Documentation dependency audit blocks local source quality #319

Activity

1. mdspinali

   added this to the v0.4.0 milestone on Oct 6, 2026
2. mdspinali commented on Oct 6, 2026

   

   mdspinali

   on Oct 6, 2026

   ContributorAuthor

   More actions

   The independent compatibility review supports a scoped published parser update.
   The implementation is in progress in a separate clean worktree.
   No passing audit or complete source-quality gate is claimed.

   Decision

   • Keep @expressive-code/core@0.44.2 and postcss-nested@6.2.0 unchanged.
   • Select published postcss-selector-parser@7.1.6 only under those exact ancestors.
   • Update smol-toml to 1.9.0 within its existing range.
   • Update source-map-js to 1.2.2 within its existing range.
   • Keep npm audit --json --audit-level=info unchanged.

   The parser change crosses nested's declared major-version range.
   The review inspected the consumed APIs and parser iteration changes.
   Nested's current-node replacement keeps the same iterator behavior in both versions.
   Upstream nested also adopted parser 7 without changing its implementation in that dependency commit.

   The correction requires unchanged upstream selector expectations, exact module ancestry, registry integrity, and zero vulnerable installed copies.
   The final clean source must pass the compatibility check, audit, contract verification, documentation build, and full source-quality gate.
   The failed Mac and desktop audit results remain required history.

   Source references

   • docs/package.json:13 declares the documentation dependency graph.
   • docs/package-lock.json:1289 records core's nested dependency.
   • docs/package-lock.json:6005 records nested's parser dependency.
   • Makefile:555 defines the unchanged audit gate.
   • Makefile:559 requires that audit during contract verification.
   • Parser security advisory
   • Nested parser-7 dependency update
   • npm ancestor-scoped overrides
3. mdspinali commented on Oct 6, 2026

   

   mdspinali

   on Oct 6, 2026

   ContributorAuthor

   More actions

   The dependency correction is committed in 0133c23c2fe53230cf825cae79969a9660f1bf7f.
   The integrated release branch contains it in 80ab882df030e67b4acdf26def3607c2592809ab.

   Only the three approved leaf entries changed.
   The parser override applies to core 0.44.2 and nested 6.2.0 only.
   The installed graph contains one parser copy, version 7.1.6.
   The other patched leaves resolve to smol-toml 1.9.0 and source-map-js 1.2.2.

   Focused validation

   All commands ran on clean 0133c23c2fe53230cf825cae79969a9660f1bf7f.
   The source remained clean after each command.

   • make test-docs-postcss-nested: exit 0, one structured test with 15 semantic cases, zero failures or skips.
   • make audit-docs: exit 0, zero advisories at the unchanged info threshold.
   • make verify-contract: exit 0, unchanged authored contract passed.
   • make docs-build: exit 0, 29 pages and 3285 internal references passed.

   The compatibility fixture retains 13 upstream expectations and two authored selector boundaries.
   The original MIT license and pinned provenance remain in the fixture directory.
   The build retains its nonfatal empty i18n collection warning.

   The primary inspected the complete diff and independently parsed the result records.
   Original records remain at .ignore/docs-audit-319-0133c23c/ in the implementation worktree.
   The prior failed Mac and desktop audits remain under their original c45 identities.

   Independent implementation review and complete final-source quality validation remain pending.
   This issue remains open.
4. mdspinali commented on Oct 6, 2026

   

   mdspinali

   on Oct 6, 2026

   ContributorAuthor

   More actions

   Fixed in 80ab882df030e67b4acdf26def3607c2592809ab

   Change

   The documentation lock selects patched smol-toml, source-map-js, and postcss-selector-parser releases.
   The parser override applies only below @expressive-code/core@0.44.2 and postcss-nested@6.2.0.
   The audit policy remains --audit-level=info.
   The compatibility check verifies the consumed parser ancestry and authored selector results.
   No broad update, downgrade, local replacement, or audit suppression was added.

   Astra accepted the dependency decision, complete correction diff, fixture provenance, and separate simplification review.
   The original failed audits remain retained and recorded above.

   Validation

   Final clean validation source: 71634a6b551ec18a0d600004c19e46290d5409d2.
   The final source retains the reviewed documentation correction unchanged.

   make ci-source-quality passed on the Mac and Ubuntu desktop.
   It includes unchanged make audit-docs, make test-docs-postcss-nested, make verify-contract, and make docs-build.
   The selector check executes one compatibility flow with 15 named subtests.
   All required structured inventories were positive, with zero failures and skips.

   The final desktop source-quality log has SHA-256 5035f299ff2b5003d0c91eead08fbc90e46b009ef26e7d314879ef491f539102.
   Astra independently accepted the completed desktop source-quality evidence.
   Its report has SHA-256 0c82710ebc00f7277e10fc1b556654897ab465f9814e1516b72c9e6341099a38.

   This closure covers the documentation audit defect. It does not establish RC.2 release acceptance.
5. mdspinali

   closed this as completedon Oct 6, 2026
6. mdspinali

   reopened this on Oct 9, 2026
7. mdspinali commented on Oct 9, 2026

   

   mdspinali

   on Oct 9, 2026

   ContributorAuthor

   More actions

   The rollback removed the historical correction from the active source.

   Current source: 215ed34d5e9d9d58a0e975f134cafe40df646ba8.
   The worktree was clean.
   The documentation manifests and lockfile match origin/dev at cd28ae93c9604f82bbc92ba5cd3cfe034e5dc648.
   Commit 80ab882df030e67b4acdf26def3607c2592809ab is not an ancestor of the current source.

   npm audit --prefix docs --json returned exit 1.
   It reported 13 affected dependency records, with 11 Moderate and two High records.
   The High records name sharp and source-map-js.
   The audit also retains the parser and TOML findings documented above.
   The complete output is retained at /private/tmp/synchro-rn082-docs-audit.json.

   The active Makefile has no audit-docs target.
   The successful current source-quality checks therefore do not establish a clean dependency audit.
   This issue must remain open until its correction is present and validated in the active source.
   The RN and fmt replacement will not restore the canceled broader dependency work.
   This output does not establish runtime exploitability of the sync service.
8. mdspinali commented on Oct 9, 2026

   

   mdspinali

   on Oct 9, 2026

   ContributorAuthor

   More actions

   The required CI vulnerability scan failed locally on clean 6d0d74aa81bebf39d344282198cd505fe101f2df.

   The pinned Trivy version was 0.69.3.
   The scan used the flags from .github/workflows/dependency-review.yml against a clean Git source archive.
   It reported three findings with available fixes:

   • Critical: shell-quote 1.10.0, CVE-2026-102422.
   • High: sharp 0.35.4, GHSA-wq5f-xc86-pv6w.
   • High: source-map-js 1.2.1, CVE-2026-93749.

   Commit a9a6b2b40515121908f6dda73f35b622f6afb10c updates these lockfile resolutions.
   It selects shell-quote 1.12.0, sharp 0.35.5 with its required platform packages, and source-map-js 1.2.2.
   Existing manifest ranges permit these versions.
   The change adds no resolution override, advisory exclusion, or source code.

   The same required scan passed on clean c2a7e9fe35935a8e0ad080f83a38c9219d2e507a.
   Its exit code was 0, and its SARIF report contained zero findings.
   The original failed scan remains preserved.

   Evidence directory: /tmp/synchro-rn082-trivy-6d0d74a.X4Q3WEFV on desktop 10.0.0.86.
   The before and after reports are trivy-dependencies.sarif and trivy-dependencies-c2a7e9fe.sarif.

   Full package-manager audits still report other advisories.
   The documentation audit reports 11 Moderate affected records.
   The RN audit still reports handlebars, braces, compression, sprintf-js, and stream-json findings.
   These findings remain unsuppressed and require separate accepted evidence.
   This comment records a partial correction, not a fully clean security audit or release signoff.
9. mdspinali commented on Oct 9, 2026

   

   mdspinali

   on Oct 9, 2026

   ContributorAuthor

   More actions

   Commit fe152790f5c124c21cb33752db488ebebaf896a2 updates smol-toml from 1.8.0 to 1.9.1.
   The existing parent range remains ^1.6.0.
   Only version, tarball URL, and integrity change in docs/package-lock.json.
   Unrelated npm lock removals were rejected and restored.
   No manifest, override, parser, parent package, source, or audit gate changed.
   The commit also adds the required issue link to the GRDB changelog entry.

   Clean exact-commit validation passed on descendant a6c8d375300f918de6e06b9f4064ddb83883d4da:

   • make docs-build verify-contract version-check: exit 0.
   • Documentation build: 29 pages.
   • Link check: 3,291 internal references.
   • Contract verification and version check: passed.

   The build reports an absent or empty i18n collection.
   The existing site has no authored translated collection.
   No page or contract check failed or skipped.

   The full npm audit still returns 1.
   The TOML advisory GHSA-r4xh-jqrq-34v2 is absent.
   Ten Moderate affected-package records remain in the parser dependency chain.
   They derive from postcss-selector-parser advisory GHSA-rj75-hqrm-r3gf.
   No High or Critical record remains in this documentation audit.
   Parser 6.1.4 is the latest release in its declared major range.
   The patched parser requires major version 7.
   This result does not establish a complete audit signoff or approve a parent-range override.
10. mdspinali commented on Oct 11, 2026

    

    mdspinali

    on Oct 11, 2026

    ContributorAuthor

    More actions

    The active correction restores the previously reviewed parser repair from 0133c23c without changing the current patched TOML or source-map versions.

    Implementation source: 13f7b0c in a separate clean worktree based on dev 538e1bf.
    The scoped published parser 7.1.6 override applies only below core 0.44.2 and nested 6.2.0.
    The unchanged info-level audit and existing upstream compatibility cases are restored.
    No advisory suppression, downgrade, local fork, or unsupported parser API is added.

    make docs-build passed on clean 13f7b0c.
    Its required audit reports zero vulnerabilities.
    The restored compatibility flow passed all 15 semantic cases.
    The contract, 29-page build, and 3291 internal-reference checks passed.

    Full source-quality validation and independent final-diff review remain required.
    The issue remains open.
    The original failing current-source audit and every historical failed attempt remain visible.
11. mdspinali commented on Oct 11, 2026

    

    mdspinali

    on Oct 11, 2026

    ContributorAuthor

    More actions

    Fixed in 57ee8a2b36f8025d5e9a48cf22dfd5028fbb4c0e through PR #336.

    Change

    The restoration selects published postcss-selector-parser 7.1.6 through the reviewed exact consumer ancestry.
    The scope is @expressive-code/core 0.44.2 and postcss-nested 6.2.0.
    Previously corrected smol-toml 1.9.1 and source-map-js 1.2.2 remain unchanged.
    The information-level documentation audit is again a required contract gate.
    No audit threshold, advisory exclusion, downgrade, or local package fork was added.

    Validation

    All local normal results below ran on clean 812330ce71e2c7ab99c086a5b58ea0126400c321.

    • make audit-docs retained --audit-level=info and reported zero vulnerabilities.
    • Actual installed resolution selects parser 7.1.6 through core 0.44.2 and nested 6.2.0.
    • The lock retains the verified published package integrity.
    • The compatibility gate passed 13 unchanged upstream cases and two independently authored boundaries.
    • Its structured runner reported one test, zero errors, zero failures, and zero skips.
    • make verify-contract and make docs-build passed on the Mac and desktop 10.0.0.86.
    • The documentation build produced 29 pages and validated 3,291 internal references.
    • Complete make ci-source-quality passed on the Mac before PR CI.
    • Complete desktop source quality also passed on the same clean source before integration.
    • The complete local runs report zero failed or skipped tests.
    • Hosted source quality separately passed for PR Restore reviewed RC.2 documentation and test repairs #336 without a gate or policy exemption.
    • Independent review checked the complete diff, consumed API, package integrity, fixture license, and dependency ancestry.
    • Its separate security and simplification assessments accepted the existing scoped correction.

    CI run 38172057464 passed all required pull-request checks.
    CI checked e572ca6163be9a6b17a412f2cc0260b86a5f5f5a.
    Its source tree equals local validation source 812330ce and merged dev 57ee8a2b.
    Both source comparisons returned zero.
    Go, JavaScript, Kotlin, and Swift CodeQL results report zero findings and empty analysis errors.

    The parser release and compatibility evidence remains recorded in this issue's earlier reviewed correction.
    The current restoration preserves that correction without a broader dependency update.
    Mac validation selects the installed SDK through SDKROOT, BINDGEN_EXTRA_CLANG_ARGS, and CFLAGS.
    Desktop validation selects installed Node, Cargo, Android SDK, and JDK 17 tools.
    The desktop also received the published release tags without changing released update scripts.
    The original failed audit and all fresh failed full-run attempts remain visible.
    The closeout records retain the complete audit, compatibility, contract, build, and source-quality logs.

    This closes the documentation dependency finding. The separate RN dependency issues remain open.
12. mdspinali

    closed this as completedon Oct 11, 2026