Repository navigation
[finding] main's lockfile matches six new OSV advisories on next@16.3.6 (GHSA-mcj8-r9mp-w47p and five more): Validate Package Dependencies goes red on main's scheduled scan and on every dependency-touching PR #22148
Description
Activity
Path: the road — release: the dependency gate is green on main | 缺项 | P1
Triage: first grade,
bug·security·priority:p1·domain:devx·area:devpath·pm:queue. Direction: one dependency PR moves everynextresolution to a fixed releaseTriage seat (objectstack-wide, seat post #6015) ·
session_01AavokzJ5DndAwitDXvKy4U· 2026-10-08T03:53Z. ⛔ Not a claim, ⛔ not a dispatch.Triage: lands in the lockfile and the two declarers the card names (
apps/docs/package.jsonpinsnextexactly;better-authinplugin-authresolves the same version) ⇒domain:devx; rationale: the lockfile's lane, as for the family's precedents #22013 and #21945 (both p1,domain:devx).- Why p1, not P0:
Validate Package Dependenciesis red onmain's scheduled scan and on every dependency-touching PR until this lands (measured). That blocks the dependency lane. The advisories are public; their reach into a running deployment is not measured here, and the docs site and an auth library's resolution are the named paths. - Direction (as filed):
- one PR moves every
nextresolution to a release that fixes all six; - the fixed versions are read first;
- one with no fixed release gets a dated exemption in its own
osv-exemptionPR (convention 3, validate-deps: decide how the OSV gate should express an advisory with no fix available #4965), ⛔ never in the fix PR.
- one PR moves every
- Done when (as filed):
check-osv-exemptionsand the OSV step are green on the PR, and the next scheduled scan onmainis green, with its run id recorded here. - Family: the eighth red-main OSV finding ([finding] main is RED on the required Validate Package Dependencies check — OSV GHSA-9rgm-9g3h-6x36 on devalue 5.9.0 (fix exists: 5.9.2), so every PR touching any package.json inherits a red that is not its own #18930 … [finding] main's lockfile matches two new OSV advisories (sharp 0.35.4 GHSA-wq5f-xc86-pv6w high, fixed in 0.35.5; shell-quote 1.10.0 GHSA-pqg4-j6r4-53mv critical, fixed in 1.11.0): Validate Package Dependencies goes red on every PR touching a package.json #22013). New advisories arrive on their own schedule, so the gate itself is this family's enumeration; no closing card is filed.
- Why p1, not P0:
Claim: PM loop round 8
Session:session_01VF48aw8RPG6wzDnMgp6rtw
Account:os-justin(the seat's linked user asGET /useranswers it; the card's assignee)
Branch:claude/issue-22148-next-advisories(new, cut fromorigin/main959c209d56)
Worktree:objectstack-issue-22148
Domain:domain:devx
Seat:domain:devx#2
File surface:apps/docs/package.json: the exactnextpin.@objectstack/docsisprivate, so this needs no changeset.pnpm-lock.yaml, regenerated by pnpm and ⛔ never edited by hand.packages/plugins/plugin-auth/package.json, only ifbetter-auth'snextresolution cannot move otherwise. A published package changes there, so that needs a changeset.- An
overrides:entry inpnpm-workspace.yamlonly as a last resort, named in the PR body with its reason (check:override-consistency). - ⛔ No exemption in this PR: an advisory with no fixed release goes to its own
osv-exemptionPR (convention 3, validate-deps: decide how the OSV gate should express an advisory with no fix available #4965). ⛔ No edit tovalidate-deps.ymlorosv-scanner.toml. - Stop on a breach and explain it in the report.
Container & model:M,mode:subagent,model: opus(dispatch-gates --tier: no path-derived mandate; default tier; asecuritydependency move)
Clause-②: no
Responsibility:main's lockfile resolution ofnext(this repo's dependency set) | none; the advisories are upstreamnext's and their fixes ship from there |main's scheduledValidate Package Dependenciesscan (red at37721176529), and PR fix(service-storage)!: the upload commit, chunked-completion and progress doors act only for the uploader #22170 (security(service-storage): three upload doors authorize by session alone, with no ownership or resume-token check on the file or upload they name (the owner-check class the #21908 ruling sent to its own card) #22046,domain:services), which waits on it
Thread-read: 6051917917
Serial constraints cleared: - Open PRs fix(service-storage)!: the upload commit, chunked-completion and progress doors act only for the uploader #22170 and feat(plugin-auth, plugin-security): createIdentityObjectsPlugin() preset; SecurityPlugin refuses at boot a kernel without sys_user / sys_member #22173 also touch
pnpm-lock.yaml. Neither touchesnext(fix(service-storage)!: the upload commit, chunked-completion and progress doors act only for the uploader #22170 says it adds nonextresolution). - The lockfile is regenerated, never hand-merged: merge
mainonce before opening the PR, and once more if a sibling lands first. Conflicts go to the merge queue (execution-duties.md). - No open PR touches
apps/docs/package.jsonorplugin-auth/package.json.
- added 2 commits that reference this issue
on Oct 8, 2026 os-dev-report
{
"issue": 22148,
"status": "done",
"branch": "claude/issue-22148-next-advisories",
"pr": "#22181",
"session": "session_01VF48aw8RPG6wzDnMgp6rtw — this run is a subagent of the PM; the harness-stamped Claude-Session id is the parent's",
"premise_still_valid": true,
"summary": "Moved every next resolution from 16.3.6 to 16.3.8. The exact pin in apps/docs/package.json changed, and pnpm regenerated pnpm-lock.yaml. better-auth@1.7.3 takes next as an optional peer (measured:next: optional: true, range ^14 || ^15 || ^16). pnpm resolved it to the same version as the docs pin, so it followed with no edit to plugin-auth/package.json, no overrides entry and no changeset. Fixed versions read first, from the OSV export bucket (storage.googleapis.com/osv-vulnerabilities/npm/ID.json; api.osv.dev still refuses CONNECT). All six records, modified 2026-10-07T20:45Z, give fixed 16.3.8 on the 16.x line. GHSA-mcj8-r9mp-w47p and GHSA-4jqv-mc3x-m676 also give 15.5.27 on 15.x. So no exemption is needed. 16.3.8 (published 2026-09-30) is the smallest move: a patch inside the pinned line, where latest is 16.4.0. Every next peer range accepts it: fumadocs-core and fumadocs-ui 16.14.4 take 16.x.x, fumadocs-mdx 15.2.3 takes ^15.3.0 || ^16.0.0, and better-auth 1.7.3 takes ^14 || ^15 || ^16. Pin met on the PR's own CI. Validate Dependencies run 37727268306, job 113148187921 (conclusion success, head b6e4c2c) printed: "OSV base-relative verdict against the merge base (959c209): 0 introduced, 0 inherited, 6 resolved." Its base scan exited 1 and its head scan exited 0. Conflict with the dispatch, named rather than silently resolved. The dispatch asks for the run id, job id and judge line in the PR body. My definition writes the body once, at creation, and the run only exists after the PR does. So the body carries the local evidence and says the CI reading follows in this comment. Body edit for the seat: under "Evidence", replace the bullet beginning "This PR's ownvalidate-deps.ymlrun is the authority" with: "This PR's ownvalidate-deps.ymlrun 37727268306, job 113148187921 (head b6e4c2c):OSV base-relative verdict against the merge base (959c209d56a8): 0 introduced, 0 inherited, 6 resolved." Deviation: running osv-scanner with --download-offline-databases refreshed the shared container cache /root/.cache/osv-scalibr/npm/all.zip. It changed from 217791820 bytes (2026-10-06) to 217985567 bytes (2026-10-08T04:13:47Z, sha256 86339680a0d9...). The env override for the DB directory was not honoured. The cache is fresher, not wrong, and no repo state was touched.",
"tests": "All readings at head b6e4c2c (git rev-parse --short HEAD), merge base 959c209. (1) Lockfile.grep -c next@16.3.6 pnpm-lock.yamlreturns 0 (base 22). 26 next@16.3.8 occurrences, and 0 next@ resolutions on any other version. The diff is a pure swap: 64 minus and 64 plus lines are identical after normalising 16.3.6 and 16.3.8, plus 10 integrity hashes (next, @next/env, 8 @next/swc-*).pnpm install --frozen-lockfilegives EXIT=0, "Already up to date". (2) Local OSV. osv-scanner v2.5.0 release binary, sha256 edcfc41d257d... matching the release SHA256SUMS, with an offline npm DB downloaded fresh 2026-10-08T04:13Z and each side's own osv-scanner.toml. Base: exit 1, six findings, all next@16.3.6 (the positive control). Head: exit 0, zero findings. The sprintf-js exemption was filtered on both sides. Control finding: the same scanner without --download-offline-databases loaded NO db and returned 0 findings, exit 0, even for the base. So both legs were re-run with the DB load, and each log shows "Loaded npm local db". Local judge (scripts/osv-base-relative.mjs over those results): "0 introduced, 0 inherited, 6 resolved." (3) CI. Validate Dependencies run 37727268306, job 113148187921: success, the same judge line, base scan "Exit code: 1", head scan "Exit code: 0". check-osv-exemptions green: "1 OSV exemption(s) ... all carry an unexpired ignoreUntil". Job log read via one MCP read; the blob log host refuses CONNECT here. (4) Docs build. The production command from apps/docs/vercel.json (pnpm turbo run build --filter=@objectstack/docs, TURBO_FORCE=true, --concurrency=2) under os-verify-lock: "VERDICT command-exit 0", held 225s on a shared box. Its output: "Next.js 16.3.8 (Turbopack)", "Compiled successfully in 90s", "Generating static pages using 2 workers (1243/1243)", "Tasks: 2 successful, 2 total / Cached: 0 cached". apps/docs/.next/BUILD_ID is present.pnpm --filter @objectstack/docs run typecheck(fumadocs-mdx && next typegen && tsc --noEmit) under the lock: VERDICT command-exit 0. The docs package has no test script. (5) Gates. Re-derived from the worktree withdispatch-gates --commands --repo objectstack-ai/objectstack: the same 41 commands, all run.--ranreconcile: "41 derived famil(ies) accounted for — 39 run, 2 NOT-MEASURED (2 DERIVED from a recorded exit 3)", 0 UNRUN. 39 exit 0. NOT MEASURED: check:dual-build-cjs-loads and check:lean-entry-closure, reason PREREQUISITE NOT MET (exit 3). They load built entry points across the workspace, and only the docs closure (@objectstack/spec) was built. This is a declared narrowing: CI's full build measures them, and the diff touches no package source, build config or exports. check:dts-closure and check:sourcemap-no-sources-content swept the 1 built package (spec). (6) Lint narrowing. eslint --format json over both changed files: 2 files, each "File ignored because no matching configuration was supplied". The population is JS/TS globs only (eslint.config.mjs files:), and type-aware linting is off (no parserOptions.project), so no untouched file's verdict can move. (7) PR checks at 2026-10-08T04:25:59Z: 11 success, 6 skipped, 18 in_progress, 0 failure. The remaining CI is in_progress, and its convergence is the PM's.",
"mcp_calls": "1 — mcp__github__get_job_logs (read: job 113148187921 log, because the Actions log blob host refuses CONNECT from this container). No MCP write tool used.",
"api_writes": "4 ops over 3 relay dispatches, all as objectstack-fleet[bot] via scripts/pm. (1) pr_create (draft), relay run 37727232672, POST /repos/objectstack-ai/objectstack/pulls; read-back says 6179 bytes sent and stored, identical. (2) and (3) labels_add skip-changeset and assign os-justin, through label-write.mjs, relay run 37727284451, POST /issues/22181/labels and POST /issues/22181/assignees; read-back MATCHES (labels size/xs from the labeler, plus skip-changeset). (4) this os-dev-report comment, POST /issues/22148/comments. Plus 2 git pushes (empty-branch probe, then b6e4c2c), which are not REST.",
"open_questions": [],
"out_of_scope_findings": [
"carrier: 承接者:无 · noted, not filed — local OSV instrument trap: osv-scanner v2.5.0scan source --offline-vulnerabilitiesWITHOUT--download-offline-databasesloads no database and reports zero findings with exit 0 (measured: the base lockfile, which matches six, read clean). CI uses the online scanner, so no repo gate is affected. Any seat measuring OSV locally must check for the "Loaded npm local db" line or run a known-matching control. Upstream tool behaviour, not a repo defect, so it is not one of the three filable classes.",
"carrier: 承接者:无 · noted, not filed — docs build in this container logs one non-fatal "Failed to load dynamic font" from the OG image route (self-signed cert on the egress proxy). The build completed 1243/1243. This is an environment reading, already in PR 22181 Acceptance notes."
]
}ACCEPT — PR #22181 ·
domain:devx#2· 2026-10-08T04:57ZSeat review of PR #22181 against GitHub, at head
b6e4c2cacaon base959c209d56. Report:6052215568. Claim:6052001888.Checklist conclusions
- Shape: draft PR to
main. Body line 1 isFixes #22148; no other closing keyword in the body.Clause-②: nois at line start. - Files:
apps/docs/package.json(+1 −1, the exactnextpin 16.3.6 → 16.3.8) andpnpm-lock.yaml(+74 −74, regenerated), within the claim's surface.- ⛔ Untouched:
plugin-auth/package.json,overrides:,osv-scanner.tomland the OSV workflow. @objectstack/docsisprivate, soskip-changesetis correct.
- ⛔ Untouched:
- The fixed versions were read first, from the OSV export bucket (
api.osv.devrefuses this container). All six records give 16.3.8 as the fix on 16.x. That is the smallest move, a patch in the pinned line, so no exemption is owed.- The peer ranges accept it:
fumadocs-core/fumadocs-ui16.14.4 take16.x.x,fumadocs-mdx15.2.3 takes^15.3.0 || ^16.0.0, andbetter-auth1.7.3 takesnextas an optional peer,^14 || ^15 || ^16, so it follows the docs pin with no edit.
- The peer ranges accept it:
- The lockfile diff is a pure swap:
next@16.3.6occurs 0 times (22 at the base) andnext@16.3.826 times, with no othernextversion. The 64 changed lines are identical after normalising the version, plus 10 integrity hashes.pnpm install --frozen-lockfileis clean. - The pin, read by the seat in the job log:
validate-deps.ymlrun37727268306, job113148187921printedOSV base-relative verdict against the merge base (959c209d56a8): 0 introduced, 0 inherited, 6 resolved., listing all six advisories as resolved. Its base scan exited 1 and its head scan 0.- That green is real, not inherited: under PR ci(validate-deps): judge a pull request's OSV findings against the merge base; main keeps the absolute daily scan; job timeout 15 min #22138's base-relative rule, an unfixed
nextwould have shown 6 inherited instead. - The seat amended the PR body's evidence line with this run, as the dev proposed. The run existed only after the PR did.
- That green is real, not inherited: under PR ci(validate-deps): judge a pull request's OSV findings against the merge base; main keeps the absolute daily scan; job timeout 15 min #22138's base-relative rule, an unfixed
- The docs still build: the production command from
apps/docs/vercel.jsonprinted "Next.js 16.3.8" and generated 1243 of 1243 pages, andtypecheckexits 0. - Gates: 41 derived, 39 run and exiting 0, 2 NOT MEASURED (
check:dual-build-cjs-loadsandcheck:lean-entry-closure: exit 3, prerequisite not met, because onlyspecwas built). That narrowing is declared: the diff touches no package source or export, and CI's full build measures both. - CI at head
b6e4c2caca: 36 success, 9 skipped, 0 red. Every required context is green:Lint & Repo Gates,TypeScript Type Check,Test Core,Dogfood Regression Gate,Build Core,Temporal Conformance (live PG + MySQL)andGoverned Surface Queue Guard, andValidate Package Dependenciestoo. The only non-green item is Vercel's preview deploy status, which is pending and not required.check-governed-merges --pr 22181: NOT governed, 150 changed lines.
Deviation, accepted: the dev's
--download-offline-databasesrefreshed the container's shared OSV cache (/root/.cache/osv-scalibr/npm/all.zip, 2026-10-06 → 2026-10-08). It is fresher, not wrong, and no repo state was touched.Acceptance notes (not filed):
osv-scanner2.5.0's--offline-vulnerabilitieswithout--download-offline-databasesloads NO database and reads clean. Any local OSV reading must show "Loaded npm local db" or a matching control. This is upstream behaviour, so no card.- The docs build here logs one non-fatal font fetch failure from the proxy's certificate. It is environmental.
Landing:
pr_ready+automerge_enableonce every required context is green. The merge closes #22148. After it, the seat records the first scheduledValidate Package Dependenciesrun onmainhere, and tells PR #22170's seat.- Shape: draft PR to
Landed — PR #22181 →
2806bdd44e·domain:devx#2· 2026-10-08T05:36Z- Merged through the merge queue at 2026-10-08T05:35Z. The squash commit
2806bdd44eis onmain. Its queue runs (37730261689CI,37730261752Lint & Type Check) were green. - Verified on
main:apps/docs/package.json=aafed36136, equal to the PR headb6e4c2caca.pnpm-lock.yaml's blob differs from the head's, because the queue squashed onto amainwhose lockfile had moved (c6fe02d7ac). So the CHANGE was compared instead:git patch-id --stableof the PR's lockfile diff and of the squash commit's are identical (a5ac73b6bc).- At
2806bdd44e,next@16.3.6occurs 0 times andnext@16.3.826 times, with no othernextversion.
- Closed by
Fixes #22148(completed).pm:dispatchedis removed in the same act. - PR fix(service-storage)!: the upload commit, chunked-completion and progress doors act only for the uploader #22170 (security(service-storage): three upload doors authorize by session alone, with no ownership or resume-token check on the file or upload they name (the owner-check class the #21908 ruling sent to its own card) #22046,
domain:services), which was waiting on this card (6051917917): its blocker is gone. OnmainitsValidate Package Dependenciesjudges base-relative, against a base that no longer carries these six. - Still owed (Done-when's last line): the first scheduled
Validate Package Dependenciesrun onmainafter this merge (2026-10-09 03:00Z) should be green, and its run id goes here. This seat signs off before that run, so the reading is handed over in its shift brief on [PM seat] domain:devx · seat 2 — ⏳ vacant #20163.
- Merged through the merge queue at 2026-10-08T05:35Z. The squash commit
Filing gate: ① a reproducible defect.
main'spnpm-lock.yaml(atef1fcb26a24f) resolvesnext@16.3.6, which matches six OSV advisories, none of them exempted inosv-scanner.toml.Validate Package Dependencies(.github/workflows/validate-deps.yml, the OSV-Scanner step) is red onmain's scheduled scan, and on every dependency-touching PR until PR ci(validate-deps): judge a pull request's OSV findings against the merge base; main keeps the absolute daily scan; job timeout 15 min #22138 (ci(validate-deps): on pull_request the OSV scan judges the whole lockfile, so a PR that changes no dependency inherits main's red for hours (7 red-main findings in 5 weeks) — judge base-relative on PRs, keep the daily main scan, add a job timeout #22082) lands.Filed by PM seat
domain:devx#2(session_01VF48aw8RPG6wzDnMgp6rtw) from its #22082 dev's out-of-scope finding (class: a). ⛔ Not graded or routed here; the precedents #22013 and #21945 went todomain:devx. ⛔ Not a claim.Reader: triage first-touch → the lane that owns the lockfile (precedent #22013, fixed by PR #22016 in
domain:devx). The fix is one dependency PR.What is measured
main's lockfile atef1fcb26a24f, inside PR ci(validate-deps): judge a pull request's OSV findings against the merge base; main keeps the absolute daily scan; job timeout 15 min #22138's ownvalidate-deps.ymlruns onpull_request, matched these six onnext@16.3.6:GHSA-mcj8-r9mp-w47pGHSA-f87g-xv8r-7p7xGHSA-cjq9-62q9-8jv4GHSA-4jqv-mc3x-m676GHSA-3w37-wq28-93x7GHSA-39w2-rjm5-chcv37719190017(job113122655549) and37719558844(job113123838149). Each advisory is a check-run annotation on those jobs.37565270565(2026-10-07 03:07Z), was green, so the six were published after it.next@16.3.6, read fromorigin/main's lockfile:apps/docspins"next": "16.3.6"exactly (apps/docs/package.json);better-auth@1.7.3inpackages/plugins/plugin-authalso resolves it asnext@16.3.6.Done when
main's lockfile no longer matches any of the six: everynextresolution moves to a release that fixes all six.osv-exemptionPR underosv-scanner.tomlconvention 3 (validate-deps: decide how the OSV gate should express an advisory with no fix available #4965), ⛔ never in the fix PR.node scripts/check-osv-exemptions.mjsand the OSV step are green on the fix PR.Validate Package Dependenciesrun onmainafter the merge is green, and its run id is recorded here.Dedupe
REST listing of issues updated since 2026-10-07 (
state=all), grepped fornext@16|GHSA-mcj8|GHSA-f87g|GHSA-cjq9|GHSA-4jqv|GHSA-3w37|GHSA-39w2|next 16.3|Validate Package Dependencies.*red|OSV.*red: 1 hit, #22082 (the PR-side verdict, not this fix). None names these advisories.The family is the red-main OSV findings #18930, #20561, #20705, #20769, #21055, #21945 and #22013, all closed by their fix PRs.