Repository navigation
fix(deps): patch dashboard security dependencies [OSWE-280] - #156
Conversation
|
@Mergifyio queue |
Merge Queue Status
This pull request spent 9 seconds in the queue, with no time running CI. ReasonPull request #156 has been dequeued by @ericlitman with a Requeued — the merge queue status continues in this comment ↓. |
|
@Mergifyio dequeue |
✅ Accepted riskAccepted by ericlitman: OSWE-280 (authority 48fa77b) 🔴 Critical · rollup pulls an unexplained linux-x64 native binary DetailsRun: @unfret review · @unfret status · @unfret help |
![unfret-eal[bot]](https://avatars.githubusercontent.com/u/28211?s=60&v=4){kind=small}
There was a problem hiding this comment.
🛑 1 blocking finding
🔴 Critical · rollup pulls an unexplained linux-x64 native binary
Check
|
OSWE-280 — exact-head adjudication for open-swe #156 at Published treatment: mandatory / critical. Consequence class: unconfirmed after one bounded source, package-integrity and reachable-path investigation. This is the only open blocking finding: The reported unexplained Linux binary has a documented upstream purpose in Rollup PR6467: fixing the release cross-toolchain and glibc compatibility. The exact optional pin is present in the official v4.64.12 tag. All three inspected npm tarballs match the lock and registry SHA-512 digests; all five registry ECDSA signatures verify. The published loader is byte-identical to the tagged loader and selects Rollup's own platform binary, with no LZMA load path found. LZMA has no install script, and this downstream lock omits the upstream cross-toolchain packages. No reproduction or conclusive trace establishes compromise, unwanted execution, or an integrity defect. I apply the standing agent waiver for an unconfirmed finding after bounded investigation; the published mandatory treatment is retained until the exact-head gate accepts this waiver. No source change is justified by this finding. This does not assert that native binaries have been exhaustively audited: no execution, full disassembly, reproducible build, or independent Sigstore chain verification was performed. The separately dismissed Mermaid allegation is change-unrelated: the prior Streamdown version already required an explicit plugin and the call site is unchanged. It requires no repair. |
|
@Mergifyio queue |
Merge Queue Status
This pull request spent 10 seconds in the queue, with no time running CI. Required conditions to merge
|
Summary
Update the dashboard dependency graph for the October security advisories. Keep Nitro on its existing working beta and use Vite 8 for the updated TanStack build plugins. The Python dependency update is in PR #155.
Evidence
After: this PR contains only the three UI files. Their blobs are identical to the validated combined head
25fc6409144dce36328d6d02b732fafb10b47b50; the union with PR fix(deps): patch Python security dependencies [OSWE-280] #155 reconstructs that head's exact treea02c76b3c1ba1187ddee50b1afa106920686a372.pnpm install --frozen-lockfile,pnpm run build,pnpm run typecheck, andpnpm run testpass on Node 22.23.4 / pnpm 11.9.0; all 50 tests pass. The build preserves the committed generated route tree.braces@3.0.3/GHSA-vfj7-8cjw-p6xm; recorded scan.pnpm run lint; invoking the lock-resolved ESLint 10.6.0 reports the existing import-order error intoolExecutionDisplay.tsand 11 shadow warnings. The affected source is unchanged from the base. Vitest exits 0 with the previously recordedmodule is not defineddiagnostic and delayed-close warning.Merge Danger
Door: two-way
Revert the UI manifest, lockfile and generated route tree together.
Blast Radius: dashboard
The dependency changes affect UI rendering and the Vite/TanStack build pipeline. No deployment has been performed. The completed four-reviewer Unfret panel met its 3-reviewer quorum. Its sole blocking allegation was classified unconfirmed after the bounded investigation below; the authentic Unfret App check accepted the exact-head waiver. Mergify queueing follows fresh gate and thread verification. Shared reviewer inputs and policy are unchanged.
Linear: OSWE-280
Adjudication
OSWE-280 — exact-head adjudication for open-swe #156 at
1c7368b1d98e0785a7265013e3f4fdb3702e985a.Published treatment: mandatory / critical. Consequence class: unconfirmed after one bounded source, package-integrity and reachable-path investigation. This is the only open blocking finding:
v1:5ce131f564ebad96a4ecbfe41ae4c2bd9a4b785f74c0a1732db22e62fe9fa7fb.The reported unexplained Linux binary has a documented upstream purpose in Rollup PR6467: fixing the release cross-toolchain and glibc compatibility. The exact optional pin is present in the official v4.64.12 tag. All three inspected npm tarballs match the lock and registry SHA-512 digests; all five registry ECDSA signatures verify. The published loader is byte-identical to the tagged loader and selects Rollup's own platform binary, with no LZMA load path found. LZMA has no install script, and this downstream lock omits the upstream cross-toolchain packages.
No reproduction or conclusive trace establishes compromise, unwanted execution, or an integrity defect. I apply the standing agent waiver for an unconfirmed finding after bounded investigation; the published mandatory treatment is retained until the exact-head gate accepts this waiver. No source change is justified by this finding. This does not assert that native binaries have been exhaustively audited: no execution, full disassembly, reproducible build, or independent Sigstore chain verification was performed.
The separately dismissed Mermaid allegation is change-unrelated: the prior Streamdown version already required an explicit plugin and the call site is unchanged. It requires no repair.