Update vulnerable documentation build dependencies #32

Activity

1. mdspinali

   added

   dependenciesPull requests that update a dependency filePull requests that update a dependency file

   javascriptPull requests that update javascript codePull requests that update javascript code

   on Aug 9, 2026
2. mdspinali

   added this to the v0.3.0 milestone on Sep 14, 2026
3. mdspinali commented on Sep 14, 2026

   

   mdspinali

   on Sep 14, 2026

   ContributorAuthor

   More actions

   Fixed in 7114439

   Change

   Updated the documentation lockfile with compatible dependency corrections. The release documentation toolchain now reports no known vulnerabilities.

   Validation

   At 597f8bd755113c7cd9f74eccc3a85b76f433c76c, make docs-build passed. This target includes npm ci and make verify-contract.

   npm audit --json reported zero vulnerabilities.
4. mdspinali

   closed this as completedon Sep 14, 2026
5. mdspinali commented on Oct 3, 2026

   

   mdspinali

   on Oct 3, 2026

   ContributorAuthor

   More actions

   The documentation dependency findings have returned with new advisories.
   Candidate source: bec42b9cb8b24b9adcf94724a86dfa24466cd898.
   Its worktree was clean during the checks.

   make docs-build test-conformance-contract passed.
   Results include 29 documentation pages, 3,284 internal references, and 162 conformance tests across three packages.
   The structured Python gates also passed without skips.
   However, npm ci reported seven dependency advisories.
   npm audit --json confirmed six High and one Moderate affected package entries.

   The direct affected dependency paths are:

   • astro@7.3.1 -> http-cache-semantics@4.2.0.
   • astro@7.3.1 -> devalue@5.9.2.
   • ajv@8.20.0 -> fast-uri@3.1.7.

   Other affected package entries inherit the Astro finding.
   No synchronization runtime exposure or exploitation was measured.

   The High advisory GHSA-ch52-4w7c-c8xp covers http-cache-semantics <=4.2.0.
   GitHub reports no first patched version.
   The npm registry still reports 4.2.0 as the latest version.
   The advisory update time is 2026-10-02T22:36:44Z.
   An automatic downgrade to Astro 2.10.9 does not establish a compatible supported correction.
   The orchestrator will investigate the smallest compatible corrections and the remaining upstream blocker.

   This issue's zero-vulnerability acceptance criterion is currently unmet.
   Release promotion remains blocked under the existing issue contract.
   Earlier source and documentation success does not establish a passing security gate.
   The assignment-capacity feature remains tracked separately in #300.
6. mdspinali

   reopened this on Oct 3, 2026
7. mdspinali commented on Oct 3, 2026

   

   mdspinali

   on Oct 3, 2026

   ContributorAuthor

   More actions

   Compatible documentation corrections are committed locally at ee5f0d7a8a3d8172756777fbd00c1507dd7dae8f.
   Independent review found no source issue after the brief's dependency ranges were corrected.

   Only six lockfile fields changed:

   • devalue: 5.9.2 -> 5.9.4, with its registry URL and integrity value.
   • fast-uri: 3.1.7 -> 3.1.8, with its registry URL and integrity value.

   Every other lockfile byte remains unchanged.
   The direct manifest, all 495 package entries, optional peers, and dependency ranges remain unchanged.
   Actual parent ranges are Astro devalue ^5.8.1 and Ajv fast-uri ^3.0.1.
   References: docs/package-lock.json:2618, :3275, :2494, and :3632.
   The earlier review brief incorrectly used installed versions as range values. The orchestrator corrected that error.

   On the exact clean commit, make docs-build test-conformance-contract passed.
   The documentation build verified 29 pages and 3,284 internal references.
   The conformance gate passed 162 tests across three packages, with no skips or failures.
   The two structured Python gates passed.

   The subsequent npm audit --json returned exit 1 with five High affected package entries.
   Those entries all follow the unresolved http-cache-semantics@4.2.0 dependency path.
   The corrected devalue and fast-uri entries no longer appear.
   The remaining advisory is GHSA-ch52-4w7c-c8xp.
   No patched version was available in the measured npm and GitHub metadata.
   The zero-vulnerability acceptance criterion in #32 remains unmet.
   Release acceptance remains blocked. Neither #32 nor #300 is complete.
8. mdspinali

   modified the milestones: v0.3.0, v0.4.0 on Oct 3, 2026
9. mdspinali commented on Oct 3, 2026

   

   mdspinali

   on Oct 3, 2026

   ContributorAuthor

   More actions

   Security check repeated at clean candidate ab33b7e93c7664edcd75a1c01bf2297ba24410d1.

   • npm audit --json exits 1 with five High findings and no other findings.
   • The direct advisory remains GHSA-ch52-4w7c-c8xp in http-cache-semantics.
   • npm view http-cache-semantics version --json returns 4.2.0.
   • The advisory includes 4.2.0. No newer registry version was returned.
   • Audit remediation proposes Astro 2.10.9 or Starlight 0.8.1 downgrades.
   • No downgrade compatibility proof exists. No forced downgrade was applied.

   The zero-audit acceptance criterion remains unmet. This issue remains open.
   This result concerns documentation build dependencies. It does not prove runtime exposure.

   Artifact: /private/tmp/trainstar-s18-20261002/assignment_integrated_docs_audit.json.
10. mdspinali commented on Oct 4, 2026

    

    mdspinali

    on Oct 4, 2026

    ContributorAuthor

    More actions

    The documentation security correction is reviewed and committed locally.
    Source: cd03a62ee92bdf1cf98569f5421a636410f4291a.
    Base: 5524510ec2a5a3a20db582bb87fc035c81d3c604.
    Checkout: /private/tmp/trainstar-synchro-docs-20261004, recovered from the retained desktop Git bundle.
    The original checkout and published rc.1 artifacts remain unchanged.

    Change

    Only the version, registry URL, and integrity fields changed for http-cache-semantics in docs/package-lock.json:4157.
    The version changed from 4.2.0 to 4.3.0.
    Astro's existing ^4.2.0 range admits this version.
    All 495 package entries, direct manifests, dependency ranges, and other lockfile bytes remain unchanged.
    Astra independently verified exact three-field reversal and registry/source agreement.
    The lockfile SHA256 is fe9e945b63f25fcf01818b80dcc9997613b6602e57ec626b3a1863d7d3934da7.

    The advisory still lists <= 4.2.0 as affected.
    Its first_patched_version remains null.
    The registry and its referenced Git package both declare 4.3.0.
    This evidence does not change that advisory field.

    Validation

    • make docs-build test-conformance-contract: exit 0.
    • npm ci: 494 installed packages and 495 audited packages, zero vulnerabilities.
    • Contract verification: passed.
    • Documentation build: 29 pages.
    • Internal reference checks: 3,284.
    • Conformance: 162 passing tests across three packages, zero failures or skips.
    • Structured Python checks: passed without skips or failures.
    • npm audit --json: exit 0, empty vulnerabilities map, zero counts at every severity.
    • git diff --check: passed.
    • The isolated checkout is clean after the commit.

    The build reports one nonfatal empty-i18n collection warning.
    No runtime source, selector, assertion, gate, grant, or published artifact changed.

    The earlier security failures remain recorded.
    The local correction removes their measured documentation dependency finding under the current audit data.
    Release integration, protected publication, and application dependency changes remain separate acceptance steps.
    No release acceptance follows from this bounded dependency correction.
11. mdspinali commented on Oct 4, 2026

    

    mdspinali

    on Oct 4, 2026

    ContributorAuthor

    More actions

    The current clean source 3d95bc20f37f18af00e665ae0952b1439aa503c4 still has three vulnerable documentation packages.
    The saved npm audit reports two High packages and one Moderate package.
    The complete original audit and dependency-path records remain retained.

    The proposed lock change contains exactly three compatible leaf updates:

    Package	Installed	Proposed	Existing parent range
    devalue	5.9.2	5.9.3	Astro: ^5.8.1
    fast-uri	3.1.7	3.1.8	AJV: ^3.0.1
    http-cache-semantics	4.2.0	4.3.0	Astro: ^4.2.0

    The manifest, parent packages, package entry set, and dependency classifications remain unchanged.
    Each lock entry changes only its version, tarball URL, and registry integrity value.
    The patch also adds make audit-docs after npm ci in contract verification.
    It uses npm audit --json --audit-level=info with no advisory exclusions.

    The isolated proposed lock reports zero vulnerabilities and 494 dependencies.
    This is preparation evidence. The patch is not yet committed or accepted for release.
    Independent source review is in progress.

    The upstream devalue release documents the six corresponding fixes.
    The upstream fast-uri release identifies its normalization correction.
    The cache maintainer disputes the cache advisory.
    The official 4.3.0 source comparison does not change max-stale handling.
    Its zero-audit result does not prove the disputed behavioral security allegation is fixed.
    This limitation remains explicit in review and validation evidence.

    The failed lookup for nonexistent cache version 4.2.1 and unsuccessful preparation attempts remain retained.
    Committed-source audit, contract verification, documentation build, and final independent review remain pending.
12. mdspinali commented on Oct 4, 2026

    

    mdspinali

    on Oct 4, 2026

    ContributorAuthor

    More actions

    Fixed in 111c453b3d5b00b420118a624922427e2811f650

    Change

    Updated only three compatible transitive dependencies in the documentation lockfile.
    The selected versions are devalue 5.9.3, fast-uri 3.1.8, and http-cache-semantics 4.3.0.
    Parent packages and dependency ranges remain unchanged.
    Contract verification now requires npm audit --json --audit-level=info.
    The earlier audit and unsuccessful preparation attempts remain recorded.

    The cache advisory remains disputed upstream.
    The update clears its listed affected-version range.
    This result does not establish a behavioral repair for the disputed allegation.

    Validation

    Clean source before and after execution: 111c453b3d5b00b420118a624922427e2811f650.

    make docs-build passed on the local Mac with Node 22.22.0.
    Its required dependency path executed npm ci, audit-docs, test-docs-contract, and the documentation build.

    • npm ci installed and verified the committed lockfile.
    • npm audit --json --audit-level=info reported zero vulnerabilities across 494 dependencies.
    • Contract verification passed all authored-input and reference checks.
    • Both structured documentation checks passed, with three total tests and zero failures or skips.
    • Documentation links passed for 29 pages and 3,284 internal references.
    • Astra accepted the complete compatible lockfile diff and audit-gate source.

    Retained evidence: .ignore/release-rc2/docs-build-111c453b.log and its source, status, and exit records.
    These results close the documentation dependency criteria. Other release gates remain pending.
13. mdspinali

    closed this as completedon Oct 4, 2026