pranems · Oct 23, 2026 · Oct 23, 2026 · Oct 23, 2026 · Oct 23, 2026 · Oct 23, 2026
@@ -7,6 +7,61 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### 0.55.59 Hono dependency security patch (#248)
+
+- Pin the API's transitive Hono override exactly to 4.13.11, the smallest
+  patched release for GHSA-5r4p-p66f-jhc7 / CVE-2026-111757 (Medium).
+  The patch was published 2026-09-29T06:15:49Z and became seven-day eligible
+  2026-10-06T06:15:49Z. No quarantine exception or registry change is needed.
+- Reserve 0.55.59 for the shipped dependency change; API and web product
+  versions move together. The existing public-registry CI workflow owns both
+  lockfiles. Bootstrap checks on the old installation do not prove the patch.
+  The actual locked dependency regression first fails on Hono 4.13.7.
+- The frozen 0.55.58 image contains Hono despite its `devOptional` lock flag.
+  This is runtime-presence evidence, not proof of exploitability or absence
+  of reachable vulnerable middleware. No application or UI behavior changes.
+  The restored private installation now proves Hono 4.13.11 in both actual
+  Prisma dependency routes. Final protected publication and hosted review
+  remain separate checks.
+- Historical bootstrap publication was blocked before CI-only regeneration. Three normal
+  Fast pushes publish nothing: C13 README badge mismatch (fixed), an unchanged
+  HTTP `ENOBUFS` failure (57/57 focused rerun), then the unchanged nested
+  non-UTC Node/Jest timestamp probe's 30,119ms `ETIMEDOUT` (6,209/6,210 units).
+  The last attempt passes all 23 preceding static gates. Both lockfiles remain
+  unchanged from master, Hono remains installed/locked at 4.13.7, and no
+  patched GREEN, PR, exact-tip CI or review was claimed at that checkpoint.
+- The separate prerequisite #252 is now normally merged at `fc962a65`, after
+  exact-tip checks and hosted review 5628884972 (COMMENTED, no findings;
+  not human GitHub approval). Its authoritative merged-source CI run
+  39962553306 passes, with test-image digest
+  `sha256:93ab5bd73465bdd215eeb2e3471022188d854d97a730d50b752c17e00eb238b0`.
+  Merge master ordinarily into this preserved four-commit Hono branch before
+  retrying its protected bootstrap. This old-dependency image is not Hono proof.
+- The ordinary master merge `62bf4d1e` preserves all four Hono commits.
+  Its normal bootstrap push passes all 25 Fast gates in 783.4 seconds:
+  6,210 unit tests / 213 suites and 2,514 HTTP tests / 118 passing suites,
+  with 42 existing backend skips. Those checks still used old dependencies.
+- CI regeneration run `39965730441`, source `62bf4d1e`, produces artifact
+  `12506119257`, ZIP SHA-256
+  `f2e318928b7aa6e672983ba1acb492bcbd8a73066db5a50355b06e9521b6bf58`.
+  The entire artifact was authenticated and compared: only Hono changes
+  (4.13.7 -> 4.13.11), plus the intended API/web 0.55.59 version metadata.
+  Every package retains public-registry URLs and sha512. The sole changed
+  package was 24.3217 days old at CI verification; no unrelated churn.
+- Approved-registry `npm ci` installs the patch without rewriting the API
+  lockfile. Permanent pin-checker tests now assert the actual committed
+  Hono occurrences and advisory boundary: 19 -> 21 cases. Before applying
+  the artifact, the real lock guard fails on 4.13.7; after restoration, all
+  21 pin tests plus all 21 inherited freshness tests pass (42 total).
+  Whole-unit expectation is 6,210 -> 6,212; final owning-hook/CI results
+  must be read from their receipts, not inferred from this focused pass.
+- Fresh API audit: zero vulnerabilities. Unchanged web dependency graph:
+  three Moderate affected Vitest packages, zero High/Critical; audit exit 1
+  is retained, not relabeled clean. Separate triage is recorded in the policy.
+- Existing performance admission failure, customer migration, operational
+  dispositions, cleanup verification and target-specific human visual
+  observation remain outstanding. No Hono merge, deployment or performance rerun.
+
 ### Test-only prerequisite: standalone non-UTC freshness probe
 
 - Backport only the two relevant test-file changes from reviewed
@@ -23,8 +78,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   fixture syntax PASS. Full protected-gate and exact-tip review evidence belong
   to the prerequisite PR, not the old isolated PASS.
 - No product/version/lockfile, application/UI, performance runner, quota or
-  admission change. The preserved Hono branch remains blocked until this
-  separate prerequisite is reviewed and normally merged.
+  admission change in #252. Its normal merge and merged-source checks are
+  recorded above; only that prerequisite is merged, not #251 or this Hono patch.
 
 ### 0.55.58 consolidation onto token-lifetime master
 

@@ -1,6 +1,6 @@
 # SCIMServer Deployment Options
 
-> **Status:** User-facing reference - **Last verified:** 2026-10-16 - **Product version:** `0.55.58`
+> **Status:** User-facing reference - **Last verified:** 2026-10-16 - **Product version:** `0.55.59`
 
 > Updated: 2026-10-16 - Scope: production + local deployment paths
 

@@ -1,6 +1,6 @@
 # SCIMServer
 
-> **Status:** User-facing reference - **Last verified:** 2026-10-21 - **Product version:** `0.55.58`
+> **Status:** User-facing reference - **Last verified:** 2026-10-21 - **Product version:** `0.55.59`
 
 > Production-ready, multi-tenant SCIM 2.0 server for Microsoft Entra ID provisioning and any RFC 7643/7644-compliant identity client.
 
@@ -15,7 +15,7 @@ For actual supported shapes and integration limits, see
 Keep strict validation enabled for Entra; diagnose the request and effective
 schema before applying a targeted compatibility setting.
 
-[![Version](https://img.shields.io/badge/version-0.55.58-blue)]()
+[![Version](https://img.shields.io/badge/version-0.55.59-blue)]()
 [![Node.js](https://img.shields.io/badge/Node.js-24-green)]()
 [![NestJS](https://img.shields.io/badge/NestJS-11.1-red)]()
 [![PostgreSQL](https://img.shields.io/badge/PostgreSQL-17-blue)]()

@@ -2,6 +2,63 @@
 
 **Last verified:** 2026-10-23
 
+### Independent Hono remediation (2026-10-23)
+
+Branch `chore/regen-lockfile-hono-security-20261023` starts from fresh
+`origin/master` e1070ba28825afee46c953e1e2d5d518863303f2, not PR #251.
+It now ordinarily incorporates prerequisite merge `fc962a65` / #252. Fresh
+master remains 0.55.58, so the reserved next patch 0.55.59 is still correct.
+Reserve 0.55.59 for exact Hono 4.13.11 (#248). The actual lock dependency
+regression was RED on 4.13.7. CI-only regeneration and a private restored
+installation now prove exact Hono 4.13.11; final publication/review remain
+required. The preserved qualification branch stays at f6f03a52.
+Frozen 0.55.58 image presence is not new-candidate qualification.
+No original deleted transcript was restored. No Hono merge or deployment.
+The unchanged 39875689201 A/A p99 failure (ratio 1.23928982, limit 1.10),
+customer migration receipt, operational dispositions, 403 cleanup verification
+and actual target-specific human visual observation remain holds.
+
+| Date | Summary |
+|---|---|
+| 2026-10-23 | Independent exact Hono remediation started from master; dependency RED confirmed; runtime-presence lesson retained. |
+| 2026-10-23 | Normally merge prerequisite #252 and verify its authoritative merged-source CI/artifact, then preserve both contexts in the ordinary Hono/master merge. |
+| 2026-10-23 | Protected bootstrap 25/25 PASS; authenticate minimal CI artifact 12506119257/run 39965730441 and prove actual installed+locked Hono 4.13.11 with 42 focused tests. |
+
+- [x] ✅ COMPLETED: Verify handoff receipts, fresh base and actual locked RED.
+- [x] ✅ COMPLETED: Normally merge reviewed prerequisite #252, verify merged
+  source CI and ordinarily incorporate master without rewriting Hono history.
+- [x] ✅ COMPLETED: Publish bootstrap through ordinary hooks, 25/25 PASS
+  (783.4 seconds); CI-only regeneration at exact source `62bf4d1e`.
+- [x] ✅ COMPLETED: Verify downloaded ZIP, all lock entries/ages and minimal
+  diff, apply only intended locks, restore via approved-registry `npm ci`
+  without lock rewrites, prove actual installed/locked Hono 4.13.11.
+- [x] ✅ COMPLETED: Permanent actual-lock guard RED then GREEN; pin checker
+  19 -> 21 cases, plus 21 inherited freshness cases, 42/42 PASS.
+- [ ] Final patched-tree protected push, exact-tip CI and hosted Hono review.
+
+**Historical publication blockers:** three ordinary Fast pushes published
+nothing. The first caught a stale README version badge (fixed). The second
+passed 24 gates but failed one unchanged HTTP test with `ENOBUFS`; its focused
+rerun passed 57/57. The third passed 23 static gates but failed the unchanged
+`endpoint-cache-freshness.spec.ts` non-UTC nested Node/Jest probe at 30,119ms,
+`ETIMEDOUT` (6,209 passed, one failed). That baseline tooling issue was
+isolated in prerequisite #252, not imported as unrelated #251 tooling.
+No hook bypass, timeout
+change or favorable retry is claimed as the historical GREEN. The separate
+prerequisite and ordinary merge now unblock publication, as recorded above.
+Retained local evidence: `test-results/hono-security-20261023/`.
+
+**Current dependency receipts:** artifact run `39965730441` / ID `12506119257`,
+ZIP SHA-256 `f2e318928b7aa6e672983ba1acb492bcbd8a73066db5a50355b06e9521b6bf58`.
+Only Hono changes; web package entries are unchanged, with version metadata
+only. API lock SHA-256 `ee7c44126acd1ef5949320f5c181c5e1291794cb41920f6c1324ab3689f7b4fc`.
+Fresh API audit is zero; web audit exits 1 with three unchanged Moderate
+Vitest packages (zero High/Critical), tracked separately in the policy.
+This is private dependency proof, not deployment or new performance admission.
+
+**Design disposition: accepted.** An exact transitive patch uses existing
+override/provenance seams; adding an application abstraction is speculative.
+
 ### Separate timezone-harness prerequisite (2026-10-23)
 
 Branch `test/timezone-leaf-prerequisite-20261023` starts from verified master
@@ -18,7 +75,13 @@ No product bump (still 0.55.58), Hono, lockfile or performance-tooling change.
 
 - [x] ✅ COMPLETED: Confirm actual full-hook spawn-timeout RED and focused
   real-leaf outcome/launcher controls, without relaxing deadlines.
-- [ ] Publish via ordinary hook, exact-tip CI and hosted review; do not merge.
+- [x] ✅ COMPLETED: Ordinary protected push passes all 25 gates; exact-tip
+  CI and hosted review 5628884972 report no findings at `5a42eb09`.
+- [x] ✅ COMPLETED: Operator-authorized normal merge #252 at `fc962a65`;
+  authoritative merged-source Build Test Image 39962553306 and CodeQL
+  39962437032 PASS. The bot review is COMMENTED, not human GitHub approval.
+  Immutable test image:
+  `sha256:93ab5bd73465bdd215eeb2e3471022188d854d97a730d50b752c17e00eb238b0`.
 
 Preserve Hono branch `chore/regen-lockfile-hono-security-20261023` at
 `e18d32c04855e8acf88c8a3e02c9ec7b447cfb21` and qualification branch at

@@ -1,6 +1,6 @@
 {
   "name": "scimserver-api",
-  "version": "0.55.58",
+  "version": "0.55.59",
   "description": "SCIMServer backend service providing SCIM 2.0 endpoints and logging for troubleshooting.",
   "license": "MIT",
   "main": "dist/main.js",
@@ -85,7 +85,7 @@
     "defu": "6.1.5",
     "effect": "3.20.0",
     "fast-uri": "4.1.5",
-    "hono": "4.13.7",
+    "hono": "4.13.11",
     "multer": "2.4.0",
     "deepmerge-ts": "8.0.0",
     "mysql2": "3.23.1",

@@ -29,6 +29,53 @@ import {
   type PackageAdvisory,
 } from './check-dependency-pins';
 import fs from 'fs/promises';
+import { resolve } from 'node:path';
+
+describe('Hono security remediation (GHSA-5r4p-p66f-jhc7)', () => {
+  const vulnerableRange = '>= 4.12.4, < 4.13.11';
+
+  it('recognizes the affected range and recommends the minimal exact patch', () => {
+    expect(satisfiesGhsaRange('4.12.3', vulnerableRange)).toBe(false);
+    expect(satisfiesGhsaRange('4.13.7', vulnerableRange)).toBe(true);
+    expect(satisfiesGhsaRange('4.13.11', vulnerableRange)).toBe(false);
+    const findings = evaluatePins(
+      { hono: '4.13.7' },
+      [{
+        packageName: 'hono',
+        ghsaId: 'GHSA-5r4p-p66f-jhc7',
+        cveId: 'CVE-2026-111757',
+        severity: 'medium',
+        summary: 'serveStatic double decoding can bypass protected static-prefix middleware',
+        vulnerableRanges: [vulnerableRange],
+        firstPatchedVersions: ['4.13.11'],
+      }],
+    );
+    expect(findings).toHaveLength(1);
+    expect(findings[0].recommendedVersion).toBe('4.13.11');
+  });
+
+  it('locks every actual Hono occurrence to the exact patched override with public provenance', async () => {
+    const manifest = JSON.parse(
+      await fs.readFile(resolve(__dirname, '../../package.json'), 'utf8'),
+    ) as { overrides: { hono: string } };
+    const lock = JSON.parse(
+      await fs.readFile(resolve(__dirname, '../../package-lock.json'), 'utf8'),
+    ) as {
+      packages: Record<string, { version: string; resolved?: string; integrity?: string }>;
+    };
+    const entries = Object.entries(lock.packages).filter(([name]) =>
+      /(?:^|\/)node_modules\/hono$/.test(name),
+    );
+    expect(manifest.overrides.hono).toBe('4.13.11');
+    expect(entries.length).toBeGreaterThan(0);
+    for (const [, entry] of entries) {
+      expect(entry.version).toBe(manifest.overrides.hono);
+      expect(satisfiesGhsaRange(entry.version, vulnerableRange)).toBe(false);
+      expect(entry.resolved).toMatch(/^https:\/\/registry\.npmjs\.org\/hono\/-\//);
+      expect(entry.integrity).toMatch(/^sha512-[A-Za-z0-9+/]+=*$/);
+    }
+  });
+});
 
 describe('compareVersions', () => {
   it('orders by numeric segment, not lexically', () => {

@@ -1,6 +1,6 @@
 # Authentication Guide
 
-> **Status:** Living reference - **Last verified:** 2026-10-21 - **Product version:** `0.55.58`
+> **Status:** Living reference - **Last verified:** 2026-10-21 - **Product version:** `0.55.59`
 >
 > **The captured protocol examples below were measured against a running server.** Request and response bodies are verbatim wire captures. Status codes and `reason_code` values are what the server actually returned. The reason-code table in [Section 8](#8-troubleshooting) is generated from [auth-reason-catalog.ts](../api/src/oauth/auth-reason-catalog.ts), so it cannot drift from the implementation.
 >

@@ -1,8 +1,8 @@
 # Azure Deployment & Usage Guide
 
-> **Status:** User-facing reference - **Last verified:** 2026-08-12 - **Product version:** `0.55.58`
+> **Status:** User-facing reference - **Last verified:** 2026-08-12 - **Product version:** `0.55.59`
 
-> **Version:** 0.55.58 - **Updated:** June 3, 2026
+> **Version:** 0.55.59 - **Updated:** June 3, 2026
 > **Source of truth:** [deploy.ps1](../deploy.ps1), [scripts/deploy-azure.ps1](../scripts/deploy-azure.ps1), [infra/](../infra/)
 
 ---

@@ -1,8 +1,8 @@
 # Complete API Reference
 
-> **Status:** User-facing reference - **Last verified:** 2026-10-16 - **Product version:** `0.55.58`
+> **Status:** User-facing reference - **Last verified:** 2026-10-16 - **Product version:** `0.55.59`
 
-> **Version:** 0.55.58 - **Updated:** 2026-10-16
+> **Version:** 0.55.59 - **Updated:** 2026-10-16
 > **Current release:** [Release notes, upgrade steps and validation limits](RELEASE_NOTES.md). Earlier isolated P1-P9 receipts remain historical; the correctness consolidation is included in the deployed release.
 > **Base URL:** `http://localhost:{PORT}/scim` (configurable via `API_PREFIX` env var)
 > **121 route handlers** across 33 controllers (includes 2 dashboard analytics routes and the web SPA catch-all). Counted from the `@Get`/`@Post`/`@Put`/`@Patch`/`@Delete`/`@Sse` decorators in `api/src/**/*.controller.ts` with comments stripped; the count is enforced by `node scripts/audit-doc-content.mjs`.

@@ -1,22 +1,50 @@
 # SCIMServer - Context Instructions for AI Assistants
 
 > **Purpose**: This file provides complete project context for AI coding assistants (GitHub Copilot, etc.) to enable productive sessions without re-discovery of architecture, patterns, and decisions.
-> **Version**: 0.55.58
+> **Version**: 0.55.59
 > **Last Updated**: October 21, 2026
-> **Last verified:** 2026-10-22
+> **Last verified:** 2026-10-23
 
 ---
 
 ## Active Delivery Process
 
+**2026-10-23 dependency remediation:** 0.55.59 reserves an independent exact
+Hono 4.13.11 patch for #248, based on master e1070ba2. CI-only lockfiles,
+final protected publication and hosted review remain required.
+Historical bootstrap publication was blocked: three ordinary Fast attempts published
+nothing. The final attempt fails the unchanged non-UTC nested Node/Jest
+timestamp probe at its existing 30-second limit (ETIMEDOUT, 6,209 units pass).
+Prerequisite #252 is now normally merged at `fc962a65`, with authoritative
+merged-source CI 39962553306 and CodeQL 39962437032 PASS. Its immutable
+test-image digest is `sha256:93ab5bd73465bdd215eeb2e3471022188d854d97a730d50b752c17e00eb238b0`.
+This is not patched-Hono proof. Ordinarily merge master into the preserved
+Hono branch; do not import other #251 tooling or bypass hooks. Ordinary merge
+`62bf4d1e` preserves all four Hono commits. Its protected bootstrap passes
+25/25 gates (6,210 units; 2,514 HTTP passes plus 42 backend skips), but those
+old-installation checks are not patched proof.
+CI-only regeneration 39965730441 / artifact 12506119257 is authenticated:
+only Hono 4.13.7 -> 4.13.11 plus 0.55.59 API/web metadata changes, public URLs,
+sha512 and a 24.3217-day publication age. Approved-registry `npm ci` preserves
+the lockfile and actual installed routes now contain 4.13.11.
+The permanent actual-lock guard was RED on 4.13.7 and is now GREEN; 21 pin
+and 21 inherited freshness cases pass. Final full patched gates/PR review
+are separate receipts. API audit is zero; unchanged web Vitest packages
+have three Moderate audit findings (zero High/Critical), not a clean audit.
+Frozen 0.55.58 runtime-presence evidence is not new-candidate proof.
+Do not absorb #251 tooling, rerun performance or alter its failed admission,
+customer migration, operational, cleanup or human visual verification holds.
+
 **2026-10-23 test-harness prerequisite:** a separate master-based branch ports
 only the real-leaf timezone tests from reviewed `84d11af7`, with runtime
 entrypoint/loader receipt checks. Original 30-second child/35-second parent
 limits remain. All 21 focused cases pass; former nested launcher and actual
 UTC-conversion negative controls fail as expected, with production restored.
 No product bump, Hono/lockfile change or performance-tooling import.
-The Hono branch stays preserved at e18d32c0 until this prerequisite is reviewed
-and normally merged. No merge, deployment or new performance admission.
+The Hono branch's four original commits through e18d32c0 stay preserved.
+Hosted review 5628884972 recommends approval with no findings but remains
+COMMENTED, not human GitHub approval. Only #252 is normally merged; no Hono
+merge, deployment or new performance admission is authorized.
 
 **2026-10-22 review follow-up:** hosted Copilot review succeeds after billing
 selection and identifies a real shared-cache binding collision. The generic