diff --git a/docs/reviews/2026-10-31-follow-redirects-patch.md b/docs/reviews/2026-10-31-follow-redirects-patch.md new file mode 100644 index 0000000..87fdc16 --- /dev/null +++ b/docs/reviews/2026-10-31-follow-redirects-patch.md @@ -0,0 +1,15 @@ +# Redirect dependency security review + +One fresh read-only gpt-6-astra/high whole-change review on59e2e19..708d120 found no Critical, Important or Minor issues. No material fix pass or re-review was needed. The reviewer independently checked the complete patch, all locked resolutions and registry integrity, and ran the owned loopback old/new harness. Full workspace checks and audit remain coordinator evidence. + +Baseline CI reported GHSA-mrwp-f3q8-3g9p: one high plus four moderate findings. The existing Nx override minimum now excludes1.16.1; the generated lock changes only follow-redirects to1.16.2 and its Axios/http-proxy/Nx edges. No audit policy, permissions or runtime source changed. The advisory did not reproduce through Axios1.20.0; this tooling finding is not proof of an observed credential incident or published-product exposure. + +Fresh Node24.22.1/pnpm9.12.0 verification: + +- Exact registry1.16.1 failed two cross-realm custom-header confidentiality cases; same-realm controls passed. Registry1.16.2 passed all four object/array-header and same/cross-realm cases, preserving a harmless header and removing built-in Authorization. Only synthetic headers and owned loopback servers were used. The temporary harness is local dependency-correction evidence, not an application regression test. +- Unmodified `pnpm install --frozen-lockfile` passed. +- `pnpm audit --audit-level=high` exited0: high/critical0, moderate4 remain. JSON audit reports all severities and exited1; retain that raw result rather than claiming a clean audit. +- `NX_DAEMON=false pnpm exec nx run-many -t lint test build typecheck --exclude domscribe-test-fixtures --parallel=2 --skip-nx-cache` passed17 projects and9 dependency tasks:2225tests/129files. Existing fixture non-null warnings and expected fault-injection logs remain; no failures were suppressed. +- Seven unchanged mirror tests, package/plan Prettier and diff whitespace checks passed. An extra generated-lock Prettier check stopped the first wrapper; original main's lock also fails it. Preserve the minimal generated delta; subsequent configured checks above passed. A later documentation write initially lacked its new directory; creating that directory corrected the command before any commit/push. + +Required latest-head hosted CI remains mandatory. No package publication, deployment, customer workload, inference or credential action occurred. Separate moderate advisories and hosted/runtime qualification remain open. diff --git a/docs/superpowers/plans/2026-10-31-follow-redirects-patch.md b/docs/superpowers/plans/2026-10-31-follow-redirects-patch.md new file mode 100644 index 0000000..58cdfb4 --- /dev/null +++ b/docs/superpowers/plans/2026-10-31-follow-redirects-patch.md @@ -0,0 +1,17 @@ +# Repair the tooling redirect dependency + +Native execution under the user's continuous-build instruction. Always use this isolated worktree; preserve primary checkouts. No publication, deployment, credentials or account changes. + +## Contract + +CI audit on unchanged main dependencies reports GHSA-mrwp-f3q8-3g9p: follow-redirects 1.16.1. Upstream fixes it in 1.16.2. Nx is a root development dependency; no direct application import was found. Do not claim an observed credential incident, shipped exposure, or that Axios reproduces the advisory. Keep the four separate moderate findings visible. + +### Task 1: Compatible patch and verified delivery + +- Preserve baseline high-audit evidence. In owned temporary directories, exercise exact registry artifacts with real loopback redirects and a synthetic custom header: same-realm and cross-realm sensitiveHeaders, preserving a harmless header. The cross-realm old artifact must fail the intended confidentiality assertion before the dependency update. +- Raise the existing Nx override minimum to ^1.16.2 and update only follow-redirects resolution, reviewing the full lockfile delta. Verify the patched artifact, frozen install, high-level audit, affected configured checks and unchanged mirror-helper baseline. Do not add an application test that only tests upstream mechanics; retain the temporary harness as evidence. +- Obtain one independent whole-change review; resolve material findings with a regression-backed pass. Push a focused ready PR, attach it, require all latest-head checks, then merge under existing OSS authority. Refresh/rebase the separately reviewed helper PR only after security delivery. No failing-audit bypass. + +## Review focus + +Every vulnerable resolution is removed; the patch remains compatible and no unrelated package drifts. Distinguish source dependencies from published artifacts and fresh evidence from assumptions. Preserve all audit checks and existing permissions. diff --git a/package.json b/package.json index f6daf5d..8141db4 100644 --- a/package.json +++ b/package.json @@ -136,7 +136,7 @@ "pnpm": { "overrides": { "nx>axios": "^1.20.0", - "nx>follow-redirects": "^1.16.1", + "nx>follow-redirects": "^1.16.2", "nx>brace-expansion": "^5.0.12", "nx>smol-toml": "^1.9.1", "postcss-selector-parser@<7.1.6": "^7.1.7", diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index cfe65f2..a22de2c 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -6,7 +6,7 @@ settings: overrides: nx>axios: ^1.20.0 - nx>follow-redirects: ^1.16.1 + nx>follow-redirects: ^1.16.2 nx>brace-expansion: ^5.0.12 nx>smol-toml: ^1.9.1 postcss-selector-parser@<7.1.6: ^7.1.7 @@ -3705,8 +3705,8 @@ packages: flatted@3.4.4: resolution: {integrity: sha512-5+ybhBZANEJxaH3X5evAFatUxLfEHSr7n6kYJ+1Qd0mUqr4eu9gIf6GDbWHf8RJijHrjjO8G+la14SlL2SeS1Q==} - follow-redirects@1.16.1: - resolution: {integrity: sha512-FNvFGzoMLWmE6Yj9spb/zjd7yiNCHiAW9/Tg9CXrQ8wuu32HtlJOwWO11OJafl5FfY3DxTdQ0vj42zU1kvv5jg==} + follow-redirects@1.16.2: + resolution: {integrity: sha512-/kVP2U8z596Ia0gwFrwyIeo74ta5aVmSeU1FfAUMAmcEP5EP7zydmag3SLiN64NaRKef3lxsq7i/g7ltJQDGow==} engines: {node: '>=4.0'} peerDependencies: debug: '*' @@ -8561,7 +8561,7 @@ snapshots: axios@1.20.0(debug@4.4.3(supports-color@7.2.0))(supports-color@7.2.0): dependencies: - follow-redirects: 1.16.1(debug@4.4.3(supports-color@7.2.0)) + follow-redirects: 1.16.2(debug@4.4.3(supports-color@7.2.0)) form-data: 4.0.6 https-proxy-agent: 5.0.1(supports-color@7.2.0) proxy-from-env: 2.1.0 @@ -9567,7 +9567,7 @@ snapshots: flatted@3.4.4: {} - follow-redirects@1.16.1(debug@4.4.3(supports-color@7.2.0)): + follow-redirects@1.16.2(debug@4.4.3(supports-color@7.2.0)): optionalDependencies: debug: 4.4.3(supports-color@7.2.0) @@ -9795,7 +9795,7 @@ snapshots: http-proxy@1.18.1: dependencies: eventemitter3: 4.0.7 - follow-redirects: 1.16.1(debug@4.4.3(supports-color@7.2.0)) + follow-redirects: 1.16.2(debug@4.4.3(supports-color@7.2.0)) requires-port: 1.0.0 transitivePeerDependencies: - debug @@ -10421,7 +10421,7 @@ snapshots: escape-string-regexp: 1.0.5 figures: 3.2.0 flat: 5.0.2 - follow-redirects: 1.16.1(debug@4.4.3(supports-color@7.2.0)) + follow-redirects: 1.16.2(debug@4.4.3(supports-color@7.2.0)) form-data: 4.0.6 fs-constants: 1.0.0 function-bind: 1.1.2