@nuxtjp/dependency-security 0.1.0 → 0.2.0

package/README.md

@@ -7,7 +7,7 @@ It does not inspect arbitrary source, monitor endpoints, install dependencies,
 contact a registry or silently modify a project during installation.
 
 ```sh
-pnpm add -D @nuxtjp/dependency-security@0.1.0
+pnpm add -D @nuxtjp/dependency-security
 pnpm exec nuxtjp-security-config --project-root . --apply
 pnpm install --no-frozen-lockfile
 pnpm install --frozen-lockfile
@@ -15,9 +15,12 @@ pnpm exec nuxtjp-security-check --project-root .
 pnpm audit --json
 ```
 
-The preset requires an installed Nuxt host with the selected braces, node-forge
-and simple-git targets. A bare core-only library graph does not need these
-backports, and an absent target remains an error rather than a passing check.
+The preset requires an installed Nuxt host with the selected braces and node-forge
+targets. The simple-git compatibility patch applies only when that dependency is
+active. Newer DevTools no longer needs it; absence is not a reason to install an
+unused Git process library. Present targets still require the reviewed fixed
+versions and malformed/escaping graphs fail closed. A bare core-only library
+graph does not need these backports.
 Use an initial install with `--ignore-scripts` before configuring a new host.
 
 Commit the generated `.nuxtjp-security` patches, manifest and lockfile. Run the
@@ -52,3 +55,36 @@ against another process with the same user privileges.
 [LICENSE](LICENSE) and [NOTICE](NOTICE) describe this tool's license. The unchanged
 LICENSE-braces, LICENSE-node-forge and LICENSE-simple-git files retain upstream
 patch-input attribution and redistribution terms.
+
+## Version policy 2
+
+Exact generic fixes and major-scoped fixes have one source in
+`dependency-versions.json`. Undici's maintained major lines and the current
+serialize-javascript and fast-uri majors are pinned separately; configuration never forces an
+unrelated major into the same implementation. Broad/conflicting caller overrides
+fail before mutation. The check walks the active installed graph, accepts optional
+absence only after complete traversal, rejects malformed manifests and rejects
+installed majors without a reviewed rule. An absent package is not proof that its
+implementation passed a vulnerability regression.
+
+The additional upstream fixes address:
+- https://github.com/advisories/GHSA-xjj6-f33q-929c
+- https://github.com/advisories/GHSA-4qv8-2p9j-2685
+- https://github.com/advisories/GHSA-f72v-6w45-q472
+- https://github.com/advisories/GHSA-m5mm-p8h7-m29v
+- https://github.com/advisories/GHSA-w74x-v6f9-j3xg
+- https://github.com/advisories/GHSA-xhq7-xmqj-769h
+- https://github.com/advisories/GHSA-wjr9-j795-jxcr
+- https://github.com/advisories/GHSA-333x-w4r6-6crp
+
+Apply the preset, refresh the lockfile, check the actual installed implementations,
+and run the owning application's type/build/consumer acceptance. Published fixed
+versions do not make Node's bundled HTTP implementation newer; Node security
+updates and registry dependencies remain separate responsibilities.
+
+Configuration writes target a single-project package.json. If a selected root
+already has pnpm-workspace.yaml, the CLI reports an explicit unsupported-workspace
+result before mutation; its owner must project the reviewed rules into that YAML
+rather than create competing configuration in package.json. Graph verification
+still supports an explicitly selected workspace root. No workspace YAML parser or
+second package-manager authority is introduced.

package/apply.mjs

@@ -13,7 +13,9 @@ if (args.length !== 3 || args[0] !== '--project-root' || args[2] !== '--apply')
     applySecurityPatches(args[1], dirname(fileURLToPath(import.meta.url)))
     console.log('Reviewed backports configured. Run pnpm install --no-frozen-lockfile to refresh the lockfile.')
   } catch (error) {
-    console.error('Selected project configuration could not be applied; review manifest and patch conflicts.')
+    console.error(error?.code === 'UNSUPPORTED_WORKSPACE_CONFIGURATION'
+      ? 'Workspace policy requires its owner-native YAML update; no configuration changed.'
+      : 'Selected project configuration could not be applied; review manifest and patch conflicts.')
     process.exitCode = 1
   }
 }

package/dependency-security.check.cjs

@@ -50,19 +50,16 @@ test('RSA verifier accepts standard signatures and rejects extra or malformed Di
 
 test('active dependency graph uses every required upstream security version', () => {
   const policy = JSON.parse(fs.readFileSync(path.join(__dirname, 'dependency-versions.json'), 'utf8'));
-  const { installedDependencies } = require('./resolved-dependency.cjs');
-  for (const [name, version] of Object.entries(policy.overrides)) {
-    const matches = installedDependencies(process.cwd(), name);
-    assert.ok(matches.length > 0, 'Required dependency is absent: ' + name);
-    for (const manifest of matches) assert.equal(JSON.parse(fs.readFileSync(manifest, 'utf8')).version, version, name);
-  }
+  require('./version-policy.cjs').verifyInstalledPolicy(process.cwd(), policy);
 });
 
 // Preserve the ESM entry point expected by current Nuxt devtools without downgrading Git protections.
-test('fixed simple-git retains named and legacy ESM factory exports', async () => {
+test('fixed simple-git retains named and legacy ESM factory exports', async context => {
   const { pathToFileURL } = require('node:url');
   const { installedDependencies } = require('./resolved-dependency.cjs');
-  for (const manifest of installedDependencies(process.cwd(), 'simple-git', '4.0.2')) {
+  const manifests = installedDependencies(process.cwd(), 'simple-git', '4.0.2', { allowMissing: true });
+  if (!manifests.length) { context.skip('No active simple-git: compatibility check is not applicable'); return; }
+  for (const manifest of manifests) {
     const module = await import(pathToFileURL(path.join(path.dirname(manifest), 'dist/index.mjs')).href);
     assert.equal(typeof module.simpleGit, 'function');
     assert.equal(module.default, module.simpleGit);

package/dependency-versions.json

@@ -1,9 +1,14 @@
 {
-  "schemaVersion": 1,
+  "schemaVersion": 2,
   "overrides": {
     "simple-git": "4.0.2",
     "@simple-git/argv-parser": "2.0.1",
-    "esbuild": "0.28.2"
+    "esbuild": "0.28.2",
+    "undici@6": "6.29.1",
+    "undici@7": "7.30.1",
+    "undici@8": "8.12.2",
+    "serialize-javascript@7": "7.1.3",
+    "fast-uri@3": "3.1.9"
   },
   "backportedAdvisories": [
     "GHSA-vfj7-8cjw-p6xm",

package/package.json

@@ -1,13 +1,12 @@
 {
   "name": "@nuxtjp/dependency-security",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "Explicit pnpm backport configuration and active dependency regression checks without Nuxt peers",
   "type": "module",
   "license": "Apache-2.0",
   "engines": {
     "node": ">=22.19.0"
   },
-  "packageManager": "pnpm@10.29.3",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/nuxtjp/nuxtjp-ui.git",
@@ -48,13 +47,20 @@
     "nuxtjp-security-config": "./apply.mjs",
     "nuxtjp-security-check": "./check.mjs"
   },
-  "scripts": {
-    "build": "node --check index.mjs && node --check project.mjs && node --check apply.mjs && node --check check.mjs && node --check resolved-dependency.cjs",
-    "test": "node --test test/*.test.mjs",
-    "typecheck": "tsc --strict --noEmit --module NodeNext --moduleResolution NodeNext --target ES2022 test/public-types.mts"
-  },
   "devDependencies": {
     "typescript": "5.9.3",
     "@types/node": "24.12.0"
+  },
+  "keywords": [
+    "dependency-security",
+    "supply-chain-security",
+    "pnpm",
+    "security",
+    "nuxt"
+  ],
+  "scripts": {
+    "build": "node --check index.mjs && node --check project.mjs && node --check apply.mjs && node --check check.mjs && node --check resolved-dependency.cjs && node --check version-policy.cjs",
+    "test": "node --test test/*.test.mjs",
+    "typecheck": "tsc --strict --noEmit --module NodeNext --moduleResolution NodeNext --target ES2022 test/public-types.mts"
   }
-}
+}

package/project.mjs

@@ -2,6 +2,8 @@
 import { existsSync, lstatSync, readFileSync, mkdirSync, writeFileSync, renameSync, unlinkSync, realpathSync } from 'node:fs'
 import { join, resolve } from 'node:path'
 import { randomUUID } from 'node:crypto'
+import resolver from './resolved-dependency.cjs'
+import versionPolicy from './version-policy.cjs'
 
 const patches = ['braces@3.0.3', 'node-forge@1.4.0', 'simple-git@4.0.2']
 function regular(path) {
@@ -22,6 +24,12 @@ function object(value) {
 /** Reject conflicting patches and links before mutating a project. No network access occurs. */
 export function applySecurityPatches(project, source) {
   const root = realpathSync(resolve(project))
+  if (existsSync(join(root, 'pnpm-workspace.yaml'))) {
+    regular(join(root, 'pnpm-workspace.yaml'))
+    const error = new Error('Use the owner-native workspace configuration; no second manifest policy was written')
+    error.code = 'UNSUPPORTED_WORKSPACE_CONFIGURATION'
+    throw error
+  }
   const manifest = join(root, 'package.json')
   const original = regular(manifest)
   const data = parseJson(original)
@@ -32,24 +40,15 @@ export function applySecurityPatches(project, source) {
   const existing = pnpm.patchedDependencies ?? {}
   if (!object(existing)) throw new Error('Expected object-valued patchedDependencies')
   const pinned = parseJson(regular(join(source, 'dependency-versions.json')))
-  if (pinned.schemaVersion !== 1 || !object(pinned.overrides)) throw new Error('Invalid dependency version policy')
+  const rules = versionPolicy.requirements(pinned)
   const overrides = pnpm.overrides ?? {}
   if (!object(overrides)) throw new Error('Expected object-valued dependency overrides')
-  for (const [name, version] of Object.entries(pinned.overrides)) {
-    if (!/^(?:@[a-z0-9._-]+\/)?[a-z0-9._-]+$/.test(name) || !/^\d+\.\d+\.\d+$/.test(version)) {
-      throw new Error('Exact registry package versions required')
-    }
-    for (const [selector, target] of Object.entries(overrides)) {
-      const dependency = selector.split('>').at(-1)
-      if ((dependency === name || dependency.startsWith(name + '@')) && target !== version) {
-        throw new Error('A dependency override conflicts; review it before applying')
-      }
-    }
-  }
+  versionPolicy.validateOverrides(rules, overrides)
   const dir = join(root, '.nuxtjp-security')
   if (existsSync(dir) && (lstatSync(dir).isSymbolicLink() || !lstatSync(dir).isDirectory())) {
     throw new Error('Security patch directory must be a real directory')
   }
+  const activeSimpleGit = resolver.installedDependencies(root, 'simple-git', undefined, { allowMissing: true }).length > 0
   const inputs = patches.map(name => {
     const relative = `.nuxtjp-security/${name.replace('@', '-')}.patch`
     if (existing[name] !== undefined && existing[name] !== relative) {
@@ -60,11 +59,15 @@ export function applySecurityPatches(project, source) {
     if (existsSync(target) && !regular(target).equals(bytes)) {
       throw new Error('An existing patch differs; no files were overwritten')
     }
-    return { name, relative, bytes, target }
+    return { name, relative, bytes, target, required: name !== 'simple-git@4.0.2' || activeSimpleGit }
   })
   if (!readFileSync(manifest).equals(original)) throw new Error('Manifest changed during preparation')
   mkdirSync(dir, { recursive: true })
   for (const patch of inputs) {
+    if (!patch.required) {
+      delete existing[patch.name]
+      continue
+    }
     if (!existsSync(patch.target)) writeFileSync(patch.target, patch.bytes, { flag: 'wx' })
     existing[patch.name] = patch.relative
   }

package/resolved-dependency.cjs

@@ -3,7 +3,7 @@ const fs = require('node:fs');
 const path = require('node:path');
 const { createRequire } = require('node:module');
 
-function installedDependencies(root, target, version) {
+function installedDependencies(root, target, version, options = {}) {
   root = fs.realpathSync(root);
   const pending = [path.join(root, 'package.json')];
   const seen = new Set();
@@ -25,7 +25,8 @@ function installedDependencies(root, target, version) {
     const names = Object.keys({ ...data.dependencies, ...data.optionalDependencies, ...data.peerDependencies,
       ...(file === path.join(root, 'package.json') ? data.devDependencies : {}) });
     for (const name of names) {
-      for (const location of request.resolve.paths(name) ?? []) {
+      let resolved = false;
+      for (const location of request.resolve.paths(name + '/package.json') ?? []) {
         const candidate = path.join(location, name, 'package.json');
         if (!fs.existsSync(candidate)) continue;
         const real = fs.realpathSync(candidate);
@@ -33,11 +34,16 @@ function installedDependencies(root, target, version) {
           throw new Error('Dependency resolves outside the selected project; select the workspace root');
         }
         pending.push(real);
+        resolved = true;
         break;
       }
+      if (!resolved && Object.hasOwn(data.dependencies ?? {}, name)
+        && !Object.hasOwn(data.optionalDependencies ?? {}, name)) {
+        throw new Error('Incomplete required dependency graph');
+      }
     }
   }
-  if (found.size === 0) throw new Error('Dependency not present in the installed application graph');
+  if (found.size === 0 && options.allowMissing !== true) throw new Error('Dependency not present in the installed application graph');
   return [...found].sort();
 }
 module.exports = { installedDependencies };

package/resolved-dependency.d.cts

@@ -1,2 +1,2 @@
 /** Traverse only the selected installed application graph, with a finite budget. */
-export function installedDependencies(root: string, target: string, version?: string): string[];
+export function installedDependencies(root: string, target: string, version?: string, options?: { allowMissing?: boolean }): string[];

package/version-policy.cjs

@@ -0,0 +1,59 @@
+/** Closed exact-version rules; scoped fixes never coerce an unrelated major. */
+const fs = require('node:fs');
+const { installedDependencies } = require('./resolved-dependency.cjs');
+const packageSelector = /^((?:@[a-z0-9._-]+\/)?[a-z0-9._-]+)(?:@(0|[1-9][0-9]{0,3}))?$/;
+const versionPattern = /^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$/;
+function selection(selector) {
+  const match = packageSelector.exec(selector);
+  if (!match) throw new Error('Unreviewed dependency selector');
+  return { name: match[1], major: match[2] };
+}
+function requirements(policy) {
+  if (!policy || policy.schemaVersion !== 2 || !policy.overrides || Array.isArray(policy.overrides)
+    || typeof policy.overrides !== 'object') throw new Error('Invalid dependency policy');
+  return Object.entries(policy.overrides).map(([selector, version]) => {
+    const rule = selection(selector);
+    if (typeof version !== 'string' || !versionPattern.test(version)
+      || (rule.major !== undefined && rule.major !== version.split('.')[0])) throw new Error('Invalid fixed version');
+    return { ...rule, selector, version };
+  });
+}
+function validateOverrides(rules, overrides) {
+  for (const [selector, target] of Object.entries(overrides)) {
+    const tail = selector.split('>').at(-1);
+    for (const rule of rules) {
+      if (tail !== rule.name && !tail.startsWith(rule.name + '@')) continue;
+      let existing;
+      try { existing = selection(tail); }
+      catch { throw new Error('A dependency override conflicts with the reviewed selector policy'); }
+      if (rule.major !== undefined) {
+        if (existing.major === undefined) throw new Error('A broad dependency override conflicts with major-scoped fixes');
+        if (existing.major !== rule.major) continue;
+      }
+      if (target !== rule.version) throw new Error('A dependency override conflicts; review it before applying');
+    }
+  }
+}
+function checkVersions(policy, observed) {
+  const rules = requirements(policy);
+  for (const [name, versions] of Object.entries(observed)) {
+    const selected = rules.filter(rule => rule.name === name);
+    for (const version of versions) {
+      if (typeof version !== 'string' || !versionPattern.test(version)) throw new Error('Invalid installed version');
+      const applicable = selected.filter(rule => rule.major === undefined || rule.major === version.split('.')[0]);
+      if (applicable.length !== 1 || applicable[0].version !== version) {
+        throw new Error('Installed dependency version is outside the reviewed security policy');
+      }
+    }
+  }
+}
+function verifyInstalledPolicy(root, policy) {
+  const names = new Set(requirements(policy).map(rule => rule.name)), observed = {};
+  for (const name of names) {
+    observed[name] = installedDependencies(root, name, undefined, { allowMissing: true })
+      .map(file => JSON.parse(fs.readFileSync(file, 'utf8')).version);
+  }
+  checkVersions(policy, observed);
+  return observed;
+}
+module.exports = { requirements, validateOverrides, checkVersions, verifyInstalledPolicy };