[al2wang]

Patches every fixable npm advisory in web and docs-site, moves two build-only tools to devDependencies with a regression that enforces it, and records the two advisories that have no upstream fix.

Fixed (in-range lockfile updates)

• source-map-js 1.2.1 → 1.2.2 in web and docs-site (GHSA-68fv-2mgg-jv7q, high)
• proxy-addr 2.0.7 → 2.0.8 in docs-site (GHSA-jqcg-44mw-7w3h, critical)
• @modelcontextprotocol/sdk 1.30.0 → 1.32.1 in docs-site (GHSA-6qxp-vccf-f47h, high)
• hono 4.13.5 → 4.13.13 in docs-site (GHSA-hxh3-vqpv-xpqv; supersedes build(deps): bump hono from 4.13.5 to 4.13.12 in /docs-site #120)
• postcss-selector-parser 7.1.5 → 7.1.6 in docs-site (GHSA-rj75-hqrm-r3gf, moderate)

Fixed (patch-level overrides through the existing overrides mechanism)

• miniflare.sharp 0.35.4 → 0.35.5 (GHSA-wq5f-xc86-pv6w, high)
• oxfmt.tinypool 2.1.0 → 2.1.2 (GHSA-5gmw-xhrv-c9v3 and GHSA-85c8-ppgw-ccpr, critical)

Reclassified (not remediation)

shadcn and vinext move to devDependencies. Neither supported deployment needs them at runtime: the GitHub Pages site builds from production dependencies alone, and the Worker dist/ imports only Node built-ins. tests/test-community-docs-site.sh now rebuilds the Pages site from a production-only install, and fails if vinext is present or the output differs. docs-site/PUBLISHING.md records this deployment contract.

Audit on the head

• web: 0 vulnerabilities.
• docs-site production audit (the CI gate, --omit=dev --audit-level=high): 4 moderate entries (sprintf-js), 0 high.
• docs-site full audit: 13 entries from 2 unique advisories, neither with a patched release:
  • braces GHSA-vfj7-8cjw-p6xm (high, dev-only, build time);
  • sprintf-js GHSA-hp3w-g68c-fv3c (moderate, build time via gray-matter).

Open maintainer decisions

Nothing is suppressed in this PR, and no exception mechanism is added. The handling of the two unfixed advisories, where they are tracked, and the Dependabot alert gap are proposals in the comments. None of them has been accepted yet.

🤖 Generated with Claude Code

[al2wang]

Update: one recommended disposition, which supersedes the four options in the description. No exception is needed.

c006b48 moves vinext to devDependencies, after testing both supported deployments without it.

Deployment test (clean copies of the artifacts, no node_modules anywhere above them):

• Public GitHub Pages: build:pages imports only gray-matter, marked and sanitize-html. I served out/ under /s-code-docs/: home, docs/configuration/ and docs/core-concepts/ return 200, an unknown page returns 404, and .nojekyll is present.
• Optional Worker: the dist/ server output imports only Node built-ins, and vinext-externals.json is []. Under the documented wrangler dev --config dist/server/wrangler.json, /, /docs/configuration and /docs/core-concepts return 200 with the correct titles, and an unknown doc returns 404. The log shows no install or download.

New regression: tests/test-community-docs-site.sh now reinstalls the site with --omit=dev, fails if vinext is present, rebuilds the static site, and requires the output to be identical to the full build. Against main's manifest it fails with "a production install of the documentation site contains vinext".

Audits on the final lockfiles:

audit	result
fixed (in-range, lockfile only)	source-map-js, proxy-addr, @modelcontextprotocol/sdk, hono
web	0 vulnerabilities
docs-site production (--omit=dev, the CI gate)	4 moderate (gray-matter → js-yaml → argparse → sprintf-js), 0 high
docs-site full, including build tools	20: 13 high and 2 critical in build tools (braces chain via vinext, oxfmt, tinypool, sharp, wrangler, miniflare, ts-morph). Still visible to Dependabot; full-audit enforcement unchanged.

braces (GHSA-vfj7-8cjw-p6xm) remains a build-tool finding, not a fixed one. I found no deployed-runtime path. It is, however, reachable at build time:

• The CI docs job runs npm run build (vinext build) on pull-request content.
• vite-plugin-dynamic-import expands glob patterns taken from the site's own source, so a PR author could submit a deeply nested pattern and exhaust that job's stack.
• That is a denial of service against an ephemeral runner with a read-only token, bounded by the job timeout.

Recommendation:

• Accept the classification.
• Track braces through Dependabot.
• Owner: @sl-7qx. Review: 2026-11-09, or when vite-plugin-dynamic-import drops fast-glob.

I have not filed the upstream issue, since that is outside this repository; I can draft it if you want.

Local checks: community tree, doc links, DCO, CI workflow (with Ruby), community candidate and verification suites all pass. The secret history scan passes on a clone with all 27 remote branches plus this commit, which is CI's fetch-depth: 0 coverage.

[al2wang]

Two clarifications to the disposition above. No new request; this PR is already waiting on @sl-7qx.

1. The owner (@sl-7qx) and the review date (2026-11-09) are proposals. Ownership and the residual-risk disposition still need your agreement.

2. My braces analysis does not cover every remaining build-tool finding, and Dependabot is not tracking them. The repository relies on "Dependabot scans the full lockfile" (comment in tests/test-community-docs-site.sh). Yet the full docs-site audit on this head reports four high/critical advisories that have no Dependabot alert, open or closed:

   package	advisory	severity	reaches the build through
   braces 3.0.3	GHSA-vfj7-8cjw-p6xm	high	vinext (analysed above)
   sharp < 0.35.5	GHSA-wq5f-xc86-pv6w	high	miniflare / wrangler (the 0.35.4 override)
   tinypool ≤ 2.1.0	GHSA-5gmw-xhrv-c9v3	critical	oxfmt
   tinypool < 2.1.2	GHSA-85c8-ppgw-ccpr	critical	oxfmt

   None of these are in the production install, and none were introduced by this PR; main has them all. They currently have no recorded disposition. I have not analysed sharp or tinypool reachability. Whether they need their own follow-up or a tracking issue is your call; I'm not changing them here, to keep this PR's scope as reviewed.

[al2wang]

@sl-7qx, this consolidates my earlier comments into one decision-ready summary. Head fddaab9; every selected check passes.

What this PR fixes: in-range, lockfile-level updates for source-map-js, proxy-addr, @modelcontextprotocol/sdk and hono. Since my last comment it also patches two build-tool findings through the existing overrides mechanism:

• sharp → 0.35.5 for GHSA-wq5f-xc86-pv6w (high);
• tinypool → 2.1.2 for GHSA-5gmw-xhrv-c9v3 and GHSA-85c8-ppgw-ccpr (both critical).

Both are patch releases. Only those packages and sharp's platform binaries change. sharp loads with librsvg 2.63.2, and oxfmt formats through its worker pool.

Why the vinext/shadcn classification is correct: both supported deployments run without them. The Pages site builds from production dependencies alone, and the Worker dist/ imports only Node built-ins and serves under wrangler dev with no node_modules. tests/test-community-docs-site.sh now enforces this on every run.

Audit status on fddaab9:

• web: 0 vulnerabilities.
• docs-site production audit (the CI gate): 4 moderate, 0 high, 0 critical.
• docs-site full audit: 14 package entries from 3 unique advisories: braces (high, no patched release) plus two moderates. The earlier "20 findings, 13 high, 2 critical" counted parent packages that only inherit an advisory; it came from 6 unique advisories.

The one remaining high, braces GHSA-vfj7-8cjw-p6xm:

• No deployed-runtime path is identified.
• It is reachable at build time: CI's docs job builds pull-request content, so a PR can crash its own job. That job runs with a read-only token, no secrets, no artifacts and a 15-minute timeout.
• No fix exists upstream yet (Security Advisory: Uncontrolled Recursion Depth in Tree Walkers Leads to Stack-Overflow DoS micromatch/braces#70).
• Recommended disposition: accept it as a recorded build-time risk, keep vinext dev-only with the new regression, and review on 2026-11-09 or when upstream ships a fix.

Correction: I said earlier that the remaining findings are tracked through Dependabot. That was unsupported.

• GitHub's dependency graph lists the exact vulnerable versions.
• No Dependabot alert has been created for any advisory reviewed after 2026-10-01, including production ones (proxy-addr critical, source-map-js in web). Before that date, alerts arrived within 1–2 days.
• With my access I can't tell whether alerts were disabled or are lagging. An administrator should check Settings → Code security → Dependabot alerts.

Decision requested:

1. Review and approve this PR.
2. Accept, or reject, the recommended braces disposition. You are the proposed owner, not an agreed one.
3. Have someone with admin access check Dependabot alert generation.

Per-advisory records (exact path, operation, reachability, residual risk) are below.

Advisory records

R1 — braces, GHSA-vfj7-8cjw-p6xm / CVE-2026-93687 (high, CVSS 7.5)

• Advisory: reviewed 2026-10-02. Affects npm/braces <= 3.0.3; no patched version. Upstream issue: Security Advisory: Uncontrolled Recursion Depth in Tree Walkers Leads to Stack-Overflow DoS micromatch/braces#70
• Operation: the recursive AST walkers in lib/compile.js have no depth guard. A deeply nested brace pattern under the length limit exhausts the stack, and Node exits with an uncaught RangeError.
• Installed: 3.0.3 on main and fix(deps): patch the fixable web and docs-site npm advisories #125.
  • via vinext@1.0.0-beta.8 → vite-plugin-commonjs@0.10.4 → vite-plugin-dynamic-import@1.6.0 → fast-glob@3.3.3 → micromatch@4.0.8 → braces
  • via shadcn@4.18.0 → fast-glob → …
  • Production dependency on main; dev-only on fix(deps): patch the fixable web and docs-site npm advisories #125.
• Reachability:
  • Build time only. vite-plugin-dynamic-import expands glob patterns derived from dynamic import() paths in the site's own source during vinext build.
  • CI exposure: the CI docs job runs that build on pull-request content, so a PR author controls the input. That job runs on pull_request with a contents: read token and persist-credentials: false, references no secrets, uploads no artifacts, and is limited to 15 minutes on an ephemeral GitHub-hosted runner.
  • Deployed sites: no identified deployed-runtime path. The GitHub Pages build never loads vinext, and the Worker dist/ contains none of the chain.
• Remediation: none available; the newest vinext (1.1.0) and the plugin chain still require fast-glob ^3.
• Proposed mitigation: keep vinext dev-only (fix(deps): patch the fixable web and docs-site npm advisories #125), keep the production-only build regression, and watch the upstream issue.
• Residual risk: a pull request can crash its own docs CI job. No identified path to secrets, tokens, caches shared with the default branch, or published output.
• Proposed owner: @sl-7qx, not yet agreed. Proposed review date: 2026-11-09, or when braces/micromatch ships a fix.
• Blocks fix(deps): patch the fixable web and docs-site npm advisories #125 under existing policy? The CI gate audits production dependencies at high, and on fix(deps): patch the fixable web and docs-site npm advisories #125 that gate passes. Whether a dev-only high finding needs anything more is a maintainer decision.

R2 — sharp, GHSA-wq5f-xc86-pv6w (high, CVSS 8.9; upstream librsvg CVE-2026-96889)

• Advisory: reviewed 2026-10-06. Affects sharp < 0.35.5; patched in 0.35.5, which ships librsvg 2.63.2. Upstream: GHSA-wq5f-xc86-pv6w
• Operation: a librsvg memory bug when decoding SVG; possible RCE on glibc Linux.
• Installed: main 0.35.4 via @cloudflare/vite-plugin / wrangler → miniflare@5.20260828.0-alpha → sharp. miniflare pins 0.35.2 exactly; the repository's root overrides.miniflare.sharp set it to 0.35.4. Dev-only.
• Reachability: miniflare uses sharp for its local Images-binding emulation. A require-trace of the CI vinext build shows sharp is never loaded, and CI never runs wrangler dev. It would be reached only by a developer running the local emulator against untrusted SVG input.
• Remediation (in fix(deps): patch the fixable web and docs-site npm advisories #125, fddaab9): override moved to 0.35.5; only sharp and its @img/* platform packages change. Validated: sharp loads at 0.35.5 with librsvg 2.63.2; vinext build passes; docs-site check passes.
• Residual risk on fix(deps): patch the fixable web and docs-site npm advisories #125: none from this advisory. Blocks: no, if fix(deps): patch the fixable web and docs-site npm advisories #125 merges.

R3 — tinypool, GHSA-5gmw-xhrv-c9v3 / CVE-2026-104848 (critical, CVSS 9.5)

• Advisory: reviewed 2026-10-05. Affects tinypool <= 2.1.0; patched in 2.1.1. Upstream: fix: guard worker options from proto pollution tinylibs/tinypool#134
• Operation: worker options are read through Object.prototype, so a prototype pollution elsewhere in the same process (execArgv, env) makes every pool worker load attacker code.
• Installed: 2.1.0 on main via oxfmt@0.61.0, which pins it exactly. Dev-only.
• Reachability: oxfmt runs only through the manual npm run format; it is not run in CI and not loaded by the build (require-trace). Exploitation needs an attacker-controlled prototype pollution inside that same formatter process.
• Remediation (in fix(deps): patch the fixable web and docs-site npm advisories #125): overrides.oxfmt.tinypool = 2.1.2, a patch-level change. The alternative, oxfmt 0.68+ (first release on 2.1.2), is a seven-minor 0.x jump and was not taken. Validated: oxfmt formats through its worker pool with tinypool 2.1.2.
• Residual risk on fix(deps): patch the fixable web and docs-site npm advisories #125: none from this advisory. Blocks: no, if fix(deps): patch the fixable web and docs-site npm advisories #125 merges.

R4 — tinypool, GHSA-85c8-ppgw-ccpr / CVE-2026-104849 (critical, CVSS 9.5)

• Advisory: reviewed 2026-10-05. Affects tinypool < 2.1.2; patched in 2.1.2. Upstream: fix: guard worker filename from proto pollution tinylibs/tinypool#135
• Operation: the run() option filename is read through Object.prototype; prototype pollution lets an attacker load an arbitrary worker module.
• Installed, reachability and remediation: as R3; 2.1.2 covers both advisories.
• Residual risk on fix(deps): patch the fixable web and docs-site npm advisories #125: none from this advisory. Blocks: no, if fix(deps): patch the fixable web and docs-site npm advisories #125 merges.

Moderates (below the high gate, recorded for completeness)

• sprintf-js GHSA-hp3w-g68c-fv3c: reached via gray-matter → js-yaml@3 → argparse@1, a production build-time dependency. No compatible fix; npm audit fix --force would replace gray-matter with 2.0.1. The input is the repository's own Markdown front matter.
• postcss-selector-parser GHSA-rj75-hqrm-r3gf (< 7.1.6): a nested copy remains. This is a possible small follow-up and was not changed here.

Dependabot discrepancy

• Dependency graph: GitHub's graph (SBOM generated 2026-10-09T21:39Z) lists the exact vulnerable versions, braces 3.0.3, sharp 0.35.4 and tinypool 2.1.0, so the dependencies are represented.
• Alert history: the 11 alerts, paginated across all states, were each created 1–2 days after their advisory, up to Bump jsonschema from 0.49.2 to 0.51.0 #11 on 2026-10-01.
• No alerts since then: none has been created for any advisory reviewed after 2026-10-01. That includes production-scope proxy-addr (critical) and source-map-js in web, so the cause is not dev-scope filtering.
• Unresolved with this access: GET /repos/…/vulnerability-alerts returns 404 and security_and_analysis is null. Without admin access I can't tell disabled from not visible.
• Administrator check needed: confirm in repository Settings → Code security that Dependabot alerts are still enabled, and look for any alert rule or org policy change around 2026-10-01.
• Correction: my earlier statement that the remaining findings were tracked through Dependabot was unsupported.

[al2wang]

@sl-7qx, what has changed since my last summary (fddaab9). Nothing below is a recorded decision; items 3–4 are proposals for you to accept or change.

1. New commit ecce9e7: postcss-selector-parser 7.1.5 → 7.1.6 (GHSA-rj75-hqrm-r3gf / CVE-2026-104844, moderate). It is a lockfile-only, in-range update to the single copy; no other package changes. Every selected check passes on this head (run 38002843497: linux, macos, web, docs with the audit selected, codeql, source-gate).

2. Remaining findings on ecce9e7 (re-audited just now):

• web: 0.
• docs-site production audit (the CI gate): 4 moderate entries, all sprintf-js; 0 high.
• docs-site full audit: 13 entries from 2 unique advisories:
  • braces GHSA-vfj7-8cjw-p6xm (high), dev-only on this branch. Unchanged since my last summary; still no patched release (3.0.3 is the latest).
  • sprintf-js GHSA-hp3w-g68c-fv3c / CVE-2026-97058 (moderate). This is new detail. Affects <= 1.1.3, and 1.1.3 is the latest release, so no fix exists. It is reached at build time through gray-matter 4.0.3 (the latest) → js-yaml 3 → argparse 1. The only input is this repository's own Markdown front matter. npm audit fix --force would downgrade gray-matter to 2.0.1, so I have not taken it.

3. Proposed handling under the existing SECURITY.md (its windows are written for S-Code's own vulnerabilities; applying them to third-party findings is my proposal):

• braces (high; reviewed 2026-10-02). The 30-day window would give 2026-11-01. That is earlier than the 2026-11-09 date I proposed before, so I now propose 2026-11-01.
• sprintf-js (moderate; published 2026-09-24). The 90-day window would give 2026-12-23.
• At that date, or when upstream ships a fix, we update or re-assess.

4. Where third-party findings would be tracked (proposal). Both advisories are already public. SECURITY.md's private channel exists to keep S-Code's own vulnerabilities undisclosed, so it doesn't fit here. I propose one public issue per unfixed advisory, labelled dependencies, containing the record from my previous comment, and linked from here. I won't open them unless you agree. If you prefer a private advisory draft, I'll use that instead.

5. Dependabot: the exact administrator check. The last alert is #11 (GHSA-hxh3-vqpv-xpqv, created 2026-10-01T04:00Z), and nothing has been created since. Someone with admin rights on sai-foundation/s-code should check:

1. Repository Settings → Advanced Security: is "Dependabot alerts" enabled? (GET /repos/sai-foundation/s-code/vulnerability-alerts returns 204 when it is enabled; with my access it returns 404.)
2. Organization Settings → Advanced Security → Configurations: which security configuration is attached to s-code, and does it enforce Dependabot alerts off?
3. Repository → Security → Dependabot → auto-triage rules: is any rule dismissing or snoozing new alerts?

One possible lead, unconfirmed: the repository now lives under the sai-foundation organization. sl-7qx/s-code redirects there, and SECURITY.md still links the old path. If the move happened around 2026-10-01, check whether the organization's configuration replaced the repository's earlier setting.

[weiddeng]

Reviewed current head ecce9e7. The dependency updates and overrides resolve to the intended patched versions, and the production-only documentation rebuild validates the vinext/shadcn development-dependency classification. The focused documentation verification and required CI are green. The disclosed upstream-unfixed build-time advisories should remain tracked, but they do not block these available fixes.