@nuxtjp/dependency-security 0.1.2 → 0.2.0

package/README.md

@@ -55,3 +55,36 @@ against another process with the same user privileges.
 [LICENSE](LICENSE) and [NOTICE](NOTICE) describe this tool's license. The unchanged
 LICENSE-braces, LICENSE-node-forge and LICENSE-simple-git files retain upstream
 patch-input attribution and redistribution terms.
+
+## Version policy 2
+
+Exact generic fixes and major-scoped fixes have one source in
+`dependency-versions.json`. Undici's maintained major lines and the current
+serialize-javascript and fast-uri majors are pinned separately; configuration never forces an
+unrelated major into the same implementation. Broad/conflicting caller overrides
+fail before mutation. The check walks the active installed graph, accepts optional
+absence only after complete traversal, rejects malformed manifests and rejects
+installed majors without a reviewed rule. An absent package is not proof that its
+implementation passed a vulnerability regression.
+
+The additional upstream fixes address:
+- https://github.com/advisories/GHSA-xjj6-f33q-929c
+- https://github.com/advisories/GHSA-4qv8-2p9j-2685
+- https://github.com/advisories/GHSA-f72v-6w45-q472
+- https://github.com/advisories/GHSA-m5mm-p8h7-m29v
+- https://github.com/advisories/GHSA-w74x-v6f9-j3xg
+- https://github.com/advisories/GHSA-xhq7-xmqj-769h
+- https://github.com/advisories/GHSA-wjr9-j795-jxcr
+- https://github.com/advisories/GHSA-333x-w4r6-6crp
+
+Apply the preset, refresh the lockfile, check the actual installed implementations,
+and run the owning application's type/build/consumer acceptance. Published fixed
+versions do not make Node's bundled HTTP implementation newer; Node security
+updates and registry dependencies remain separate responsibilities.
+
+Configuration writes target a single-project package.json. If a selected root
+already has pnpm-workspace.yaml, the CLI reports an explicit unsupported-workspace
+result before mutation; its owner must project the reviewed rules into that YAML
+rather than create competing configuration in package.json. Graph verification
+still supports an explicitly selected workspace root. No workspace YAML parser or
+second package-manager authority is introduced.

package/apply.mjs

@@ -13,7 +13,9 @@ if (args.length !== 3 || args[0] !== '--project-root' || args[2] !== '--apply')
     applySecurityPatches(args[1], dirname(fileURLToPath(import.meta.url)))
     console.log('Reviewed backports configured. Run pnpm install --no-frozen-lockfile to refresh the lockfile.')
   } catch (error) {
-    console.error('Selected project configuration could not be applied; review manifest and patch conflicts.')
+    console.error(error?.code === 'UNSUPPORTED_WORKSPACE_CONFIGURATION'
+      ? 'Workspace policy requires its owner-native YAML update; no configuration changed.'
+      : 'Selected project configuration could not be applied; review manifest and patch conflicts.')
     process.exitCode = 1
   }
 }

package/dependency-security.check.cjs

@@ -50,18 +50,16 @@ test('RSA verifier accepts standard signatures and rejects extra or malformed Di
 
 test('active dependency graph uses every required upstream security version', () => {
   const policy = JSON.parse(fs.readFileSync(path.join(__dirname, 'dependency-versions.json'), 'utf8'));
-  const { installedDependencies } = require('./resolved-dependency.cjs');
-  for (const [name, version] of Object.entries(policy.overrides)) {
-    const matches = installedDependencies(process.cwd(), name, undefined, { allowMissing: true });
-    for (const manifest of matches) assert.equal(JSON.parse(fs.readFileSync(manifest, 'utf8')).version, version, name);
-  }
+  require('./version-policy.cjs').verifyInstalledPolicy(process.cwd(), policy);
 });
 
 // Preserve the ESM entry point expected by current Nuxt devtools without downgrading Git protections.
-test('fixed simple-git retains named and legacy ESM factory exports', async () => {
+test('fixed simple-git retains named and legacy ESM factory exports', async context => {
   const { pathToFileURL } = require('node:url');
   const { installedDependencies } = require('./resolved-dependency.cjs');
-  for (const manifest of installedDependencies(process.cwd(), 'simple-git', '4.0.2', { allowMissing: true })) {
+  const manifests = installedDependencies(process.cwd(), 'simple-git', '4.0.2', { allowMissing: true });
+  if (!manifests.length) { context.skip('No active simple-git: compatibility check is not applicable'); return; }
+  for (const manifest of manifests) {
     const module = await import(pathToFileURL(path.join(path.dirname(manifest), 'dist/index.mjs')).href);
     assert.equal(typeof module.simpleGit, 'function');
     assert.equal(module.default, module.simpleGit);

package/dependency-versions.json

@@ -1,9 +1,14 @@
 {
-  "schemaVersion": 1,
+  "schemaVersion": 2,
   "overrides": {
     "simple-git": "4.0.2",
     "@simple-git/argv-parser": "2.0.1",
-    "esbuild": "0.28.2"
+    "esbuild": "0.28.2",
+    "undici@6": "6.29.1",
+    "undici@7": "7.30.1",
+    "undici@8": "8.12.2",
+    "serialize-javascript@7": "7.1.3",
+    "fast-uri@3": "3.1.9"
   },
   "backportedAdvisories": [
     "GHSA-vfj7-8cjw-p6xm",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nuxtjp/dependency-security",
-  "version": "0.1.2",
+  "version": "0.2.0",
   "description": "Explicit pnpm backport configuration and active dependency regression checks without Nuxt peers",
   "type": "module",
   "license": "Apache-2.0",
@@ -59,7 +59,7 @@
     "nuxt"
   ],
   "scripts": {
-    "build": "node --check index.mjs && node --check project.mjs && node --check apply.mjs && node --check check.mjs && node --check resolved-dependency.cjs",
+    "build": "node --check index.mjs && node --check project.mjs && node --check apply.mjs && node --check check.mjs && node --check resolved-dependency.cjs && node --check version-policy.cjs",
     "test": "node --test test/*.test.mjs",
     "typecheck": "tsc --strict --noEmit --module NodeNext --moduleResolution NodeNext --target ES2022 test/public-types.mts"
   }

package/project.mjs

@@ -3,6 +3,7 @@ import { existsSync, lstatSync, readFileSync, mkdirSync, writeFileSync, renameSy
 import { join, resolve } from 'node:path'
 import { randomUUID } from 'node:crypto'
 import resolver from './resolved-dependency.cjs'
+import versionPolicy from './version-policy.cjs'
 
 const patches = ['braces@3.0.3', 'node-forge@1.4.0', 'simple-git@4.0.2']
 function regular(path) {
@@ -23,6 +24,12 @@ function object(value) {
 /** Reject conflicting patches and links before mutating a project. No network access occurs. */
 export function applySecurityPatches(project, source) {
   const root = realpathSync(resolve(project))
+  if (existsSync(join(root, 'pnpm-workspace.yaml'))) {
+    regular(join(root, 'pnpm-workspace.yaml'))
+    const error = new Error('Use the owner-native workspace configuration; no second manifest policy was written')
+    error.code = 'UNSUPPORTED_WORKSPACE_CONFIGURATION'
+    throw error
+  }
   const manifest = join(root, 'package.json')
   const original = regular(manifest)
   const data = parseJson(original)
@@ -33,20 +40,10 @@ export function applySecurityPatches(project, source) {
   const existing = pnpm.patchedDependencies ?? {}
   if (!object(existing)) throw new Error('Expected object-valued patchedDependencies')
   const pinned = parseJson(regular(join(source, 'dependency-versions.json')))
-  if (pinned.schemaVersion !== 1 || !object(pinned.overrides)) throw new Error('Invalid dependency version policy')
+  const rules = versionPolicy.requirements(pinned)
   const overrides = pnpm.overrides ?? {}
   if (!object(overrides)) throw new Error('Expected object-valued dependency overrides')
-  for (const [name, version] of Object.entries(pinned.overrides)) {
-    if (!/^(?:@[a-z0-9._-]+\/)?[a-z0-9._-]+$/.test(name) || !/^\d+\.\d+\.\d+$/.test(version)) {
-      throw new Error('Exact registry package versions required')
-    }
-    for (const [selector, target] of Object.entries(overrides)) {
-      const dependency = selector.split('>').at(-1)
-      if ((dependency === name || dependency.startsWith(name + '@')) && target !== version) {
-        throw new Error('A dependency override conflicts; review it before applying')
-      }
-    }
-  }
+  versionPolicy.validateOverrides(rules, overrides)
   const dir = join(root, '.nuxtjp-security')
   if (existsSync(dir) && (lstatSync(dir).isSymbolicLink() || !lstatSync(dir).isDirectory())) {
     throw new Error('Security patch directory must be a real directory')

package/resolved-dependency.cjs

@@ -25,7 +25,8 @@ function installedDependencies(root, target, version, options = {}) {
     const names = Object.keys({ ...data.dependencies, ...data.optionalDependencies, ...data.peerDependencies,
       ...(file === path.join(root, 'package.json') ? data.devDependencies : {}) });
     for (const name of names) {
-      for (const location of request.resolve.paths(name) ?? []) {
+      let resolved = false;
+      for (const location of request.resolve.paths(name + '/package.json') ?? []) {
         const candidate = path.join(location, name, 'package.json');
         if (!fs.existsSync(candidate)) continue;
         const real = fs.realpathSync(candidate);
@@ -33,8 +34,13 @@ function installedDependencies(root, target, version, options = {}) {
           throw new Error('Dependency resolves outside the selected project; select the workspace root');
         }
         pending.push(real);
+        resolved = true;
         break;
       }
+      if (!resolved && Object.hasOwn(data.dependencies ?? {}, name)
+        && !Object.hasOwn(data.optionalDependencies ?? {}, name)) {
+        throw new Error('Incomplete required dependency graph');
+      }
     }
   }
   if (found.size === 0 && options.allowMissing !== true) throw new Error('Dependency not present in the installed application graph');

package/version-policy.cjs

@@ -0,0 +1,59 @@
+/** Closed exact-version rules; scoped fixes never coerce an unrelated major. */
+const fs = require('node:fs');
+const { installedDependencies } = require('./resolved-dependency.cjs');
+const packageSelector = /^((?:@[a-z0-9._-]+\/)?[a-z0-9._-]+)(?:@(0|[1-9][0-9]{0,3}))?$/;
+const versionPattern = /^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$/;
+function selection(selector) {
+  const match = packageSelector.exec(selector);
+  if (!match) throw new Error('Unreviewed dependency selector');
+  return { name: match[1], major: match[2] };
+}
+function requirements(policy) {
+  if (!policy || policy.schemaVersion !== 2 || !policy.overrides || Array.isArray(policy.overrides)
+    || typeof policy.overrides !== 'object') throw new Error('Invalid dependency policy');
+  return Object.entries(policy.overrides).map(([selector, version]) => {
+    const rule = selection(selector);
+    if (typeof version !== 'string' || !versionPattern.test(version)
+      || (rule.major !== undefined && rule.major !== version.split('.')[0])) throw new Error('Invalid fixed version');
+    return { ...rule, selector, version };
+  });
+}
+function validateOverrides(rules, overrides) {
+  for (const [selector, target] of Object.entries(overrides)) {
+    const tail = selector.split('>').at(-1);
+    for (const rule of rules) {
+      if (tail !== rule.name && !tail.startsWith(rule.name + '@')) continue;
+      let existing;
+      try { existing = selection(tail); }
+      catch { throw new Error('A dependency override conflicts with the reviewed selector policy'); }
+      if (rule.major !== undefined) {
+        if (existing.major === undefined) throw new Error('A broad dependency override conflicts with major-scoped fixes');
+        if (existing.major !== rule.major) continue;
+      }
+      if (target !== rule.version) throw new Error('A dependency override conflicts; review it before applying');
+    }
+  }
+}
+function checkVersions(policy, observed) {
+  const rules = requirements(policy);
+  for (const [name, versions] of Object.entries(observed)) {
+    const selected = rules.filter(rule => rule.name === name);
+    for (const version of versions) {
+      if (typeof version !== 'string' || !versionPattern.test(version)) throw new Error('Invalid installed version');
+      const applicable = selected.filter(rule => rule.major === undefined || rule.major === version.split('.')[0]);
+      if (applicable.length !== 1 || applicable[0].version !== version) {
+        throw new Error('Installed dependency version is outside the reviewed security policy');
+      }
+    }
+  }
+}
+function verifyInstalledPolicy(root, policy) {
+  const names = new Set(requirements(policy).map(rule => rule.name)), observed = {};
+  for (const name of names) {
+    observed[name] = installedDependencies(root, name, undefined, { allowMissing: true })
+      .map(file => JSON.parse(fs.readFileSync(file, 'utf8')).version);
+  }
+  checkVersions(policy, observed);
+  return observed;
+}
+module.exports = { requirements, validateOverrides, checkVersions, verifyInstalledPolicy };