From 09a0a1cf4df5b9e2f4743b8571ad2eca3abbd680 Mon Sep 17 00:00:00 2001 From: Kaushik Gnanaskandan Date: Sat, 31 Oct 2026 18:23:10 -0700 Subject: [PATCH 1/3] docs: plan compatible redirect security update --- .../plans/2026-10-31-follow-redirects-patch.md | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) create mode 100644 docs/superpowers/plans/2026-10-31-follow-redirects-patch.md diff --git a/docs/superpowers/plans/2026-10-31-follow-redirects-patch.md b/docs/superpowers/plans/2026-10-31-follow-redirects-patch.md new file mode 100644 index 0000000..58cdfb4 --- /dev/null +++ b/docs/superpowers/plans/2026-10-31-follow-redirects-patch.md @@ -0,0 +1,17 @@ +# Repair the tooling redirect dependency + +Native execution under the user's continuous-build instruction. Always use this isolated worktree; preserve primary checkouts. No publication, deployment, credentials or account changes. + +## Contract + +CI audit on unchanged main dependencies reports GHSA-mrwp-f3q8-3g9p: follow-redirects 1.16.1. Upstream fixes it in 1.16.2. Nx is a root development dependency; no direct application import was found. Do not claim an observed credential incident, shipped exposure, or that Axios reproduces the advisory. Keep the four separate moderate findings visible. + +### Task 1: Compatible patch and verified delivery + +- Preserve baseline high-audit evidence. In owned temporary directories, exercise exact registry artifacts with real loopback redirects and a synthetic custom header: same-realm and cross-realm sensitiveHeaders, preserving a harmless header. The cross-realm old artifact must fail the intended confidentiality assertion before the dependency update. +- Raise the existing Nx override minimum to ^1.16.2 and update only follow-redirects resolution, reviewing the full lockfile delta. Verify the patched artifact, frozen install, high-level audit, affected configured checks and unchanged mirror-helper baseline. Do not add an application test that only tests upstream mechanics; retain the temporary harness as evidence. +- Obtain one independent whole-change review; resolve material findings with a regression-backed pass. Push a focused ready PR, attach it, require all latest-head checks, then merge under existing OSS authority. Refresh/rebase the separately reviewed helper PR only after security delivery. No failing-audit bypass. + +## Review focus + +Every vulnerable resolution is removed; the patch remains compatible and no unrelated package drifts. Distinguish source dependencies from published artifacts and fresh evidence from assumptions. Preserve all audit checks and existing permissions. From 708d120dfd6bdb3a82fcc369e8ba45927431eb1b Mon Sep 17 00:00:00 2001 From: Kaushik Gnanaskandan Date: Sat, 31 Oct 2026 18:26:21 -0700 Subject: [PATCH 2/3] fix: patch tooling redirect credential advisory --- package.json | 2 +- pnpm-lock.yaml | 14 +++++++------- 2 files changed, 8 insertions(+), 8 deletions(-) diff --git a/package.json b/package.json index f6daf5d..8141db4 100644 --- a/package.json +++ b/package.json @@ -136,7 +136,7 @@ "pnpm": { "overrides": { "nx>axios": "^1.20.0", - "nx>follow-redirects": "^1.16.1", + "nx>follow-redirects": "^1.16.2", "nx>brace-expansion": "^5.0.12", "nx>smol-toml": "^1.9.1", "postcss-selector-parser@<7.1.6": "^7.1.7", diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index cfe65f2..a22de2c 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -6,7 +6,7 @@ settings: overrides: nx>axios: ^1.20.0 - nx>follow-redirects: ^1.16.1 + nx>follow-redirects: ^1.16.2 nx>brace-expansion: ^5.0.12 nx>smol-toml: ^1.9.1 postcss-selector-parser@<7.1.6: ^7.1.7 @@ -3705,8 +3705,8 @@ packages: flatted@3.4.4: resolution: {integrity: sha512-5+ybhBZANEJxaH3X5evAFatUxLfEHSr7n6kYJ+1Qd0mUqr4eu9gIf6GDbWHf8RJijHrjjO8G+la14SlL2SeS1Q==} - follow-redirects@1.16.1: - resolution: {integrity: sha512-FNvFGzoMLWmE6Yj9spb/zjd7yiNCHiAW9/Tg9CXrQ8wuu32HtlJOwWO11OJafl5FfY3DxTdQ0vj42zU1kvv5jg==} + follow-redirects@1.16.2: + resolution: {integrity: sha512-/kVP2U8z596Ia0gwFrwyIeo74ta5aVmSeU1FfAUMAmcEP5EP7zydmag3SLiN64NaRKef3lxsq7i/g7ltJQDGow==} engines: {node: '>=4.0'} peerDependencies: debug: '*' @@ -8561,7 +8561,7 @@ snapshots: axios@1.20.0(debug@4.4.3(supports-color@7.2.0))(supports-color@7.2.0): dependencies: - follow-redirects: 1.16.1(debug@4.4.3(supports-color@7.2.0)) + follow-redirects: 1.16.2(debug@4.4.3(supports-color@7.2.0)) form-data: 4.0.6 https-proxy-agent: 5.0.1(supports-color@7.2.0) proxy-from-env: 2.1.0 @@ -9567,7 +9567,7 @@ snapshots: flatted@3.4.4: {} - follow-redirects@1.16.1(debug@4.4.3(supports-color@7.2.0)): + follow-redirects@1.16.2(debug@4.4.3(supports-color@7.2.0)): optionalDependencies: debug: 4.4.3(supports-color@7.2.0) @@ -9795,7 +9795,7 @@ snapshots: http-proxy@1.18.1: dependencies: eventemitter3: 4.0.7 - follow-redirects: 1.16.1(debug@4.4.3(supports-color@7.2.0)) + follow-redirects: 1.16.2(debug@4.4.3(supports-color@7.2.0)) requires-port: 1.0.0 transitivePeerDependencies: - debug @@ -10421,7 +10421,7 @@ snapshots: escape-string-regexp: 1.0.5 figures: 3.2.0 flat: 5.0.2 - follow-redirects: 1.16.1(debug@4.4.3(supports-color@7.2.0)) + follow-redirects: 1.16.2(debug@4.4.3(supports-color@7.2.0)) form-data: 4.0.6 fs-constants: 1.0.0 function-bind: 1.1.2 From 8031c4d74186fead1af966076f93e58ed9e45a30 Mon Sep 17 00:00:00 2001 From: Kaushik Gnanaskandan Date: Sat, 31 Oct 2026 18:28:01 -0700 Subject: [PATCH 3/3] docs: record redirect patch review and fresh verification --- docs/reviews/2026-10-31-follow-redirects-patch.md | 15 +++++++++++++++ 1 file changed, 15 insertions(+) create mode 100644 docs/reviews/2026-10-31-follow-redirects-patch.md diff --git a/docs/reviews/2026-10-31-follow-redirects-patch.md b/docs/reviews/2026-10-31-follow-redirects-patch.md new file mode 100644 index 0000000..87fdc16 --- /dev/null +++ b/docs/reviews/2026-10-31-follow-redirects-patch.md @@ -0,0 +1,15 @@ +# Redirect dependency security review + +One fresh read-only gpt-6-astra/high whole-change review on59e2e19..708d120 found no Critical, Important or Minor issues. No material fix pass or re-review was needed. The reviewer independently checked the complete patch, all locked resolutions and registry integrity, and ran the owned loopback old/new harness. Full workspace checks and audit remain coordinator evidence. + +Baseline CI reported GHSA-mrwp-f3q8-3g9p: one high plus four moderate findings. The existing Nx override minimum now excludes1.16.1; the generated lock changes only follow-redirects to1.16.2 and its Axios/http-proxy/Nx edges. No audit policy, permissions or runtime source changed. The advisory did not reproduce through Axios1.20.0; this tooling finding is not proof of an observed credential incident or published-product exposure. + +Fresh Node24.22.1/pnpm9.12.0 verification: + +- Exact registry1.16.1 failed two cross-realm custom-header confidentiality cases; same-realm controls passed. Registry1.16.2 passed all four object/array-header and same/cross-realm cases, preserving a harmless header and removing built-in Authorization. Only synthetic headers and owned loopback servers were used. The temporary harness is local dependency-correction evidence, not an application regression test. +- Unmodified `pnpm install --frozen-lockfile` passed. +- `pnpm audit --audit-level=high` exited0: high/critical0, moderate4 remain. JSON audit reports all severities and exited1; retain that raw result rather than claiming a clean audit. +- `NX_DAEMON=false pnpm exec nx run-many -t lint test build typecheck --exclude domscribe-test-fixtures --parallel=2 --skip-nx-cache` passed17 projects and9 dependency tasks:2225tests/129files. Existing fixture non-null warnings and expected fault-injection logs remain; no failures were suppressed. +- Seven unchanged mirror tests, package/plan Prettier and diff whitespace checks passed. An extra generated-lock Prettier check stopped the first wrapper; original main's lock also fails it. Preserve the minimal generated delta; subsequent configured checks above passed. A later documentation write initially lacked its new directory; creating that directory corrected the command before any commit/push. + +Required latest-head hosted CI remains mandatory. No package publication, deployment, customer workload, inference or credential action occurred. Separate moderate advisories and hosted/runtime qualification remain open.