Adopt offline OSV lockfile scanning and remediate the qualified baseline

[sarthakagrawal927]

Why

The OSV-Scanner 2.5.1 trial found dependency risk that the existing root pnpm audit gate missed because it did not cover the independent docs-site lockfile or RustSec advisories.

Measured offline receipt on 2026-08-31:

• Four inputs discovered: root and docs-site pnpm lockfiles, desktop Cargo.lock, and one Go module.
• 35 packages affected by 51 known vulnerabilities across npm and crates.io.
• Severity summary: 0 critical, 14 high, 18 medium, 2 low, 17 unknown.
• 34 vulnerabilities have a listed fixed version.
• Warm offline scan: 9.16 seconds using cached local databases.
• Root pnpm-lock and the Go module had no reported packages; findings were in docs-site and desktop Rust locks.

Requirement

CodeVetter SHALL produce version-attributed SARIF and JSON lockfile evidence without uploading customer manifests. The maintained scan SHALL use a pre-seeded local OSV database and --offline --offline-vulnerabilities. Database refresh SHALL be a separate explicit network operation with provenance.

Design

• Repository lane: checksum-pinned OSV binary, database refresh job, offline scan job, SARIF upload, and a reviewed baseline policy.
• Product lane: optional collector only after database packaging, freshness, signing, and size are measured. CodeVetter remains verdict authority.
• Do not suppress an advisory by package name alone. Classify reachability, target platform, dev/build/runtime scope, fixed-version availability, and accepted risk.
• Treat the unmaintained GTK3/RustSec cluster separately from directly fixable npm/Rust lock updates.

Tasks

• Capture the complete JSON/SARIF trial receipt and database freshness identity.
• Triage all 51 vulnerabilities by scope, reachability, and fix availability.
• Upgrade the 34 fixable findings in bounded lockfile groups with builds/tests after each group.
• Decide and document the GTK3/unmaintained advisory policy.
• Add a checksum-pinned repository workflow that refreshes separately and scans offline.
• Add a local script that emits deterministic artifacts under artifacts/.
• Validate no manifest or source content leaves the machine during the offline phase.
• Re-run OSV, pnpm audit, Cargo checks, docs build, and release-relevant tests.

Evidence

Discovered during #193. Trial artifacts are local ignored scratch under artifacts/tooling/trials/osv/; no dependency changes were made by the trial.

[sarthakagrawal927]

Repository integration receipt (local, uncommitted): added pnpm quality:vulnerabilities with a tested offline runner, deterministic SARIF plus a versioned receipt, exact scanner/source/database identities, and tracked evidence at evidence/security/osv-baseline-2026-08-31.md. Re-run: OSV-Scanner 2.5.1, 8.942 s, 35 affected package versions, 52 advisory/package matches, 49 primary IDs, 48 SARIF rules; root pnpm and Go remain clean. No findings were suppressed and no dependency was changed. Blume and Cargo remediation still require owner approval before CI enforcement.

[sarthakagrawal927]

Follow-up: added a manual-only osv-offline.yml design with two jobs: explicit networked database refresh and artifact hashing, then a separate --offline --offline-vulnerabilities scan using OSV-Scanner 2.5.1 with its official Linux SHA-256. All actions are commit-pinned, permissions are narrow, scan evidence uploads even on findings, and the workflow stays red instead of accepting the current baseline. zizmor 1.29.0 offline/pedantic reports no findings. It is intentionally not a push/PR gate until dependency remediation.

[sarthakagrawal927]

Bounded remediation proposal awaiting owner approval: (A) update only event-listener 5.4.1 to 5.4.2 in Cargo.lock; cargo update --dry-run shows that single package update plus removal of three now-unused Windows support crates. Build/check and OSV immediately after. (B) separately update docs-site Blume 1.0.4 to 1.5.3; this spans multiple minor releases and a broad transitive docs runtime, but upstream 1.4.2 explicitly raised Astro, Mermaid, DOMPurify, Undici, js-yaml, and Vercel adapter minimums for security fixes. Run frozen install, validate, production build, and OSV after. Keep GTK3 and unic advisories visible and target-classified; do not package-name allowlist them. No lockfile has been modified.

[sarthakagrawal927]

Approved maintenance landed locally at revision 8552029: Blume 1.0.4 to 1.5.3 and event-listener 5.4.1 to 5.4.2. Blume validate/build pass after replacing the removed amber preset with the literal product token and fixing the newly enforced docs links/order. The exact offline OSV rerun used the same database digests, took 9.745s, and reduced findings from 52 advisory/package matches to 39 result instances / 36 normalized SARIF rules. This is not clean: docs-site pnpm audit --prod still reports 12 high, 7 moderate, and 1 low advisory in transitive build/documentation paths. Root production audit is clean, cargo-deny is clean with 14 duplicate warnings, and no suppression was added. Evidence is appended to evidence/security/osv-baseline-2026-08-31.md.