pranems · Oct 29, 2026 · Oct 29, 2026 · Oct 29, 2026 · Oct 29, 2026 · Oct 29, 2026
@@ -7,6 +7,38 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### 0.55.62 web advisory patch bootstrap (2026-10-29)
+
+- Reserve 0.55.62 from merged master `727860866c53c7ec8d01d1ff5bae858f80a1715d`.
+  Change only exact web Seroval 1.6.3 -> 1.6.11 and Undici 7.29.1 -> 7.30.1;
+  preserve the API dependency graph and merged security/fixture corrections.
+- Focused TDD RED: six real assertions fail before manifest edits across pins,
+  all lock occurrences and all installed owners. Preserve the draft outside
+  source until authenticated CI lock import; bootstrap hook GREEN is old-tree
+  evidence only, not a patched dependency result.
+- Prior merged counts: API units 6,220; HTTP 2,514 plus 42 skips; web 1,655.
+  Final current-tip counts and CI-owned lock provenance remain pending.
+- Authenticated regeneration 40895972413 / artifact 12906712562 changes only
+  the two web packages and coordinated release metadata. Clean restores keep
+  both CI lock hashes unchanged. Focused GREEN: 35/35, including six new
+  regressions. Web full npm inventory exits 0; existing API full-tree owner
+  context errors remain a separate explicit limitation, not blanket clearance.
+- Bootstrap ordinary Fast hook: 25/25 gates, 618.2 seconds; units 6,220 and
+  HTTP 2,514 plus 42 skips. The retained native/OS HTTP worker warning is not
+  reclassified as a fixed unit-fixture leak.
+- Hosted CI caught a local-only prerequisite assumption: API units run
+  before web installation. Move all six dependency regressions to the
+  existing web Vitest lane, preserving every assertion and using native
+  owner resolution. Focused web GREEN: 6/6. No workflow/gate redesign or skip.
+  Earlier local Validate at `52200e33` passed 28/28 in 783.1 seconds with
+  units 6,226, HTTP 2,514 +42 skips and web 1,655; those are not final-tip
+  proof after the test relocation. Fresh protected Validate is required.
+- Update user-facing release notes, indexed scope/RCA, Session and Context.
+  Issue #256 stays open for six independent API advisory records.
+- Self-improvement: all-occurrence and real-owner regressions, without skips.
+  Design disposition: accepted, existing exact override/process is cohesive.
+  No application refactor, browser behavior change, merge or deployment.
+
 ### Fixture branch integration with merged security master (2026-10-29)
 
 - Normally integrate security PR #258 merge `80460d59` into draft PR #257,

@@ -1,6 +1,6 @@
 # SCIMServer Deployment Options
 
-> **Status:** User-facing reference - **Last verified:** 2026-10-16 - **Product version:** `0.55.61`
+> **Status:** User-facing reference - **Last verified:** 2026-10-16 - **Product version:** `0.55.62`
 
 > Updated: 2026-10-16 - Scope: production + local deployment paths
 

@@ -1,6 +1,6 @@
 # SCIMServer
 
-> **Status:** User-facing reference - **Last verified:** 2026-10-21 - **Product version:** `0.55.61`
+> **Status:** User-facing reference - **Last verified:** 2026-10-21 - **Product version:** `0.55.62`
 
 > Production-ready, multi-tenant SCIM 2.0 server for Microsoft Entra ID provisioning and any RFC 7643/7644-compliant identity client.
 
@@ -15,7 +15,7 @@ For actual supported shapes and integration limits, see
 Keep strict validation enabled for Entra; diagnose the request and effective
 schema before applying a targeted compatibility setting.
 
-[![Version](https://img.shields.io/badge/version-0.55.61-blue)]()
+[![Version](https://img.shields.io/badge/version-0.55.62-blue)]()
 [![Node.js](https://img.shields.io/badge/Node.js-24-green)]()
 [![NestJS](https://img.shields.io/badge/NestJS-11.1-red)]()
 [![PostgreSQL](https://img.shields.io/badge/PostgreSQL-17-blue)]()

@@ -2,6 +2,27 @@
 
 **Last verified:** 2026-10-29
 
+### Independent web advisory patch boundary (2026-10-29)
+
+PR #257 is normally merged at `727860866c53c7ec8d01d1ff5bae858f80a1715d`.
+The independent branch `fix/web-seroval-undici-20261029` reserves 0.55.62:
+web Seroval 1.6.11 and Undici 7.30.1 only, API graph unchanged.
+Six focused assertions failed on actual old pins/locks/installed owners before
+manifest edits. CI-only locks are authenticated from run 40895972413 and
+artifact 12906712562; all 35 focused tests and full web npm inventory pass.
+API package graph is unchanged; its pre-existing full-tree override-context
+errors remain explicit, despite top-level inventory exit 0.
+Final protected Validate and hosted review remain pending.
+Historical `52200e33` Validate passed locally, but hosted CI correctly failed
+installed-web tests in the API-before-web-install lane. All six regressions
+now live in web's existing post-install Vitest lane and pass focused GREEN.
+No workflow order, test skip or assertion relaxation was introduced.
+See [scope, RCA and validation](docs/WEB_SEROVAL_UNDICI_SECURITY_REMEDIATION.md).
+The prior fixture/draft boundary below is historical. Keep issue #256 open,
+PR #251 untouched, and all release holds. No merge or deployment authorized.
+Self-improvement is applied through owner/all-occurrence checks; design
+disposition is accepted because existing exact overrides need no abstraction.
+
 ### Current consolidation boundary (2026-10-29)
 
 Security PR #258 is normally merged into master at `80460d59`. Draft PR #257

@@ -1,6 +1,6 @@
 {
   "name": "scimserver-api",
-  "version": "0.55.61",
+  "version": "0.55.62",
   "description": "SCIMServer backend service providing SCIM 2.0 endpoints and logging for troubleshooting.",
   "license": "MIT",
   "main": "dist/main.js",

@@ -1,6 +1,6 @@
 # Authentication Guide
 
-> **Status:** Living reference - **Last verified:** 2026-10-21 - **Product version:** `0.55.61`
+> **Status:** Living reference - **Last verified:** 2026-10-21 - **Product version:** `0.55.62`
 >
 > **The captured protocol examples below were measured against a running server.** Request and response bodies are verbatim wire captures. Status codes and `reason_code` values are what the server actually returned. The reason-code table in [Section 8](#8-troubleshooting) is generated from [auth-reason-catalog.ts](../api/src/oauth/auth-reason-catalog.ts), so it cannot drift from the implementation.
 >

@@ -1,8 +1,8 @@
 # Azure Deployment & Usage Guide
 
-> **Status:** User-facing reference - **Last verified:** 2026-08-12 - **Product version:** `0.55.61`
+> **Status:** User-facing reference - **Last verified:** 2026-08-12 - **Product version:** `0.55.62`
 
-> **Version:** 0.55.61 - **Updated:** June 3, 2026
+> **Version:** 0.55.62 - **Updated:** June 3, 2026
 > **Source of truth:** [deploy.ps1](../deploy.ps1), [scripts/deploy-azure.ps1](../scripts/deploy-azure.ps1), [infra/](../infra/)
 
 ---

@@ -1,8 +1,8 @@
 # Complete API Reference
 
-> **Status:** User-facing reference - **Last verified:** 2026-10-16 - **Product version:** `0.55.61`
+> **Status:** User-facing reference - **Last verified:** 2026-10-16 - **Product version:** `0.55.62`
 
-> **Version:** 0.55.61 - **Updated:** 2026-10-16
+> **Version:** 0.55.62 - **Updated:** 2026-10-16
 > **Current release:** [Release notes, upgrade steps and validation limits](RELEASE_NOTES.md). Earlier isolated P1-P9 receipts remain historical; the correctness consolidation is included in the deployed release.
 > **Base URL:** `http://localhost:{PORT}/scim` (configurable via `API_PREFIX` env var)
 > **121 route handlers** across 33 controllers (includes 2 dashboard analytics routes and the web SPA catch-all). Counted from the `@Get`/`@Post`/`@Put`/`@Patch`/`@Delete`/`@Sse` decorators in `api/src/**/*.controller.ts` with comments stripped; the count is enforced by `node scripts/audit-doc-content.mjs`.

@@ -1,14 +1,30 @@
 # SCIMServer - Context Instructions for AI Assistants
 
 > **Purpose**: This file provides complete project context for AI coding assistants (GitHub Copilot, etc.) to enable productive sessions without re-discovery of architecture, patterns, and decisions.
-> **Version**: 0.55.61
+> **Version**: 0.55.62
 > **Last Updated**: October 29, 2026
 > **Last verified:** 2026-10-29
 
 ---
 
 ## Active Delivery Process
 
+**2026-10-29 independent web advisory patch:** merged master is
+`727860866c53c7ec8d01d1ff5bae858f80a1715d` (0.55.61).
+The new bounded patch reserves 0.55.62 for Seroval 1.6.11 and Undici 7.30.1,
+with no API dependency graph changes. Six genuine focused RED assertions are
+retained; authenticated CI locks (run 40895972413), 35/35 focused tests and
+actual full web npm inventory now pass. API graph is unchanged, with existing
+full-tree override-context errors explicitly retained as a separate finding.
+Normal final Validate and hosted review remain pending.
+Hosted source `52200e33` exposed API tests reading web packages before CI
+installs them. All six new regressions now run in web's existing Vitest lane;
+focused 6/6 passes without workflow changes or skips. Prior local Validate
+results are historical and must not be substituted for the corrected tip.
+See [scope and RCA](WEB_SEROVAL_UNDICI_SECURITY_REMEDIATION.md).
+This supersedes the older draft #257 status below. No merge/deployment,
+release admission or closure of issue #256 is authorized.
+
 **2026-10-29 current consolidation:** security PR #258 merged normally at
 `80460d59`. Draft #257 integrates that master while preserving its prior
 `9d6d5c62` fixture/diagnosis history. Product remains 0.55.61 and CI-owned

@@ -9,7 +9,7 @@ or fetching them. See [minimal-schema validation](GOOGLE_MINIMAL_GROUP_MEMBERSHI
 [reference persistence and compatibility](GROUP_MEMBER_REFERENCE_PRESERVATION.md)
 and [release notes](RELEASE_NOTES.md).
 
-> **Status:** User-facing reference - **Last verified:** 2026-10-16 - **Product version:** `0.55.61`
+> **Status:** User-facing reference - **Last verified:** 2026-10-16 - **Product version:** `0.55.62`
 
 > **P7a behavior, included since 0.55.36:** [Profile validation](SCIM_P7A_PROFILE_VALIDATION.md)
 > adds declaration/type/cardinality checks, required extension enforcement,

@@ -1,8 +1,8 @@
 # Docker Guide
 
-> **Status:** User-facing reference - **Last verified:** 2026-10-09 - **Product version:** `0.55.61`
+> **Status:** User-facing reference - **Last verified:** 2026-10-09 - **Product version:** `0.55.62`
 
-> **Version:** 0.55.61 - **Updated:** June 3, 2026
+> **Version:** 0.55.62 - **Updated:** June 3, 2026
 > **Source of truth:** [Dockerfile](../Dockerfile), [docker-compose.yml](../docker-compose.yml)
 
 ---

@@ -1,8 +1,8 @@
 # Endpoint Configuration Flags Reference
 
-> **Status:** User-facing reference - **Last verified:** 2026-09-29 - **Product version:** `0.55.61`
+> **Status:** User-facing reference - **Last verified:** 2026-09-29 - **Product version:** `0.55.62`
 
-> **Version:** 0.55.61 - **Updated:** September 29, 2026
+> **Version:** 0.55.62 - **Updated:** September 29, 2026
 > **Source of truth:** [endpoint-profile.types.ts](../api/src/modules/scim/endpoint-profile/endpoint-profile.types.ts) (`ProfileSettings`)
 > 39 registered settings in the unreleased lifetime port: 20 boolean + 16 numeric (11 runtime-egress overrides + 3 active-credential caps + 2 token lifetimes) + 3 other typed values. `PersistRequestSecrets` is inert and `CredentialSecretVisibility` supports only `always`. See the [behavioral evidence and explicit coverage gaps](SCIM_SETTINGS_BEHAVIOR_EVIDENCE.md) and [Entra compatibility guide](SCIM_ENTRA_COMPATIBILITY.md). Registry membership is not evidence of enforcement.
 > 6 value types: `boolean`, `logLevel`, `primaryEnforcement`, `credentialVisibility`, `structured`, and `number` (the last added for the runtime JWKS-fetch egress knobs).

@@ -1,8 +1,8 @@
 # Create Your Own SCIM Endpoint - Self-Service Wiki
 
-> **Status:** User-facing reference - **Last verified:** 2026-10-16 - **Product version:** `0.55.61`
+> **Status:** User-facing reference - **Last verified:** 2026-10-16 - **Product version:** `0.55.62`
 
-> **Version:** 0.55.61 - **Updated:** 2026-10-16
+> **Version:** 0.55.62 - **Updated:** 2026-10-16
 > Beginner-friendly, copy-paste guide for standing up a SCIM endpoint in minutes.
 > **Source of truth:** [endpoint.controller.ts](../api/src/modules/endpoint/controllers/endpoint.controller.ts) - [built-in-presets.ts](../api/src/modules/scim/endpoint-profile/built-in-presets.ts)
 

@@ -1,8 +1,8 @@
 # Endpoint Lifecycle & Usage Guide
 
-> **Status:** User-facing reference - **Last verified:** 2026-10-12 - **Product version:** `0.55.61`
+> **Status:** User-facing reference - **Last verified:** 2026-10-12 - **Product version:** `0.55.62`
 
-> **Version:** 0.55.61 - **Updated:** June 3, 2026
+> **Version:** 0.55.62 - **Updated:** June 3, 2026
 > Quick-start recipes for common SCIMServer operations
 
 ---

@@ -1,6 +1,6 @@
 # Endpoint Profile Architecture
 
-> **Status:** User-facing reference - **Last verified:** 2026-10-21 - **Product version:** `0.55.61`
+> **Status:** User-facing reference - **Last verified:** 2026-10-21 - **Product version:** `0.55.62`
 
 > **Updated:** 2026-10-17
 > **Source of truth:** [endpoint-profile/](../api/src/modules/scim/endpoint-profile/) and [endpoint.service.ts](../api/src/modules/endpoint/services/endpoint.service.ts)

@@ -1,6 +1,6 @@
 # Global navigation and workflow context
 
-> **Status:** User-facing reference - **Last verified:** 2026-10-16 - **Product version:** `0.55.61`
+> **Status:** User-facing reference - **Last verified:** 2026-10-16 - **Product version:** `0.55.62`
 
 See [current release notes](RELEASE_NOTES.md) for deployment and acceptance
 boundaries. Endpoints now uses available window height, Dashboard uses compact

@@ -1,8 +1,8 @@
 # SCIMServer Documentation Index
 
-> **Status:** User-facing reference - **Last verified:** 2026-10-21 - **Product version:** `0.55.61`
+> **Status:** User-facing reference - **Last verified:** 2026-10-21 - **Product version:** `0.55.62`
 
-> **Version:** 0.55.61 - **Updated:** 2026-10-21
+> **Version:** 0.55.62 - **Updated:** 2026-10-21
 > 6 presets - **39 endpoint settings controls** in the unreleased lifetime port (20 boolean flags + 3 other typed settings + 16 numerics) - profile-driven User, Group, and custom ResourceType forms
 
 **Unreleased preparation:** [endpoint token lifetime integration and original
@@ -11,6 +11,8 @@ current-master port from earlier isolated validation and deployed behavior.
 
 ### Start here
 
+**Independent web Seroval/Undici correction:** [Scope, actual owners and evidence](WEB_SEROVAL_UNDICI_SECURITY_REMEDIATION.md)
+
 **Pending request-body security correction:** [Implementation and evidence](REQUEST_BODY_SECURITY_REMEDIATION.md)
 records proposed 0.55.61, exact API patches, CI-only locks and distinct bootstrap
 versus installed-graph validation. No merge or deployment is authorized.

@@ -1,6 +1,6 @@
 # Logging & Observability Guide
 
-> **Status:** User-facing reference - **Last verified:** 2026-10-16 - **Product version:** `0.55.61`
+> **Status:** User-facing reference - **Last verified:** 2026-10-16 - **Product version:** `0.55.62`
 
 **Current UI presentation:** absolute timestamps in Logs, Activity, Operations
 and live/detail drawers include full UTC date/time and milliseconds. Copy

@@ -1,8 +1,8 @@
 # Multi-Endpoint Architecture Guide
 
-> **Status:** User-facing reference - **Last verified:** 2026-09-28 - **Product version:** `0.55.61`
+> **Status:** User-facing reference - **Last verified:** 2026-09-28 - **Product version:** `0.55.62`
 
-> **Version:** 0.55.61 - **Updated:** June 3, 2026
+> **Version:** 0.55.62 - **Updated:** June 3, 2026
 > **Source of truth:** [endpoint.service.ts](../api/src/modules/endpoint/services/endpoint.service.ts)
 
 ---

@@ -1,6 +1,6 @@
 # Observability, Traceability, Correlation IDs, Logging, Error Handling and Diagnostics
 
-> **Status:** User-facing reference - **Last verified:** 2026-10-16 - **Product version:** `0.55.61`
+> **Status:** User-facing reference - **Last verified:** 2026-10-16 - **Product version:** `0.55.62`
 
 **Current operator presentation:** all absolute UI timestamps carry complete
 UTC date/time, milliseconds and timezone; invalid expiry values are explicit,

@@ -11,7 +11,7 @@ rejected later operation saves no earlier mutation. See
 [reference persistence and rollback compatibility](GROUP_MEMBER_REFERENCE_PRESERVATION.md)
 and [current release notes](RELEASE_NOTES.md).
 
-> **Status:** User-facing reference - **Last verified:** 2026-10-16 - **Product version:** `0.55.61`
+> **Status:** User-facing reference - **Last verified:** 2026-10-16 - **Product version:** `0.55.62`
 
 > Comprehensive, source-verified reference for every PATCH option, mode, setting, path form, verb, and persistence outcome across Users, Groups, custom extensions, and custom resource types - grounded in RFC 7644 / RFC 7643 and the SCIMServer implementation.
 

@@ -1,8 +1,8 @@
 # Prod -> Dev mirroring + synthetic shape-coverage fixtures
 
-> **Status:** User-facing reference - **Last verified:** 2026-10-16 - **Product version:** `0.55.61`
+> **Status:** User-facing reference - **Last verified:** 2026-10-16 - **Product version:** `0.55.62`
 
-> **Version:** 0.55.61  -  **Date:** May 6, 2026
+> **Version:** 0.55.62  -  **Date:** May 6, 2026
 > **Scope:** dev-tooling, no API surface change
 > **Affects:** [api/src/scripts/mirror-prod-to-dev.ts](../api/src/scripts/mirror-prod-to-dev.ts), [api/src/scripts/seed-shape-coverage.ts](../api/src/scripts/seed-shape-coverage.ts), [scripts/mirror-prod-to-dev.ps1](../scripts/mirror-prod-to-dev.ps1)
 

@@ -1,6 +1,6 @@
 # SCIMServer release notes
 
-> **Status:** User-facing reference - **Last verified:** 2026-10-23 - **Product version:** `0.55.61`
+> **Status:** User-facing reference - **Last verified:** 2026-10-23 - **Product version:** `0.55.62`
 
 These curated notes explain what changes for operators and integrators, how to
 upgrade, and what remains limited. The [engineering changelog](../CHANGELOG.md)
@@ -15,6 +15,21 @@ notes rather than assuming that a patch label makes every rollback lossless.
 
 ## Unreleased
 
+### 0.55.62 web Seroval and Undici security dependency patch
+
+This proposed patch updates exact web overrides from Seroval 1.6.3 to
+1.6.11 and Undici 7.29.1 to 7.30.1. These minimal compatible patches address
+the five Seroval and eight Undici advisory records listed in
+[issue #256](https://github.com/pranems/SCIMServer/issues/256).
+Both patches exceed the seven-day quarantine minimum. The existing API
+request-body security correction remains intact; six separate API advisory
+records remain open. See [ownership, scope and validation](WEB_SEROVAL_UNDICI_SECURITY_REMEDIATION.md).
+CI-generated locks now contain only the two intended package updates; the
+restored web dependency inventory and all focused pin/owner tests pass.
+Final protected validation and hosted review remain required.
+No UI behavior, deployment, browser
+exploitability assessment or overall release approval is included.
+
 ### 0.55.61 request-body security dependency patch
 
 This draft patch pins body-parser to 2.4.0 and multer to 2.5.0 for the two

@@ -1,6 +1,6 @@
 # Remote Debugging & Diagnosis Guide
 
-> **Status:** User-facing reference - **Last verified:** 2026-10-09 - **Product version:** `0.55.61`
+> **Status:** User-facing reference - **Last verified:** 2026-10-09 - **Product version:** `0.55.62`
 
 > **Version:** 3.2 - **Source-verified against:** v0.55.36 - **Updated:** 2026-10-01
 > Request-history identity and authenticated stream transport re-verified against v0.55.36 on 2026-10-01; the full line-by-line pass dates from v0.53.0.

@@ -1,6 +1,6 @@
 # Schema Attribute Customization Guide
 
-> **Status:** User-facing reference - **Last verified:** 2026-09-28 - **Product version:** `0.55.61`
+> **Status:** User-facing reference - **Last verified:** 2026-09-28 - **Product version:** `0.55.62`
 
 > **Version**: 1.1 - **Date**: 2026-08-04 - **Status**: Complete (PATCH merge semantics re-verified against `mergeProfilePartial()` on 2026-08-04; the full line-by-line source pass dates from v0.40.0)  
 > **Audience**: Operators, ISV admins, Entra ID integration engineers