@nuxtjp/dependency-security 0.1.2 → 0.2.1

package/README.md

@@ -55,3 +55,58 @@ against another process with the same user privileges.
 [LICENSE](LICENSE) and [NOTICE](NOTICE) describe this tool's license. The unchanged
 LICENSE-braces, LICENSE-node-forge and LICENSE-simple-git files retain upstream
 patch-input attribution and redistribution terms.
+
+## Version policy 2
+
+Exact generic fixes and major-scoped fixes have one source in
+`dependency-versions.json`. Undici's maintained major lines and the current
+serialize-javascript and fast-uri majors are pinned separately; configuration never forces an
+unrelated major into the same implementation. Broad/conflicting caller overrides
+fail before mutation. The check walks the active installed graph, accepts optional
+absence only after complete traversal, rejects malformed manifests and rejects
+installed majors without a reviewed rule. An absent package is not proof that its
+implementation passed a vulnerability regression.
+
+The additional upstream fixes address:
+- https://github.com/advisories/GHSA-xjj6-f33q-929c
+- https://github.com/advisories/GHSA-4qv8-2p9j-2685
+- https://github.com/advisories/GHSA-f72v-6w45-q472
+- https://github.com/advisories/GHSA-m5mm-p8h7-m29v
+- https://github.com/advisories/GHSA-w74x-v6f9-j3xg
+- https://github.com/advisories/GHSA-xhq7-xmqj-769h
+- https://github.com/advisories/GHSA-wjr9-j795-jxcr
+- https://github.com/advisories/GHSA-333x-w4r6-6crp
+
+Apply the preset, refresh the lockfile, check the actual installed implementations,
+and run the owning application's type/build/consumer acceptance. Published fixed
+versions do not make Node's bundled HTTP implementation newer; Node security
+updates and registry dependencies remain separate responsibilities.
+
+Configuration writes target a single-project package.json. If a selected root
+already has pnpm-workspace.yaml, the CLI reports an explicit unsupported-workspace
+result before mutation; its owner must project the reviewed rules into that YAML
+rather than create competing configuration in package.json. Graph verification
+still supports an explicitly selected workspace root. No workspace YAML parser or
+second package-manager authority is introduced.
+
+### Explicit workspace graph verification
+
+`verifyProject(workspaceRoot, { projects })` checks the aggregate active dependency
+graphs of explicitly selected projects, including each project's development
+dependencies. Supply the actual owner package manager inventory (for example,
+paths returned by `pnpm list -r --depth -1 --json`), including the workspace root
+exactly once. The caller owns inventory completeness; this API does not parse
+workspace YAML or infer that unselected projects were checked. More than 256
+projects, duplicates, missing root, linked manifests, node_modules selections
+and paths outside the workspace are refused. Dependencies shared within the
+workspace are allowed; external resolutions and missing required dependencies
+remain errors. Unreferenced store entries remain excluded.
+
+The configuration CLI still refuses workspace YAML. Its owner updates that native
+policy using the public policy export and reviewed patch assets. Graph inspection
+does not install dependencies, invoke package lifecycles or grant runtime authority.
+
+The reviewed policy retains fast-uri 3.1.9 for 3.x consumers and selects 4.2.3
+for 4.x consumers; it never forces a cross-major SDK update. The 4.x correction
+follows the upstream release: https://github.com/fastify/fast-uri/releases/tag/v4.2.3 .
+A passing policy check is not an exhaustive advisory audit of unrelated packages.

package/apply.mjs

@@ -13,7 +13,9 @@ if (args.length !== 3 || args[0] !== '--project-root' || args[2] !== '--apply')
     applySecurityPatches(args[1], dirname(fileURLToPath(import.meta.url)))
     console.log('Reviewed backports configured. Run pnpm install --no-frozen-lockfile to refresh the lockfile.')
   } catch (error) {
-    console.error('Selected project configuration could not be applied; review manifest and patch conflicts.')
+    console.error(error?.code === 'UNSUPPORTED_WORKSPACE_CONFIGURATION'
+      ? 'Workspace policy requires its owner-native YAML update; no configuration changed.'
+      : 'Selected project configuration could not be applied; review manifest and patch conflicts.')
     process.exitCode = 1
   }
 }

package/checks.mjs

@@ -2,12 +2,17 @@
 import { spawnSync } from 'node:child_process'
 import { fileURLToPath } from 'node:url'
 import { realpathSync } from 'node:fs'
-export function verifyProject(project) {
+import { dirname } from 'node:path'
+import resolver from './resolved-dependency.cjs'
+export function verifyProject(project, options = {}) {
+  const root = realpathSync(project)
+  const projects = resolver.projectManifests(root, options.projects).map(dirname)
   const env = { ...process.env }
   // A parent's node:test context would silently skip a child suite.
-  for (const name of ['NODE_TEST_CONTEXT', 'NODE_OPTIONS', 'NODE_PATH']) delete env[name]
+  for (const name of ['NODE_TEST_CONTEXT', 'NODE_OPTIONS', 'NODE_PATH', 'NUXTJP_SECURITY_PROJECTS']) delete env[name]
+  env.NUXTJP_SECURITY_PROJECTS = JSON.stringify(projects)
   const result = spawnSync(process.execPath,
     ['--test', fileURLToPath(new URL('./dependency-security.check.cjs', import.meta.url))],
-    { cwd: realpathSync(project), env, encoding: 'utf8', timeout: 120000, maxBuffer: 4 * 1024 * 1024 })
+    { cwd: root, env, encoding: 'utf8', timeout: 120000, maxBuffer: 4 * 1024 * 1024 })
   return { exitCode: result.status ?? 2, stdout: result.stdout ?? '', stderr: result.stderr ?? '' }
 }

package/dependency-security.check.cjs

@@ -4,9 +4,11 @@ const { createRequire } = require('node:module');
 const { generateKeyPairSync, sign, privateEncrypt, constants } = require('node:crypto');
 const path = require('node:path');
 const fs = require('node:fs');
+const graphOptions = process.env.NUXTJP_SECURITY_PROJECTS
+  ? { projects: JSON.parse(process.env.NUXTJP_SECURITY_PROJECTS) } : {};
 function dependency(name, version) {
   const { installedDependencies } = require('./resolved-dependency.cjs');
-  const matches = installedDependencies(process.cwd(), name, version);
+  const matches = installedDependencies(process.cwd(), name, version, graphOptions);
   assert.equal(matches.length, 1, 'Expected one active locked dependency implementation');
   return createRequire(matches[0])(name);
 }
@@ -50,18 +52,16 @@ test('RSA verifier accepts standard signatures and rejects extra or malformed Di
 
 test('active dependency graph uses every required upstream security version', () => {
   const policy = JSON.parse(fs.readFileSync(path.join(__dirname, 'dependency-versions.json'), 'utf8'));
-  const { installedDependencies } = require('./resolved-dependency.cjs');
-  for (const [name, version] of Object.entries(policy.overrides)) {
-    const matches = installedDependencies(process.cwd(), name, undefined, { allowMissing: true });
-    for (const manifest of matches) assert.equal(JSON.parse(fs.readFileSync(manifest, 'utf8')).version, version, name);
-  }
+  require('./version-policy.cjs').verifyInstalledPolicy(process.cwd(), policy, graphOptions);
 });
 
 // Preserve the ESM entry point expected by current Nuxt devtools without downgrading Git protections.
-test('fixed simple-git retains named and legacy ESM factory exports', async () => {
+test('fixed simple-git retains named and legacy ESM factory exports', async context => {
   const { pathToFileURL } = require('node:url');
   const { installedDependencies } = require('./resolved-dependency.cjs');
-  for (const manifest of installedDependencies(process.cwd(), 'simple-git', '4.0.2', { allowMissing: true })) {
+  const manifests = installedDependencies(process.cwd(), 'simple-git', '4.0.2', { ...graphOptions, allowMissing: true });
+  if (!manifests.length) { context.skip('No active simple-git: compatibility check is not applicable'); return; }
+  for (const manifest of manifests) {
     const module = await import(pathToFileURL(path.join(path.dirname(manifest), 'dist/index.mjs')).href);
     assert.equal(typeof module.simpleGit, 'function');
     assert.equal(module.default, module.simpleGit);

package/dependency-versions.json

@@ -1,9 +1,15 @@
 {
-  "schemaVersion": 1,
+  "schemaVersion": 2,
   "overrides": {
     "simple-git": "4.0.2",
     "@simple-git/argv-parser": "2.0.1",
-    "esbuild": "0.28.2"
+    "esbuild": "0.28.2",
+    "undici@6": "6.29.1",
+    "undici@7": "7.30.1",
+    "undici@8": "8.12.2",
+    "serialize-javascript@7": "7.1.3",
+    "fast-uri@3": "3.1.9",
+    "fast-uri@4": "4.2.3"
   },
   "backportedAdvisories": [
     "GHSA-vfj7-8cjw-p6xm",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nuxtjp/dependency-security",
-  "version": "0.1.2",
+  "version": "0.2.1",
   "description": "Explicit pnpm backport configuration and active dependency regression checks without Nuxt peers",
   "type": "module",
   "license": "Apache-2.0",
@@ -59,7 +59,7 @@
     "nuxt"
   ],
   "scripts": {
-    "build": "node --check index.mjs && node --check project.mjs && node --check apply.mjs && node --check check.mjs && node --check resolved-dependency.cjs",
+    "build": "node --check index.mjs && node --check project.mjs && node --check apply.mjs && node --check check.mjs && node --check resolved-dependency.cjs && node --check version-policy.cjs",
     "test": "node --test test/*.test.mjs",
     "typecheck": "tsc --strict --noEmit --module NodeNext --moduleResolution NodeNext --target ES2022 test/public-types.mts"
   }

package/project.mjs

@@ -3,6 +3,7 @@ import { existsSync, lstatSync, readFileSync, mkdirSync, writeFileSync, renameSy
 import { join, resolve } from 'node:path'
 import { randomUUID } from 'node:crypto'
 import resolver from './resolved-dependency.cjs'
+import versionPolicy from './version-policy.cjs'
 
 const patches = ['braces@3.0.3', 'node-forge@1.4.0', 'simple-git@4.0.2']
 function regular(path) {
@@ -23,6 +24,12 @@ function object(value) {
 /** Reject conflicting patches and links before mutating a project. No network access occurs. */
 export function applySecurityPatches(project, source) {
   const root = realpathSync(resolve(project))
+  if (existsSync(join(root, 'pnpm-workspace.yaml'))) {
+    regular(join(root, 'pnpm-workspace.yaml'))
+    const error = new Error('Use the owner-native workspace configuration; no second manifest policy was written')
+    error.code = 'UNSUPPORTED_WORKSPACE_CONFIGURATION'
+    throw error
+  }
   const manifest = join(root, 'package.json')
   const original = regular(manifest)
   const data = parseJson(original)
@@ -33,20 +40,10 @@ export function applySecurityPatches(project, source) {
   const existing = pnpm.patchedDependencies ?? {}
   if (!object(existing)) throw new Error('Expected object-valued patchedDependencies')
   const pinned = parseJson(regular(join(source, 'dependency-versions.json')))
-  if (pinned.schemaVersion !== 1 || !object(pinned.overrides)) throw new Error('Invalid dependency version policy')
+  const rules = versionPolicy.requirements(pinned)
   const overrides = pnpm.overrides ?? {}
   if (!object(overrides)) throw new Error('Expected object-valued dependency overrides')
-  for (const [name, version] of Object.entries(pinned.overrides)) {
-    if (!/^(?:@[a-z0-9._-]+\/)?[a-z0-9._-]+$/.test(name) || !/^\d+\.\d+\.\d+$/.test(version)) {
-      throw new Error('Exact registry package versions required')
-    }
-    for (const [selector, target] of Object.entries(overrides)) {
-      const dependency = selector.split('>').at(-1)
-      if ((dependency === name || dependency.startsWith(name + '@')) && target !== version) {
-        throw new Error('A dependency override conflicts; review it before applying')
-      }
-    }
-  }
+  versionPolicy.validateOverrides(rules, overrides)
   const dir = join(root, '.nuxtjp-security')
   if (existsSync(dir) && (lstatSync(dir).isSymbolicLink() || !lstatSync(dir).isDirectory())) {
     throw new Error('Security patch directory must be a real directory')

package/resolved-dependency.cjs

@@ -3,9 +3,28 @@ const fs = require('node:fs');
 const path = require('node:path');
 const { createRequire } = require('node:module');
 
+function projectManifests(root, projects = [root]) {
+  root = fs.realpathSync(root);
+  if (!Array.isArray(projects) || projects.length === 0 || projects.length > 256) throw new Error('Invalid selected project inventory');
+  const manifests = projects.map(project => {
+    if (typeof project !== 'string') throw new Error('Invalid selected project');
+    const selected = fs.realpathSync(path.resolve(root, project));
+    const relative = path.relative(root, selected);
+    if (relative === '..' || relative.startsWith('..' + path.sep) || path.isAbsolute(relative)
+      || relative.split(path.sep).includes('node_modules')) throw new Error('Selected project escapes workspace boundary');
+    const manifest = path.join(selected, 'package.json');
+    if (fs.realpathSync(manifest) !== manifest) throw new Error('Linked project manifest refused');
+    return manifest;
+  });
+  if (new Set(manifests).size !== manifests.length || !manifests.includes(path.join(root, 'package.json'))) {
+    throw new Error('Project inventory must include the workspace root exactly once');
+  }
+  return manifests;
+}
 function installedDependencies(root, target, version, options = {}) {
   root = fs.realpathSync(root);
-  const pending = [path.join(root, 'package.json')];
+  const entries = new Set(projectManifests(root, options.projects));
+  const pending = [...entries];
   const seen = new Set();
   const found = new Set();
   while (pending.length) {
@@ -23,9 +42,10 @@ function installedDependencies(root, target, version, options = {}) {
     }
     const request = createRequire(file);
     const names = Object.keys({ ...data.dependencies, ...data.optionalDependencies, ...data.peerDependencies,
-      ...(file === path.join(root, 'package.json') ? data.devDependencies : {}) });
+      ...(entries.has(file) ? data.devDependencies : {}) });
     for (const name of names) {
-      for (const location of request.resolve.paths(name) ?? []) {
+      let resolved = false;
+      for (const location of request.resolve.paths(name + '/package.json') ?? []) {
         const candidate = path.join(location, name, 'package.json');
         if (!fs.existsSync(candidate)) continue;
         const real = fs.realpathSync(candidate);
@@ -33,11 +53,16 @@ function installedDependencies(root, target, version, options = {}) {
           throw new Error('Dependency resolves outside the selected project; select the workspace root');
         }
         pending.push(real);
+        resolved = true;
         break;
       }
+      if (!resolved && Object.hasOwn({ ...data.dependencies, ...(entries.has(file) ? data.devDependencies : {}) }, name)
+        && !Object.hasOwn(data.optionalDependencies ?? {}, name)) {
+        throw new Error('Incomplete required dependency graph');
+      }
     }
   }
   if (found.size === 0 && options.allowMissing !== true) throw new Error('Dependency not present in the installed application graph');
   return [...found].sort();
 }
-module.exports = { installedDependencies };
+module.exports = { installedDependencies, projectManifests };

package/resolved-dependency.d.cts

@@ -1,2 +1,2 @@
-/** Traverse only the selected installed application graph, with a finite budget. */
-export function installedDependencies(root: string, target: string, version?: string, options?: { allowMissing?: boolean }): string[];
+/** Traverse active graphs within the selected workspace boundary. Projects must include its root once. */
+export function installedDependencies(root: string, target: string, version?: string, options?: { allowMissing?: boolean; projects?: readonly string[] }): string[];

package/types/index.d.mts

@@ -1,6 +1,7 @@
+export interface GraphOptions { projects?: readonly string[] }
 /** Configure reviewed pnpm backports. No installation or network access occurs. */
 export function applySecurityPatches(project: string): void;
 /** Resolve exact active packages; reject external-workspace resolution and missing targets. */
-export function installedDependencies(root: string, target: string, version?: string): string[];
+export function installedDependencies(root: string, target: string, version?: string, options?: GraphOptions & { allowMissing?: boolean }): string[];
 /** Run the known dependency regressions, returning bounded local output and exit status. */
-export function verifyProject(project: string): { exitCode: number; stdout: string; stderr: string };
+export function verifyProject(project: string, options?: GraphOptions): { exitCode: number; stdout: string; stderr: string };

package/version-policy.cjs

@@ -0,0 +1,59 @@
+/** Closed exact-version rules; scoped fixes never coerce an unrelated major. */
+const fs = require('node:fs');
+const { installedDependencies } = require('./resolved-dependency.cjs');
+const packageSelector = /^((?:@[a-z0-9._-]+\/)?[a-z0-9._-]+)(?:@(0|[1-9][0-9]{0,3}))?$/;
+const versionPattern = /^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$/;
+function selection(selector) {
+  const match = packageSelector.exec(selector);
+  if (!match) throw new Error('Unreviewed dependency selector');
+  return { name: match[1], major: match[2] };
+}
+function requirements(policy) {
+  if (!policy || policy.schemaVersion !== 2 || !policy.overrides || Array.isArray(policy.overrides)
+    || typeof policy.overrides !== 'object') throw new Error('Invalid dependency policy');
+  return Object.entries(policy.overrides).map(([selector, version]) => {
+    const rule = selection(selector);
+    if (typeof version !== 'string' || !versionPattern.test(version)
+      || (rule.major !== undefined && rule.major !== version.split('.')[0])) throw new Error('Invalid fixed version');
+    return { ...rule, selector, version };
+  });
+}
+function validateOverrides(rules, overrides) {
+  for (const [selector, target] of Object.entries(overrides)) {
+    const tail = selector.split('>').at(-1);
+    for (const rule of rules) {
+      if (tail !== rule.name && !tail.startsWith(rule.name + '@')) continue;
+      let existing;
+      try { existing = selection(tail); }
+      catch { throw new Error('A dependency override conflicts with the reviewed selector policy'); }
+      if (rule.major !== undefined) {
+        if (existing.major === undefined) throw new Error('A broad dependency override conflicts with major-scoped fixes');
+        if (existing.major !== rule.major) continue;
+      }
+      if (target !== rule.version) throw new Error('A dependency override conflicts; review it before applying');
+    }
+  }
+}
+function checkVersions(policy, observed) {
+  const rules = requirements(policy);
+  for (const [name, versions] of Object.entries(observed)) {
+    const selected = rules.filter(rule => rule.name === name);
+    for (const version of versions) {
+      if (typeof version !== 'string' || !versionPattern.test(version)) throw new Error('Invalid installed version');
+      const applicable = selected.filter(rule => rule.major === undefined || rule.major === version.split('.')[0]);
+      if (applicable.length !== 1 || applicable[0].version !== version) {
+        throw new Error('Installed dependency version is outside the reviewed security policy');
+      }
+    }
+  }
+}
+function verifyInstalledPolicy(root, policy, options = {}) {
+  const names = new Set(requirements(policy).map(rule => rule.name)), observed = {};
+  for (const name of names) {
+    observed[name] = installedDependencies(root, name, undefined, { ...options, allowMissing: true })
+      .map(file => JSON.parse(fs.readFileSync(file, 'utf8')).version);
+  }
+  checkVersions(policy, observed);
+  return observed;
+}
+module.exports = { requirements, validateOverrides, checkVersions, verifyInstalledPolicy };