.676Z; seven-day eligible 2026-10-06; actual CI age 24.321723 days
Provenance	All package URLs public registry.npmjs.org; sha512 only; approved-proxy dist integrity independently matches Hono
API lock SHA-256	ee7c44126acd1ef5949320f5c181c5e1291794cb41920f6c1324ab3689f7b4fc
Web lock SHA-256	047012e291c72a6c5d7f4a8dc6a5c2e1185152c131ad14e3cd9e96f5928e0d9e
Actual installed route	prisma@7.8.0 -> @prisma/dev@0.24.3 -> hono@4.13.11
Actual installed route	prisma@7.8.0 -> @prisma/dev@0.24.3 -> @hono/node-server@1.19.15 -> hono@4.13.11

Final-tip reproducibility and applicable CI:

• Final regeneration 39968711323
  passed at exact head a39a47b5360f8d30314283949f718179a495b6bf.
  Artifact 12507883125, ZIP SHA-256
  aff7121d7df4ff282e70536d3b06c76002c50f7c1c3e817776910a28875e7acd,
  matches GitHub's artifact digest. Both lockfiles are byte-identical to the
  committed locks above; the seven-day publication report has zero changed
  packages. No second artifact integration was needed.
• Build Test Image 39968960708
  passed: 6,212 API unit tests, 2,514 HTTP tests with 42 existing backend skips,
  and 1,655 web tests in 124 files. Production build, isolated CI container
  smoke and HIGH/CRITICAL Trivy gate passed.
• Normal PR checkout is the test-merge commit
  b424d5b68309a543454c4b33a7b2ab8ab7776577, not the branch commit label.
  Its parents are current master fc962a65... and exact Hono head a39a47b5....
  Its tree 2424adeb3f8a31d66fc165c85186a79aa9ffbb40 is verified identical
  to the Hono head tree. Thus the tested source contents match the exact tip.
• Immutable CI test-image digest:
  sha256:d39525974b7449384ba0990a17824321d06aecf1d9c92f484873f10d3bef371b.
  Build record artifact: 12508473033,
  pranems~SCIMServer~YMIHUS.dockerbuild. This is a CI test image, not a
  deployment, performance admission or live-estate remediation claim.
• CodeQL 39968960656
  and Docs freshness 39968960631
  passed. All six listed checks are green at the exact Hono head.
• Initial hosted review 5629633564 had no code findings; it noted that CI
  was still running. After the green results were published, hosted review
  5629802625 at the exact same head recommended approval with no open issues
  and zero inline threads. Both generated lockfiles were outside the hosted
  reviewer's generated-file scope and were independently authenticated and
  compared as documented above. The COMMENTED bot review is not human GitHub
  approval.

Complete logs and machine-readable receipts are retained under
test-results/hono-security-20261023/, including the original three protected
failures, permanent actual-lock RED, authenticated artifact ZIP/report,
unchanged-lock npm ci, installed proof, both audits and final protected push.
No local lockfile generation/manual patch, quarantine bypass or registry/control
change was used. Source manifests and workflow are unchanged from the artifact
source; final differences add tests/docs, not dependency resolution inputs.

Unchanged release holds: qualification 39875689201 remains FAIL, same-image
populated-read A/A p99 40.650743 versus 50.378052ms, ratio 1.23928982 outside
unchanged 1.10. Native 39875689138 and timeline 39875689169 remain diagnostics
only. Customer actual-data migration receipt, capacity/operational
dispositions, 403 cleanup verification and actual target-specific human
visual observation remain pending. No deployment, performance retry,
candidate admission, release-complete claim or waiver.

Self-improvement: applied. Assert actual committed dependency entries and
restored routes, not just the manifest or development/optional flags.
Design disposition: accepted. Minimal exact override plus existing CI and
pin-checker seams; no speculative application abstraction.

Standing Rules Acknowledgment

• No em-dash (Unicode U+2014) anywhere in the diff. Verified via Select-String -Pattern ([char]0x2014).
• No git commit --amend on history that has been pushed.
• No new credentials, tokens, or secrets committed to source. Forbidden patterns regression spec at api/src/security/forbidden-source-patterns.spec.ts will catch known anti-patterns.
• Migrations are additive-only (expand-contract for column changes). Migration linter at api/src/scripts/lint-migrations.ts enforces this. N/A: no migration changes.

Destructive Migration Override (skip if not applicable)

N/A: no Prisma schema or migration changes.

• This PR contains a NEW destructive Prisma migration (DROP TABLE/COLUMN, ALTER COLUMN ... TYPE, RENAME, INSERT ... SELECT FROM)
• I have set ALLOW_DESTRUCTIVE_MIGRATION=1 in the CI environment for this PR
• Justification (required if box above is ticked):

  <!-- Why this destructive change is necessary, what the rollback path is, and which release window it ships in -->
  

Reviewer Hint

Diff areas worth special attention from the reviewer:

• Exact minimal Hono override, actual committed lock entries and CI-only provenance/age proof.
• The two permanent pin tests, including the observed actual-lock RED before artifact application.
• Scope: inherited prerequisite is already master; no other performance tooling or production behavior changed.
• Bootstrap and frozen-image evidence are explicitly distinct from actual patched installation, CI and any future deployment.
• Web Moderate findings remain visible and separately triaged rather than hidden by a clean-API summary.

[Copilot]

🔵 Needs a closer look

GitHub Actions confirms that Build Test Image and CodeQL checks for the exact source tip remain in progress, so final approval must await their results.

No open issues 🎉

2 files not reviewed

• api/package-lock.json: Generated file
• web/package-lock.json: Generated file

What changed in this PR

Addresses #248 by pinning SCIMServer’s transitive Hono dependency to 4.13.11 for the static-prefix middleware advisory. The change prepares unreleased version 0.55.59 without changing application/UI behavior or claiming deployment remediation.

Changes:

• Update the exact Hono override and CI-generated lockfile, with coordinated API/web version metadata.
• Add regression tests for the advisory boundary, minimal patch recommendation, and every committed Hono lock entry.
• Record dependency provenance and validation evidence; refresh documentation version headers while preserving existing release holds.

File	Description
web/​package.json	Bump product version to 0.55.59.
web/​package-lock.json	Align version metadata; dependencies unchanged.
Session_starter.md	Record remediation progress and remaining checks.
README.md	Update product header and version badge.
docs/​UI_GUIDE.md	Refresh version headers only.
docs/​strategy/​NPM_SUPPLY_CHAIN_QUARANTINE_POLICY.md	Document provenance, validation, and separate web advisory triage.
docs/​strategy/​ENGINEERING_LESSONS_AND_PATTERNS.md	Record dependency-inventory verification lessons.
docs/​SOVEREIGN_AND_GOV_CLOUD_DEPLOYMENT.md	Refresh version headers only.
docs/​SCHEMA_CUSTOMIZATION_GUIDE.md	Refresh product version header only.
docs/​SCHEMA_ATTRIBUTE_CUSTOMIZATION_GUIDE.md	Refresh product version header only.
docs/​REMOTE_DEBUGGING_AND_DIAGNOSIS.md	Refresh product version header only.
docs/​RELEASE_NOTES.md	Describe the pending security patch and validation limits.
docs/​PROD_TO_DEV_MIRRORING_AND_FIXTURES.md	Refresh version headers only.
docs/​PATCH_OPERATIONS_COMPLETE_GUIDE.md	Refresh product version header only.
docs/​OBSERVABILITY_TRACEABILITY_AND_DIAGNOSTICS.md	Refresh product version header only.
docs/​MULTI_ENDPOINT_GUIDE.md	Refresh version headers only.
docs/​LOGGING_AND_OBSERVABILITY.md	Refresh product version header only.
docs/​INDEX.md	Refresh version headers only.
docs/​GLOBAL_NAVIGATION_AND_WORKFLOW_CONTEXT.md	Refresh product version header only.
docs/​ENDPOINT_PROFILE_ARCHITECTURE.md	Refresh product version header only.
docs/​ENDPOINT_LIFECYCLE_AND_USAGE.md	Refresh version headers only.
docs/​ENDPOINT_CREATION_WIKI.md	Refresh version headers only.
docs/​ENDPOINT_CONFIG_FLAGS_REFERENCE.md	Refresh version headers only.
docs/​DOCKER_GUIDE_AND_TEST_REPORT.md	Refresh version headers only.
docs/​CUSTOM_EXTENSIONS_RFC_GUIDE.md	Refresh product version header only.
docs/​CONTEXT_INSTRUCTIONS.md	Update remediation context and prerequisite status.
docs/​COMPLETE_API_REFERENCE.md	Refresh version headers only.
docs/​AZURE_DEPLOYMENT_AND_USAGE_GUIDE.md	Refresh version headers only.
docs/​AUTHENTICATION_GUIDE.md	Refresh product version header only.
DEPLOYMENT.md	Refresh product version header only.
CHANGELOG.md	Record the patch, test coverage, and evidence boundaries.
api/​src/​scripts/​check-dependency-pins.spec.ts	Add advisory and actual-lock provenance regression tests.
api/​package.json	Pin Hono 4.13.11 and bump product version.
api/​package-lock.json	Lock patched Hono with updated integrity and version metadata.

_{Review effort: Balanced}

[Copilot]

🟢 Approval recommended

The bounded dependency patch has targeted regression coverage, confirmed successful exact-head Build Test Image CI, and no unresolved blocking findings.

No open issues 🎉

2 files not reviewed

• api/package-lock.json: Generated file
• web/package-lock.json: Generated file

_{Review effort: Balanced}

[pranems]

Hono merged and published; issue remains open for separate web pins

PR #253 was normally merged,
without admin bypass or history rewriting, at master
cddeb5a569b3997000fc3c3bb38349357d83e2ed. Its reviewed head was
a39a47b5360f8d30314283949f718179a495b6bf. Both reviews were COMMENTED;
no human GitHub approval is claimed.

One authoritative merged-source matrix,
39973944347,
passed 6,212 API unit tests, 2,514 HTTP tests with 42 existing backend skips,
and 1,655 web tests. Its image smoke and HIGH/CRITICAL scan gates passed.
Automatic merged-source CodeQL 39973888794 also passed.

Guarded publication
39976314612
passed once with exact expectedSha=cddeb5a569b3997000fc3c3bb38349357d83e2ed,
version=0.55.59 and pushLatest=false.
The version tag and sha-cddeb5a569b3997000fc3c3bb38349357d83e2ed tag both
resolve to:

ghcr.io/pranems/scimserver@sha256:db16e5493b9061460f186bcf3211391b0a3c3bcd065ef0a6a12646033cc320a6

Registry provenance identifies that exact source revision and publication
run. Build record artifact 12511616486 was downloaded and authenticated
against GitHub's SHA-256
2a843fd2bdab0dba50d6daf2990d4e5271249f4383056bb9822769daa79156b4.
An isolated metadata-only inspection of the immutable published image found
product 0.55.59 and actual Hono 4.13.11, alongside Prisma 7.8.0,
@prisma/dev 0.24.3 and @hono/node-server 1.19.15.
It used network mode none, a read-only root filesystem, zero mounts and a
Node entrypoint that only read package metadata. The application/database
were never started, and the inspection container was removed.

Issue disposition: the specific Hono GHSA-5r4p-p66f-jhc7 /
CVE-2026-111757 pin is remediated in merged source and the published image.
The sanctioned automatic pin review
39973888733
reports zero findings across 26 API pins. It correctly keeps this issue
OPEN for two Medium advisory records on the unchanged web
ip-address@10.7.1 pin:

• GHSA-rxp7-6hxx-x8q5 / CVE-2026-111997 recommends 10.7.4.
• GHSA-p3hm-x653-5rc6 is marked as a duplicate and reports no patched-version
  recommendation. Reconciliation belongs to separate age/exposure triage.

The pin watcher is explicitly non-blocking; its successful workflow execution
does not mean there were no findings. No issue closure, unrelated dependency
upgrade, registry/lock mutation or new waiver was used. The earlier three
Moderate affected Vitest packages also remain separately tracked.
Repository maintainer follow-up target: 2026-10-30.
Neither a clean API audit nor a Hono fix proves a globally vulnerability-free
dependency tree.

The merged-source CI test image and published image are separate builds:
the CI image passed smoke/scan, and the published digest has the exact-source
provenance and runtime inventory above. This is a publication checkpoint,
not a claim that the published digest was deployed or performance-qualified.

No dev/customer deployment, live mutation, performance rerun, #251 merge,
new candidate admission or change to frozen 0.55.58 results occurred.
Qualification 39875689201 remains FAIL: p99 40.650743 versus 50.378052ms,
ratio 1.23928982 outside unchanged 1.10. Native 39875689138 and timeline
39875689169 remain diagnostic only. Customer actual-data migration,
capacity/operational dispositions, 403 cleanup verification and actual
target-specific human visual observation remain pending.