@danypops/lector 0.1.10 → 0.1.12

package/README.md

@@ -64,7 +64,7 @@ Three independent `SymbolIndexPort` implementations use one result DTO with expl
 - **TypeScript compiler** extracts bounded structural declarations from cold, malformed, or partially configured projects. It does not claim cross-file identity.
 - **tree-sitter** extracts bounded structural declarations and caches them by content hash. It does not claim type or language-server identity.
 
-File-position operations dispatch by extension and seed a cold server with the requested file. Workspace symbol search and graph population detect every enabled language, merge results deterministically, and retain per-symbol and per-backend provenance. Backend and file-level semantic failures produce bounded partial results without discarding successful languages or files. Bash remains explicit-file-only until its vulnerable upstream dependency chain is removed; generic YAML is explicit-file-only because lockfiles and data files do not establish a workspace language.
+File-position operations dispatch by extension and seed a cold server with the requested file. Workspace symbol search and graph population detect every enabled language, merge results deterministically, and retain per-symbol and per-backend provenance. Backend and file-level semantic failures produce bounded partial results without discarding successful languages or files. Bash and generic YAML stay explicit-file-only: a stray `.sh`/`.yaml` file shouldn't spawn a whole extra language server for every polyglot workspace. `bash-language-server` resolves by bare name against `PATH`, like `gopls`/`rust-analyzer`/`clangd` -- install it yourself if you want Bash support; it does not ship as a bundled dependency, since its own pinned `editorconfig` dependency carries an unpatched ReDoS/OOM chain in a code path Lector never exercises but would otherwise still ship to every install.
 
 Symbol results report `fidelity`, `backend`, `authority`, `freshness`, `limitations`, `truncated`, and composite `sources`/`completeness` when applicable. Language-server messages, pending requests, opened files, file bytes, settling, parser files, parser nodes, parser bytes, language indexes, and returned symbols are bounded.
 

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@danypops/lector",
-	"version": "0.1.10",
+	"version": "0.1.12",
 	"description": "Platform-neutral filesystem & code-intelligence capability: core, service, and driven adapters",
 	"license": "MIT",
 	"type": "module",
@@ -19,7 +19,6 @@
 	"dependencies": {
 		"@danypops/daemon-kit": "^0.3.2",
 		"@yarnpkg/parsers": "^3.0.3",
-		"bash-language-server": "^5.6.0",
 		"fetch-retry": "^6.0.0",
 		"graphology": "^0.26.0",
 		"jsonc-parser": "^3.3.1",

package/src/domain/language-server-descriptor.ts

@@ -104,7 +104,14 @@ export const BASH_DESCRIPTOR: LanguageServerDescriptor = {
 	backendId: "bash-language-server",
 	extensions: [".sh", ".bash"],
 	workspaceDiscovery: "explicit-only",
-	launch: { kind: "npm-module", entryModule: "bash-language-server/out/cli.js" },
+	// System-binary, not npm-module: bash-language-server's own package.json hard-pins a vulnerable
+	// editorconfig -> minimatch/brace-expansion chain (GHSA-3ppc-4f35-3m26, GHSA-7r86-cg39-jmmj,
+	// GHSA-23c5-xmqv-rm74, GHSA-mh99-v99m-4gvg) with no upstream fix. That chain is only reachable
+	// through textDocument/formatting, which Lector never sends -- but bundling it as a production
+	// npm dependency still ships the vulnerable code and the audit finding to every consumer.
+	// Resolving by bare name against PATH, like gopls/rust-analyzer/clangd, keeps Bash support
+	// available to whoever installs the real server themselves without shipping it by default.
+	launch: { kind: "system-binary", command: "bash-language-server" },
 	args: ["start"],
 	rootMarkers: [],
 	commonSeedCandidates: ["main.sh", "run.sh", "install.sh"],