diff --git a/.github/workflows/osv-offline.yml b/.github/workflows/osv-offline.yml index 26e263d0..7015037a 100644 --- a/.github/workflows/osv-offline.yml +++ b/.github/workflows/osv-offline.yml @@ -18,7 +18,11 @@ jobs: env: OSV_CACHE_ROOT: ${{ runner.temp }}/osv-db/osv-scalibr run: | - mkdir -p "$OSV_CACHE_ROOT/npm" "$OSV_CACHE_ROOT/crates.io" "$OSV_CACHE_ROOT/Go" + mkdir -p \ + "$OSV_CACHE_ROOT/npm" \ + "$OSV_CACHE_ROOT/crates.io" \ + "$OSV_CACHE_ROOT/Go" \ + "$OSV_CACHE_ROOT/SwiftURL" curl --fail --silent --show-error --location \ https://osv-vulnerabilities.storage.googleapis.com/npm/all.zip \ --output "$OSV_CACHE_ROOT/npm/all.zip" @@ -28,8 +32,11 @@ jobs: curl --fail --silent --show-error --location \ https://osv-vulnerabilities.storage.googleapis.com/Go/all.zip \ --output "$OSV_CACHE_ROOT/Go/all.zip" + curl --fail --silent --show-error --location \ + https://osv-vulnerabilities.storage.googleapis.com/SwiftURL/all.zip \ + --output "$OSV_CACHE_ROOT/SwiftURL/all.zip" cd "$OSV_CACHE_ROOT" - sha256sum npm/all.zip crates.io/all.zip Go/all.zip > SHA256SUMS + sha256sum npm/all.zip crates.io/all.zip Go/all.zip SwiftURL/all.zip > SHA256SUMS - name: Upload database snapshot uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with: @@ -69,8 +76,15 @@ jobs: id: scan continue-on-error: true env: + CODEVETTER_OSV_NETWORK_ISOLATION: linux-network-namespace XDG_CACHE_HOME: ${{ runner.temp }}/osv-db - run: node scripts/run-osv-offline.mjs + run: | + sudo unshare --net -- \ + env \ + CODEVETTER_OSV_NETWORK_ISOLATION="$CODEVETTER_OSV_NETWORK_ISOLATION" \ + PATH="$PATH" \ + XDG_CACHE_HOME="$XDG_CACHE_HOME" \ + "$(command -v node)" scripts/run-osv-offline.mjs - name: Upload scan evidence if: always() uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 diff --git a/docs-site/package.json b/docs-site/package.json index 5746bd9e..ee5d43a6 100644 --- a/docs-site/package.json +++ b/docs-site/package.json @@ -9,5 +9,22 @@ }, "dependencies": { "blume": "1.5.3" + }, + "pnpm": { + "overrides": { + "@hono/node-server": "1.19.15", + "brace-expansion@2": "2.1.4", + "brace-expansion@5": "5.0.9", + "browserslist": "4.28.7", + "fast-uri": "3.1.6", + "hono": "4.12.34", + "ip-address": "10.3.1", + "js-yaml@3": "3.15.1", + "nanoid@3": "3.3.18", + "path-to-regexp@6.1.0": "6.3.0", + "postcss": "8.5.26", + "qs": "6.16.0", + "tar": "7.5.21" + } } } diff --git a/docs-site/pnpm-lock.yaml b/docs-site/pnpm-lock.yaml index 003aab9c..c59e11df 100644 --- a/docs-site/pnpm-lock.yaml +++ b/docs-site/pnpm-lock.yaml @@ -4,6 +4,21 @@ settings: autoInstallPeers: true excludeLinksFromLockfile: false +overrides: + '@hono/node-server': 1.19.15 + brace-expansion@2: 2.1.4 + brace-expansion@5: 5.0.9 + browserslist: 4.28.7 + fast-uri: 3.1.6 + hono: 4.12.34 + ip-address: 10.3.1 + js-yaml@3: 3.15.1 + nanoid@3: 3.3.18 + path-to-regexp@6.1.0: 6.3.0 + postcss: 8.5.26 + qs: 6.16.0 + tar: 7.5.21 + importers: .: @@ -516,11 +531,11 @@ packages: cpu: [x64] os: [win32] - '@hono/node-server@1.19.14': - resolution: {integrity: sha512-GwtvgtXxnWsucXvbQXkRgqksiH2Qed37H9xHZocE5sA3N8O8O8/8FA3uclQXxXVzc9XBZuEOMK7+r02FmSpHtw==} + '@hono/node-server@1.19.15': + resolution: {integrity: sha512-Za2ai6TLdKjUvnur+eenO6nuYYipVAEhyCAdaV8IRvmU9kK8crOZUSYvIXn72E4f8fJqyAbpcJuTsYYmZp9Deg==} engines: {node: '>=18.14.1'} peerDependencies: - hono: ^4 + hono: 4.12.34 '@iconify-json/lucide@1.2.118': resolution: {integrity: sha512-JBnK4YOq6K/lA0JP//27QxFxJ4120TjvfXAzGZZIGjCcXcRRRFxl1rcV7+IWdcVCe90KXdqVaAwLaLf6G3HELw==} @@ -1762,8 +1777,8 @@ packages: resolution: {integrity: sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==} engines: {node: 18 || 20 || >=22} - baseline-browser-mapping@2.10.43: - resolution: {integrity: sha512-AjYpR78kDWAY3Efj+cDTFH9t9SCoL7OoTp1BOb0mQV7S+6CiLwnWM3FyxhJtdPufDFKzmCSFoUncKjWgJEZTCQ==} + baseline-browser-mapping@2.11.20: + resolution: {integrity: sha512-H0ulySigv6icDJ1F7SjtdCD6PrhTpdYCmP0CactWy1+ekh0AFd0o1Wn5T8b+hnTmdBx19u9yhL6wvCylXMY7zw==} engines: {node: '>=6.0.0'} hasBin: true @@ -1826,15 +1841,15 @@ packages: brace-expansion@1.1.18: resolution: {integrity: sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==} - brace-expansion@2.1.2: - resolution: {integrity: sha512-w5JZcKgdhDOgOwm8H+KgbosopHMuGcl6qbulwjtz3SM7I7P3yW1eAjzMPLrIE+NQ9vjgANKHWeMHnrT0OXW1oA==} + brace-expansion@2.1.4: + resolution: {integrity: sha512-hGfVzPxthbf3+2yjg/RBs60cB0FhqBS/zvdV/4wn4/BmN0bNMMHPc4V/BbFieqf1TKAGGAHnY4eSjajCl0f2Xg==} - brace-expansion@5.0.7: - resolution: {integrity: sha512-7oFy703dxfY3/NLxC1fh2SUCQ0H9rmAY+5EpDVfXjUTTs+HEwR2nYaqLv+GWcTsumwxPfiz6CzCNkwXwBUwqCA==} - engines: {node: 18 || 20 || >=22} + brace-expansion@5.0.9: + resolution: {integrity: sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==} + engines: {node: 20 || >=22} - browserslist@4.28.6: - resolution: {integrity: sha512-FQBYNK15VMslhLHpA7+n+n1GOlF1kId2xcCg7/j95f24AOF6VDYMNH4mFxF7KuaTdv627faazpOAjFzMrfJOUw==} + browserslist@4.28.7: + resolution: {integrity: sha512-JxV13hNrFxqjOc8alRbq9dK1MM79NEXYpma2B2J4wAtpWS5zIEIKqWPGCl7N4o7Uc7B7itylh7SuDujATRyyTw==} engines: {node: ^6 || ^7 || ^8 || ^9 || ^10 || ^11 || ^12 || >=13.7} hasBin: true @@ -2490,8 +2505,8 @@ packages: fast-string-width@3.0.2: resolution: {integrity: sha512-gX8LrtNEI5hq8DVUfRQMbr5lpaS4nMIWV+7XEbXk2b8kiQIizgnlr12B4dA3ZEx3308ze0O4Q1R+cHts8kyUJg==} - fast-uri@3.1.3: - resolution: {integrity: sha512-i70LwGWUduXqzicKXWshooq+sWL1K3WUU5rKZNG/0i3a1OSoX3HqhH5WbWwTmqWfor4urUakGPiRQcleRZTwOg==} + fast-uri@3.1.6: + resolution: {integrity: sha512-7Ical1vFEMr0onbVzEDIreM22I4khW+fzyQPwvAFWBp1iwdshSZRsL4jjRvPG9JP1uiqMHRto+YU6R2/CzDz5Q==} fast-wrap-ansi@0.2.2: resolution: {integrity: sha512-7F2Fl+TjRSenLqlU3UjSH0iyqopqoZIu7eZVpEirP2g1GtWa2G/ecEmBdgz31+Mxr+ELclgg6sokpSFIQiZ02Q==} @@ -2692,8 +2707,8 @@ packages: hastscript@9.0.1: resolution: {integrity: sha512-g7df9rMFX/SPi34tyGCyUBREQoKkapwdY/T04Qn9TDWfHhAYt4/I0gMVirzK5wEzeUqIjEB+LXC/ypb7Aqno5w==} - hono@4.12.30: - resolution: {integrity: sha512-emn+JoJjrN9YTpRDS5it/UI2SO9BAE37T6I3d963RxcZ81G9A4pr2SZTEiiaiKbzx+NKRg5BZ89fCL7gCJCUog==} + hono@4.12.34: + resolution: {integrity: sha512-GqXJqY/xJkJmuloTrnV1ZEXG3fqte+VjkUqoRNZXcrUidiUOP4fMSIHHY4tsqZBK++kVyWmt/AAfSUuy57/eSA==} engines: {node: '>=16.9.0'} html-escaper@3.0.3: @@ -2762,8 +2777,8 @@ packages: resolution: {integrity: sha512-5Hh7Y1wQbvY5ooGgPbDaL5iYLAPzMTUrjMulskHLH6wnv/A+1q5rgEaiuqEjB+oxGXIVZs1FF+R/KPN3ZSQYYg==} engines: {node: '>=12'} - ip-address@10.2.0: - resolution: {integrity: sha512-/+S6j4E9AHvW9SWMSEY9Xfy66O5PWvVEJ08O0y5JGyEKQpojb0K0GKpz/v5HJ/G0vi3D2sjGK78119oXZeE0qA==} + ip-address@10.3.1: + resolution: {integrity: sha512-1e9d3kb97NHJTIJDZW9rKqW2h6+dFa50Dy0fpPSMQp2ADje5gvKsXmdiK6dwY5t76TaTt5+P5N1Y/LoToIxP6g==} engines: {node: '>= 12'} ipaddr.js@1.9.1: @@ -2935,8 +2950,8 @@ packages: js-tokens@4.0.0: resolution: {integrity: sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ==} - js-yaml@3.15.0: - resolution: {integrity: sha512-ttBQIIQPDeLjpPOohtUdXuXUVoA2uIB6fEH9HyJ7234s5mBJ5wTx20njxplLZQgLaOfpmPQA7X2t5AX6tIPbog==} + js-yaml@3.15.1: + resolution: {integrity: sha512-S99WuO3HlhO3XN41EtYUNl9zzXjoJx7QvmipxsJVxtCBT0YHEFy+iOJhjSvrmV12nYhWpZaM8lPHkJm0yUMbag==} hasBin: true js-yaml@4.3.2: @@ -3381,8 +3396,8 @@ packages: muggle-string@0.4.1: resolution: {integrity: sha512-VNTrAak/KhO2i8dqqnqnAHOa3cYBwXEZe9h+D5h/1ZqFSTEFHdM65lR7RoIqq3tBBYavsOXV84NoHXZ0AkPyqQ==} - nanoid@3.3.16: - resolution: {integrity: sha512-bzlKTyNJ7+LdGIIwy8ijFpIqEQIvafahV7eYykJ8Cvh42EdJeODoJ6gUJXpQJvej1BddH8OqTXZNE/KfbWAu8Q==} + nanoid@3.3.18: + resolution: {integrity: sha512-DTg4MJbGMWkfi6VZFdNt2/caMbQy4Ou+Op/hJQvGEWcnVfoA1QA+xzRKAzw9jD6+GVOOeYr/mIcuDSdug6F6+w==} engines: {node: ^10 || ^12 || ^13.7 || ^14 || >=15.0.1} hasBin: true @@ -3579,9 +3594,6 @@ packages: resolution: {integrity: sha512-3O/iVVsJAPsOnpwWIeD+d6z/7PmqApyQePUtCndjatj/9I5LylHvt5qluFaBT3I5h3r1ejfR056c+FCv+NnNXg==} engines: {node: 18 || 20 || >=22} - path-to-regexp@6.1.0: - resolution: {integrity: sha512-h9DqehX3zZZDCEm+xbfU0ZmwCGFCAAraPJWMXJ4+v32NjZJilVg3k1TcKsRgIb8IQ/izZSaydDc1OhJCZvs2Dw==} - path-to-regexp@6.3.0: resolution: {integrity: sha512-Yhpw4T9C6hPpgPeA28us07OJeqZ5EzQTkbfwuhsUg0c237RomFoETJgmp2sa3F/41gfLE6G5cqcYwznmeEeOlQ==} @@ -3633,8 +3645,8 @@ packages: resolution: {integrity: sha512-IQ7TZdoaqbT+LCpShg46jnZVlhWD2w6iQYAcYXfHARZ7X1t/UGhhceQDs5X0cGqKvYlHNOuv7Oa1xmb0oQuA3w==} engines: {node: '>=4'} - postcss@8.5.19: - resolution: {integrity: sha512-Mz8SaolMd8nB+G13WkORcxQKHZ/NE4xXevtkJHVuG+guo9/wYKlIMTKAqGdEmYOXR2ijPjTYNHssizdaVSUNdQ==} + postcss@8.5.26: + resolution: {integrity: sha512-u82N74LFzG8ca+dD8puPnplTXoGH4fTPpVGuIbt36G3qvNlkvfD0lEAZSxaly3KX8TS/L1A1gsCEmvKmBcVbkQ==} engines: {node: ^10 || ^12 || >=14} prettier@3.9.5: @@ -3668,8 +3680,8 @@ packages: resolution: {integrity: sha512-vYt7UD1U9Wg6138shLtLOvdAu+8DsC/ilFtEVHcH+wydcSpNE20AfSOduf6MkRFahL5FY7X1oU7nKVZFtfq8Fg==} engines: {node: '>=6'} - qs@6.15.3: - resolution: {integrity: sha512-O9gl3zCl5h5blw1KGUzQKhA5oUXSl8rwUIM5o0S3nCXMliSvy5Dzx7/DJcI+SwgICv+IneSZwhBh1oSyEHA71A==} + qs@6.16.0: + resolution: {integrity: sha512-h6fhOIaRrID2CbEY2fqs+7t+UXZo+MLAnU5gRIq85uFtdiUPCdsApMlHhXogKVM4HM2DVbIjGNTTYH2OcmP1vA==} engines: {node: '>=0.6'} radix3@1.1.2: @@ -4052,8 +4064,8 @@ packages: resolution: {integrity: sha512-uxc/zpqFg6x7C8vOE7lh6Lbda8eEL9zmVm/PLeTPBRhh1xCgdWaQ+J1CUieGpIfm2HdtsUpRv+HshiasBMcc6A==} engines: {node: '>=6'} - tar@7.5.20: - resolution: {integrity: sha512-9FcyK4PA6+WbzlTM9WhQm6vB5W7cP7dUiPsv1g7YDwEQnQ1CGpK3MGlKk/ITVWMk05kHZuBhmVhiv8LZoy/PFQ==} + tar@7.5.21: + resolution: {integrity: sha512-XdhtCvlMywwxpCW8YEq3lOXBJpUPTR2OHHcwLPO3HwsJqOHa2Ok/oJ7ruGzp+JrKoRPVCzJwAdEjqLW/vNRPHA==} engines: {node: '>=18'} tiny-inflate@1.0.3: @@ -4267,7 +4279,7 @@ packages: resolution: {integrity: sha512-Js0m9cx+qOgDxo0eMiFGEueWztz+d4+M3rGlmKPT+T4IS/jP4ylw3Nwpu6cpTTP8R1MAC1kF4VbdLt3ARf209w==} hasBin: true peerDependencies: - browserslist: '>= 4.21.0' + browserslist: 4.28.7 uri-js@4.4.1: resolution: {integrity: sha512-7rKUyy33Q1yc98pQ1DAmLtwX109F7TIfWlW1Ydo8Wl1ii1SeHieeh0HHfPeL2fMXK6z0s8ecKs9frCuLJvndBg==} @@ -4829,7 +4841,7 @@ snapshots: '@asyncapi/converter@2.0.2': dependencies: '@asyncapi/parser': 3.6.3 - js-yaml: 3.15.0 + js-yaml: 3.15.1 path: 0.12.7 transitivePeerDependencies: - encoding @@ -4902,7 +4914,7 @@ snapshots: dependencies: '@babel/compat-data': 7.29.7 '@babel/helper-validator-option': 7.29.7 - browserslist: 4.28.6 + browserslist: 4.28.7 lru-cache: 5.1.1 semver: 6.3.1 @@ -5147,9 +5159,9 @@ snapshots: '@esbuild/win32-x64@0.28.1': optional: true - '@hono/node-server@1.19.14(hono@4.12.30)': + '@hono/node-server@1.19.15(hono@4.12.34)': dependencies: - hono: 4.12.30 + hono: 4.12.34 '@iconify-json/lucide@1.2.118': dependencies: @@ -5312,7 +5324,7 @@ snapshots: node-fetch: 2.7.0 nopt: 8.1.0 semver: 7.8.5 - tar: 7.5.20 + tar: 7.5.21 transitivePeerDependencies: - encoding - supports-color @@ -5353,7 +5365,7 @@ snapshots: '@modelcontextprotocol/sdk@1.29.0(zod@4.4.3)': dependencies: - '@hono/node-server': 1.19.14(hono@4.12.30) + '@hono/node-server': 1.19.15(hono@4.12.34) ajv: 8.20.0 ajv-formats: 3.0.1(ajv@8.20.0) content-type: 1.0.5 @@ -5363,7 +5375,7 @@ snapshots: eventsource-parser: 3.1.0 express: 5.2.1 express-rate-limit: 8.6.0(express@5.2.1) - hono: 4.12.30 + hono: 4.12.34 jose: 6.2.3 json-schema-typed: 8.0.2 pkce-challenge: 5.0.1 @@ -6149,7 +6161,7 @@ snapshots: '@vercel/routing-utils@5.3.3': dependencies: - path-to-regexp: 6.1.0 + path-to-regexp: 6.3.0 path-to-regexp-updated: path-to-regexp@6.3.0 optionalDependencies: ajv: 6.15.0 @@ -6279,7 +6291,7 @@ snapshots: ajv@8.20.0: dependencies: fast-deep-equal: 3.1.3 - fast-uri: 3.1.3 + fast-uri: 3.1.6 json-schema-traverse: 1.0.0 require-from-string: 2.0.2 @@ -6446,7 +6458,7 @@ snapshots: balanced-match@4.0.4: {} - baseline-browser-mapping@2.10.43: {} + baseline-browser-mapping@2.11.20: {} bindings@1.5.0: dependencies: @@ -6597,7 +6609,7 @@ snapshots: http-errors: 2.0.1 iconv-lite: 0.7.3 on-finished: 2.4.1 - qs: 6.15.3 + qs: 6.16.0 raw-body: 3.0.2 type-is: 2.1.0 transitivePeerDependencies: @@ -6610,21 +6622,21 @@ snapshots: balanced-match: 1.0.2 concat-map: 0.0.1 - brace-expansion@2.1.2: + brace-expansion@2.1.4: dependencies: balanced-match: 1.0.2 - brace-expansion@5.0.7: + brace-expansion@5.0.9: dependencies: balanced-match: 4.0.4 - browserslist@4.28.6: + browserslist@4.28.7: dependencies: - baseline-browser-mapping: 2.10.43 + baseline-browser-mapping: 2.11.20 caniuse-lite: 1.0.30001806 electron-to-chromium: 1.5.393 node-releases: 2.0.51 - update-browserslist-db: 1.2.3(browserslist@4.28.6) + update-browserslist-db: 1.2.3(browserslist@4.28.7) bytes@3.1.2: {} @@ -7355,7 +7367,7 @@ snapshots: dependencies: debug: 4.4.3 express: 5.2.1 - ip-address: 10.2.0 + ip-address: 10.3.1 transitivePeerDependencies: - supports-color @@ -7381,7 +7393,7 @@ snapshots: once: 1.4.0 parseurl: 1.3.3 proxy-addr: 2.0.7 - qs: 6.15.3 + qs: 6.16.0 range-parser: 1.3.0 router: 2.2.0 send: 1.2.1 @@ -7411,7 +7423,7 @@ snapshots: dependencies: fast-string-truncated-width: 3.0.3 - fast-uri@3.1.3: {} + fast-uri@3.1.6: {} fast-wrap-ansi@0.2.2: dependencies: @@ -7556,7 +7568,7 @@ snapshots: gray-matter@4.0.3: dependencies: - js-yaml: 3.15.0 + js-yaml: 3.15.1 kind-of: 6.0.3 section-matter: 1.0.0 strip-bom-string: 1.0.0 @@ -7723,7 +7735,7 @@ snapshots: property-information: 7.2.0 space-separated-tokens: 2.0.2 - hono@4.12.30: {} + hono@4.12.34: {} html-escaper@3.0.3: {} @@ -7787,7 +7799,7 @@ snapshots: internmap@2.0.3: {} - ip-address@10.2.0: {} + ip-address@10.3.1: {} ipaddr.js@1.9.1: {} @@ -7942,7 +7954,7 @@ snapshots: js-tokens@4.0.0: {} - js-yaml@3.15.0: + js-yaml@3.15.1: dependencies: argparse: 1.0.10 esprima: 4.0.1 @@ -8586,7 +8598,7 @@ snapshots: minimatch@10.2.5: dependencies: - brace-expansion: 5.0.7 + brace-expansion: 5.0.9 minimatch@3.1.5: dependencies: @@ -8594,7 +8606,7 @@ snapshots: minimatch@5.1.9: dependencies: - brace-expansion: 2.1.2 + brace-expansion: 2.1.4 minipass@7.1.3: {} @@ -8608,7 +8620,7 @@ snapshots: muggle-string@0.4.1: {} - nanoid@3.3.16: {} + nanoid@3.3.18: {} nanoid@5.1.16: {} @@ -8804,8 +8816,6 @@ snapshots: lru-cache: 11.5.2 minipass: 7.1.3 - path-to-regexp@6.1.0: {} - path-to-regexp@6.3.0: {} path-to-regexp@8.4.2: {} @@ -8845,9 +8855,9 @@ snapshots: cssesc: 3.0.0 util-deprecate: 1.0.2 - postcss@8.5.19: + postcss@8.5.26: dependencies: - nanoid: 3.3.16 + nanoid: 3.3.18 picocolors: 1.1.1 source-map-js: 1.2.1 @@ -8871,7 +8881,7 @@ snapshots: punycode@2.3.1: optional: true - qs@6.15.3: + qs@6.16.0: dependencies: es-define-property: 1.0.1 side-channel: 1.1.1 @@ -9429,7 +9439,7 @@ snapshots: tapable@2.3.3: {} - tar@7.5.20: + tar@7.5.21: dependencies: '@isaacs/fs-minipass': 4.0.1 chownr: 3.0.0 @@ -9619,9 +9629,9 @@ snapshots: optionalDependencies: '@vercel/functions': 3.7.5 - update-browserslist-db@1.2.3(browserslist@4.28.6): + update-browserslist-db@1.2.3(browserslist@4.28.7): dependencies: - browserslist: 4.28.6 + browserslist: 4.28.7 escalade: 3.2.0 picocolors: 1.1.1 @@ -9665,7 +9675,7 @@ snapshots: dependencies: lightningcss: 1.32.0 picomatch: 4.0.5 - postcss: 8.5.19 + postcss: 8.5.26 rolldown: 1.1.5 tinyglobby: 0.2.17 optionalDependencies: diff --git a/docs/development/configuration.md b/docs/development/configuration.md index 334bef02..ab470905 100644 --- a/docs/development/configuration.md +++ b/docs/development/configuration.md @@ -23,7 +23,6 @@ the Settings tab and persisted via Tauri preferences. |---|---|---| | `DEBUG_TAURI_DRIVER` | `.env` (optional) | Debug flag for the (removed) tauri-driver path; kept for compatibility. | | LLM provider keys | Settings tab → Tauri preferences | Anthropic / OpenAI / OpenRouter. Never written to SQLite review tables. | -| `gatewayBaseUrl`, `gatewayApiKey`, `gatewayModel` | `codevetter_review_config` (localStorage) mirrored to Tauri preferences | `ReviewConfig` in `apps/desktop/src/lib/review-service.ts`. | | `reviewTone` | same | Incumbent review presentation default. | | `customRules`, `activeStandardsPack`, `standardsPacks` | Rust `review_rubric_config_v1` preference; allowlisted localStorage compatibility mirror | Standards packs authored in Tauri or native Settings and available through `codevetter rubrics`; the first incumbent open migrates older local-only packs. | | Auto-updater pubkey + endpoint | `apps/desktop/src-tauri/tauri.conf.json` | `@tauri-apps/plugin-updater` consumes `latest.json` from GitHub Releases. | @@ -42,6 +41,10 @@ The only network egress from the product is the user-supplied LLM provider and `api.github.com` for PR reads. `api.codevetter.com` is reserved for landing-page proxy concerns, not the desktop app. +Legacy `gatewayBaseUrl`, `gatewayApiKey`, and `gatewayModel` fields are removed +from persisted review configuration. Startup migration scrubs those keys from +older localStorage payloads; new saves allowlist only active review settings. + ## Build / bundle configuration | File | Purpose | diff --git a/evidence/security/osv-baseline-2026-08-31.md b/evidence/security/osv-baseline-2026-08-31.md index de6cc638..69ecfd4c 100644 --- a/evidence/security/osv-baseline-2026-08-31.md +++ b/evidence/security/osv-baseline-2026-08-31.md @@ -68,3 +68,56 @@ paths, and several have no resolution through the current direct version. The repository-wide root production audit remains clean because the docs site has its own lockfile; both facts must stay visible until issue #195 completes reachability and upstream/remediation review. + +## Docs-site transitive remediation — 2026-09-02 + +The docs-site lockfile now overrides thirteen fixable transitive packages to +patched releases while retaining Blume 1.5.3 as the single direct dependency. +The production audit moved from 18 high, 9 moderate, and 1 low advisory to 2 +high advisories, with no critical, moderate, or low advisories remaining. + +Both residual advisories affect `image-size` 2.0.2 parsers for ICNS, JXL, and +HEIF. Upstream lists no patched release, and those formats are absent from +`docs/` and `docs-site/`. The package is confined to the repository-controlled +static documentation build; it is not shipped in the desktop runtime. This is +reachability containment, not suppression or a clean-audit claim. The +advisories remain visible until Blume's dependency graph provides a patched +version. + +Validation after the lockfile update: + +- frozen docs-site install completed successfully; +- the Blume/Astro static build produced all 61 pages; +- `node scripts/check-docs.mjs` validated all 86 Markdown files; +- Biome accepted the docs-site package manifest; +- the repository contains no `.icns`, `.jxl`, `.heif`, or `.heic` docs input. + +## Complete four-ecosystem rerun — 2026-09-02 + +The scanner initially emitted seven Rust findings while also reporting that it +could not load the SwiftURL database. The wrapper previously treated every +exit code `1` as a complete findings run. It now detects extraction/database +errors, marks any emitted artifact incomplete, and exits `2`. The separate +refresh workflow now seeds npm, crates.io, Go, and SwiftURL snapshots. + +After seeding SwiftURL and pinning `path-to-regexp` 6.1.0 to 6.3.0, an offline +rerun at revision `57c2363444bc9c2bd2adf959399217e2723ca2d6` completed in +11.588 seconds. Its SARIF digest is +`307dcf556d664716a5f712b4701f69f6fe4621fcffc26dc3ea6722354e1c8dfc`. +It contains 20 result instances across 19 unique primary advisory IDs: + +- 2 unpatched `image-size` advisories, contained to repository-controlled docs + build inputs as described above; +- 11 unmaintained GTK3 advisory IDs (12 result instances because `glib` is + reached twice), absent from the Apple target graph and retained only by the + Tauri Linux dependency graph; +- 1 unmaintained `proc-macro-error` advisory in the same GTK3 graph; and +- 5 unmaintained `unic-*` advisories reached through + `urlpattern -> tauri-utils` on the Tauri Apple build/runtime graph. + +These residual unmaintained-package notices have no listed fixed version. They +remain visible and do not become an allowlist. The macOS-native application +does not consume the Tauri/GTK/urlpattern graph, but Tauri remains operational +until the separate owner-approved retirement gate; therefore the five +cross-platform `unic-*` notices remain accepted, tracked migration risk rather +than being suppressed. diff --git a/scripts/run-osv-offline.mjs b/scripts/run-osv-offline.mjs index 01cbf728..b86da40e 100644 --- a/scripts/run-osv-offline.mjs +++ b/scripts/run-osv-offline.mjs @@ -57,7 +57,15 @@ export function parseScannerVersion(stdout) { return match[1]; } -export function classifyScannerExit(status) { +export function classifyScannerExit(status, stderr = '') { + if ( + /(?:^|\n)Error during extraction:/i.test(stderr) || + /unable to fetch OSV database:|no offline version of the OSV database is available/i.test( + stderr + ) + ) { + return 'operational_failure'; + } if (status === 0) return 'clean'; if (status === 1) return 'findings'; return 'operational_failure'; @@ -107,6 +115,7 @@ export function runOfflineScan({ outputDir = DEFAULT_OUTPUT_DIR, databaseRoot = defaultDatabaseRoot(), scanner = 'osv-scanner', + networkIsolation = process.env.CODEVETTER_OSV_NETWORK_ISOLATION ?? 'scanner-offline-mode', } = {}) { const versionResult = spawnSync(scanner, ['--version'], { encoding: 'utf8' }); if (versionResult.status !== 0) { @@ -138,7 +147,7 @@ export function runOfflineScan({ { cwd: repositoryRoot, encoding: 'utf8' } ); const finishedAt = new Date(); - const outcome = classifyScannerExit(scan.status); + const outcome = classifyScannerExit(scan.status, scan.stderr); const receipt = { schema: RECEIPT_SCHEMA, @@ -152,7 +161,7 @@ export function runOfflineScan({ recursive: true, }, execution: { - network: 'disabled', + network: networkIsolation, vulnerability_source: 'preseeded-local-databases', started_at: startedAt.toISOString(), finished_at: finishedAt.toISOString(), @@ -166,9 +175,13 @@ export function runOfflineScan({ path: relative(repositoryRoot, sarifPath), sha256: sha256File(sarifPath), result_count: sarifResultCount(sarifPath), + complete: outcome !== 'operational_failure', } : null, limitations: [ + ...(outcome === 'operational_failure' + ? ['The scanner reported an operational error; any emitted findings are incomplete.'] + : []), 'Database refresh is intentionally outside this offline command.', 'A lockfile advisory does not by itself establish runtime reachability.', 'OSV result count may include aliases for the same underlying vulnerability.', @@ -178,7 +191,7 @@ export function runOfflineScan({ if (scan.stderr) process.stderr.write(scan.stderr); process.stdout.write(`${JSON.stringify(receipt, null, 2)}\n`); - return scan.status ?? 2; + return outcome === 'operational_failure' ? 2 : (scan.status ?? 2); } if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) { diff --git a/scripts/run-osv-offline.test.mjs b/scripts/run-osv-offline.test.mjs index 1393a799..c6cc23f4 100644 --- a/scripts/run-osv-offline.test.mjs +++ b/scripts/run-osv-offline.test.mjs @@ -44,6 +44,14 @@ test('parses scanner identity and keeps findings distinct from operational failu assert.equal(classifyScannerExit(1), 'findings'); assert.equal(classifyScannerExit(2), 'operational_failure'); assert.equal(classifyScannerExit(null), 'operational_failure'); + assert.equal( + classifyScannerExit( + 1, + 'Error during extraction: unable to fetch OSV database: no offline version is available' + ), + 'operational_failure' + ); + assert.equal(classifyScannerExit(1, 'warning: advisory metadata is incomplete'), 'findings'); }); test('hashes databases by ecosystem without retaining absolute cache paths', (context) => {