@holmes-lab/holmes-kit 0.19.4 → 0.19.6

package/CHANGELOG.md

@@ -5,6 +5,71 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 <!-- @implements A-SPEC-209 -->
+## [0.19.6] - 2026-09-11
+
+A correction. 0.19.5 claimed a security improvement that does not reach the people it was written
+for, and a claim that does not hold is worse than no claim.
+
+### Fixed
+- **The `protobufjs` override does not protect consumers, and 0.19.5 said it did.** `overrides` is a
+  ROOT-manifest field: npm applies it from the top-level project only and ignores a dependency's.
+  The field ships inside this package's `package.json` and has no effect there. Measured against the
+  published 0.19.5 from a fresh consumer project: `protobufjs@6.11.6`, critical 1 / high 5 —
+  unchanged. This repository had already recorded that `allowScripts` is root-only and does not
+  transfer; the same property of `overrides` was not carried across, and the claim was written before
+  a third-party install was checked.
+
+  The override is kept, because it does protect this repository's own tree — development, CI and the
+  release gate. What changed is the description.
+
+### Security
+- **Consumers who want the critical advisory gone must declare the override themselves.** In the
+  CONSUMING project's `package.json`:
+
+  ```json
+  { "overrides": { "protobufjs": "^7.6.3" } }
+  ```
+
+  Measured from a fresh consumer project: `protobufjs@7.6.6`, **critical 0 / high 3**, with the
+  local model's real inference intact. The remaining three highs (`@xenova/transformers`, `js-yaml`,
+  `sharp`) are unaffected by this and stay recorded, with their re-evaluation triggers, in
+  `docs/goals/supply-chain-xenova-2026-09.md`. The durable fix is upstream — an
+  `@xenova/transformers` line that does not pull `onnxruntime-web`'s 6.x `protobufjs` — and is not
+  something this package can deliver on a consumer's behalf.
+
+## [0.19.5] - 2026-09-11
+
+One critical supply-chain advisory removed, by measuring a prediction this project had written down
+and found to be wrong.
+
+> **Correction (0.19.6):** the entry below overstates its reach. `overrides` is a ROOT-manifest
+> field — npm applies it only from the top-level project, never from a dependency — so installing
+> this package does **not** change what a consumer resolves. Measured on the published 0.19.5:
+> a consumer still gets `protobufjs@6.11.6`, critical 1 / high 5. The override protects THIS
+> repository's tree (development, CI, the release gate) and nothing else. A consumer who wants it
+> must declare it themselves; see the Security note in 0.19.6.
+
+### Security
+- **`protobufjs` is overridden to 7.x, and the critical advisory is gone** (REQ-601). The arbitrary
+  code execution lives in protobufjs's 6.x line, reached three levels down —
+  `@xenova/transformers → onnxruntime-web → onnx-proto → protobufjs@6.11.6` — and this project's own
+  supply-chain note predicted that overriding it would break `onnx-proto`, which pins 6.x. That
+  prediction was **refuted**: the Windows qualification run measured it first (critical 0 / high 3,
+  inference intact) and macOS reproduced it with protobufjs as the only variable, verifying import,
+  `ModelProto.decode`, and a **real 1024-dimension normalized inference** — the path where
+  `onnx-proto` actually decodes a model, which is where a 6→7 incompatibility would surface.
+
+  | | critical | high | protobufjs |
+  |---|---|---|---|
+  | 0.19.4 | 1 | 5 | 6.11.6 |
+  | **0.19.5** | **0** | **3** | **7.6.6** |
+
+  A guard reads the **lockfile**, not the manifest: the manifest is the intent and the lock is the
+  fact, so asserting the declaration alone would stay green while the override was being ignored —
+  and an override that quietly stops applying brings the critical back without a word. The remaining
+  three highs (`@xenova/transformers`, `js-yaml`, `sharp`) are untouched and still recorded, with
+  their re-evaluation triggers, in `docs/goals/supply-chain-xenova-2026-09.md`.
+
 ## [0.19.4] - 2026-09-10
 
 Three Windows diagnoses that pointed the wrong way, found by running the Windows plan on a real

package/README.md

@@ -165,6 +165,15 @@ To prepare during installation instead, set `HOLMES_AUTO_MODEL_INSTALL=1` before
 is never overridden. Models live in `~/.holmes/models` (`%USERPROFILE%\.holmes\models` on Windows);
 `HOLMES_MODEL_CACHE` overrides that, including for a prepopulated offline cache.
 
+> **Security note.** This package's dependency chain pulls `protobufjs@6.x` through
+> `@xenova/transformers → onnxruntime-web → onnx-proto`, which carries a critical advisory. npm's
+> `overrides` is a ROOT-manifest field, so we cannot fix this on your behalf — declare it in YOUR
+> `package.json` to resolve it:
+> ```json
+> { "overrides": { "protobufjs": "^7.6.3" } }
+> ```
+> Measured from a fresh install: `critical 1 → 0`, `high 5 → 3`, with local inference intact.
+
 > On **ARM Linux**, install with Node 20 or 22: `tree-sitter@0.21.1` ships no `linux-arm64` prebuild,
 > so it compiles from source, and that compile fails against Node 24 headers. The failure happens
 > while npm is still installing dependencies — before Holmes-Kit exists — so `doctor` cannot diagnose

package/dist/.build-id

@@ -1 +1 @@
-bb0f4497-mtwbj9ia
+b6de96c3-mtx2uyhs

package/package.json

@@ -1,7 +1,7 @@
 {
   "//": "@implements A-SPEC-209",
   "name": "@holmes-lab/holmes-kit",
-  "version": "0.19.4",
+  "version": "0.19.6",
   "description": "Holmes-Kit — deterministic Agentic Software Engineering (ASE) harness with causal traceability (spec chain + D-CPG + RTM + phase guardrail)",
   "main": "dist/holmes/mcp/server.js",
   "types": "dist/holmes/mcp/server.d.ts",
@@ -91,5 +91,8 @@
   "allowScripts": {
     "better-sqlite3@12.11.1": true,
     "sharp@0.32.6": true
+  },
+  "overrides": {
+    "protobufjs": "^7.6.3"
   }
 }