@nuxtjp/dependency-security 0.2.0 → 0.2.1

package/README.md

@@ -88,3 +88,25 @@ result before mutation; its owner must project the reviewed rules into that YAML
 rather than create competing configuration in package.json. Graph verification
 still supports an explicitly selected workspace root. No workspace YAML parser or
 second package-manager authority is introduced.
+
+### Explicit workspace graph verification
+
+`verifyProject(workspaceRoot, { projects })` checks the aggregate active dependency
+graphs of explicitly selected projects, including each project's development
+dependencies. Supply the actual owner package manager inventory (for example,
+paths returned by `pnpm list -r --depth -1 --json`), including the workspace root
+exactly once. The caller owns inventory completeness; this API does not parse
+workspace YAML or infer that unselected projects were checked. More than 256
+projects, duplicates, missing root, linked manifests, node_modules selections
+and paths outside the workspace are refused. Dependencies shared within the
+workspace are allowed; external resolutions and missing required dependencies
+remain errors. Unreferenced store entries remain excluded.
+
+The configuration CLI still refuses workspace YAML. Its owner updates that native
+policy using the public policy export and reviewed patch assets. Graph inspection
+does not install dependencies, invoke package lifecycles or grant runtime authority.
+
+The reviewed policy retains fast-uri 3.1.9 for 3.x consumers and selects 4.2.3
+for 4.x consumers; it never forces a cross-major SDK update. The 4.x correction
+follows the upstream release: https://github.com/fastify/fast-uri/releases/tag/v4.2.3 .
+A passing policy check is not an exhaustive advisory audit of unrelated packages.

package/checks.mjs

@@ -2,12 +2,17 @@
 import { spawnSync } from 'node:child_process'
 import { fileURLToPath } from 'node:url'
 import { realpathSync } from 'node:fs'
-export function verifyProject(project) {
+import { dirname } from 'node:path'
+import resolver from './resolved-dependency.cjs'
+export function verifyProject(project, options = {}) {
+  const root = realpathSync(project)
+  const projects = resolver.projectManifests(root, options.projects).map(dirname)
   const env = { ...process.env }
   // A parent's node:test context would silently skip a child suite.
-  for (const name of ['NODE_TEST_CONTEXT', 'NODE_OPTIONS', 'NODE_PATH']) delete env[name]
+  for (const name of ['NODE_TEST_CONTEXT', 'NODE_OPTIONS', 'NODE_PATH', 'NUXTJP_SECURITY_PROJECTS']) delete env[name]
+  env.NUXTJP_SECURITY_PROJECTS = JSON.stringify(projects)
   const result = spawnSync(process.execPath,
     ['--test', fileURLToPath(new URL('./dependency-security.check.cjs', import.meta.url))],
-    { cwd: realpathSync(project), env, encoding: 'utf8', timeout: 120000, maxBuffer: 4 * 1024 * 1024 })
+    { cwd: root, env, encoding: 'utf8', timeout: 120000, maxBuffer: 4 * 1024 * 1024 })
   return { exitCode: result.status ?? 2, stdout: result.stdout ?? '', stderr: result.stderr ?? '' }
 }

package/dependency-security.check.cjs

@@ -4,9 +4,11 @@ const { createRequire } = require('node:module');
 const { generateKeyPairSync, sign, privateEncrypt, constants } = require('node:crypto');
 const path = require('node:path');
 const fs = require('node:fs');
+const graphOptions = process.env.NUXTJP_SECURITY_PROJECTS
+  ? { projects: JSON.parse(process.env.NUXTJP_SECURITY_PROJECTS) } : {};
 function dependency(name, version) {
   const { installedDependencies } = require('./resolved-dependency.cjs');
-  const matches = installedDependencies(process.cwd(), name, version);
+  const matches = installedDependencies(process.cwd(), name, version, graphOptions);
   assert.equal(matches.length, 1, 'Expected one active locked dependency implementation');
   return createRequire(matches[0])(name);
 }
@@ -50,14 +52,14 @@ test('RSA verifier accepts standard signatures and rejects extra or malformed Di
 
 test('active dependency graph uses every required upstream security version', () => {
   const policy = JSON.parse(fs.readFileSync(path.join(__dirname, 'dependency-versions.json'), 'utf8'));
-  require('./version-policy.cjs').verifyInstalledPolicy(process.cwd(), policy);
+  require('./version-policy.cjs').verifyInstalledPolicy(process.cwd(), policy, graphOptions);
 });
 
 // Preserve the ESM entry point expected by current Nuxt devtools without downgrading Git protections.
 test('fixed simple-git retains named and legacy ESM factory exports', async context => {
   const { pathToFileURL } = require('node:url');
   const { installedDependencies } = require('./resolved-dependency.cjs');
-  const manifests = installedDependencies(process.cwd(), 'simple-git', '4.0.2', { allowMissing: true });
+  const manifests = installedDependencies(process.cwd(), 'simple-git', '4.0.2', { ...graphOptions, allowMissing: true });
   if (!manifests.length) { context.skip('No active simple-git: compatibility check is not applicable'); return; }
   for (const manifest of manifests) {
     const module = await import(pathToFileURL(path.join(path.dirname(manifest), 'dist/index.mjs')).href);

package/dependency-versions.json

@@ -8,7 +8,8 @@
     "undici@7": "7.30.1",
     "undici@8": "8.12.2",
     "serialize-javascript@7": "7.1.3",
-    "fast-uri@3": "3.1.9"
+    "fast-uri@3": "3.1.9",
+    "fast-uri@4": "4.2.3"
   },
   "backportedAdvisories": [
     "GHSA-vfj7-8cjw-p6xm",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nuxtjp/dependency-security",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "description": "Explicit pnpm backport configuration and active dependency regression checks without Nuxt peers",
   "type": "module",
   "license": "Apache-2.0",

package/resolved-dependency.cjs

@@ -3,9 +3,28 @@ const fs = require('node:fs');
 const path = require('node:path');
 const { createRequire } = require('node:module');
 
+function projectManifests(root, projects = [root]) {
+  root = fs.realpathSync(root);
+  if (!Array.isArray(projects) || projects.length === 0 || projects.length > 256) throw new Error('Invalid selected project inventory');
+  const manifests = projects.map(project => {
+    if (typeof project !== 'string') throw new Error('Invalid selected project');
+    const selected = fs.realpathSync(path.resolve(root, project));
+    const relative = path.relative(root, selected);
+    if (relative === '..' || relative.startsWith('..' + path.sep) || path.isAbsolute(relative)
+      || relative.split(path.sep).includes('node_modules')) throw new Error('Selected project escapes workspace boundary');
+    const manifest = path.join(selected, 'package.json');
+    if (fs.realpathSync(manifest) !== manifest) throw new Error('Linked project manifest refused');
+    return manifest;
+  });
+  if (new Set(manifests).size !== manifests.length || !manifests.includes(path.join(root, 'package.json'))) {
+    throw new Error('Project inventory must include the workspace root exactly once');
+  }
+  return manifests;
+}
 function installedDependencies(root, target, version, options = {}) {
   root = fs.realpathSync(root);
-  const pending = [path.join(root, 'package.json')];
+  const entries = new Set(projectManifests(root, options.projects));
+  const pending = [...entries];
   const seen = new Set();
   const found = new Set();
   while (pending.length) {
@@ -23,7 +42,7 @@ function installedDependencies(root, target, version, options = {}) {
     }
     const request = createRequire(file);
     const names = Object.keys({ ...data.dependencies, ...data.optionalDependencies, ...data.peerDependencies,
-      ...(file === path.join(root, 'package.json') ? data.devDependencies : {}) });
+      ...(entries.has(file) ? data.devDependencies : {}) });
     for (const name of names) {
       let resolved = false;
       for (const location of request.resolve.paths(name + '/package.json') ?? []) {
@@ -37,7 +56,7 @@ function installedDependencies(root, target, version, options = {}) {
         resolved = true;
         break;
       }
-      if (!resolved && Object.hasOwn(data.dependencies ?? {}, name)
+      if (!resolved && Object.hasOwn({ ...data.dependencies, ...(entries.has(file) ? data.devDependencies : {}) }, name)
         && !Object.hasOwn(data.optionalDependencies ?? {}, name)) {
         throw new Error('Incomplete required dependency graph');
       }
@@ -46,4 +65,4 @@ function installedDependencies(root, target, version, options = {}) {
   if (found.size === 0 && options.allowMissing !== true) throw new Error('Dependency not present in the installed application graph');
   return [...found].sort();
 }
-module.exports = { installedDependencies };
+module.exports = { installedDependencies, projectManifests };

package/resolved-dependency.d.cts

@@ -1,2 +1,2 @@
-/** Traverse only the selected installed application graph, with a finite budget. */
-export function installedDependencies(root: string, target: string, version?: string, options?: { allowMissing?: boolean }): string[];
+/** Traverse active graphs within the selected workspace boundary. Projects must include its root once. */
+export function installedDependencies(root: string, target: string, version?: string, options?: { allowMissing?: boolean; projects?: readonly string[] }): string[];

package/types/index.d.mts

@@ -1,6 +1,7 @@
+export interface GraphOptions { projects?: readonly string[] }
 /** Configure reviewed pnpm backports. No installation or network access occurs. */
 export function applySecurityPatches(project: string): void;
 /** Resolve exact active packages; reject external-workspace resolution and missing targets. */
-export function installedDependencies(root: string, target: string, version?: string): string[];
+export function installedDependencies(root: string, target: string, version?: string, options?: GraphOptions & { allowMissing?: boolean }): string[];
 /** Run the known dependency regressions, returning bounded local output and exit status. */
-export function verifyProject(project: string): { exitCode: number; stdout: string; stderr: string };
+export function verifyProject(project: string, options?: GraphOptions): { exitCode: number; stdout: string; stderr: string };

package/version-policy.cjs

@@ -47,10 +47,10 @@ function checkVersions(policy, observed) {
     }
   }
 }
-function verifyInstalledPolicy(root, policy) {
+function verifyInstalledPolicy(root, policy, options = {}) {
   const names = new Set(requirements(policy).map(rule => rule.name)), observed = {};
   for (const name of names) {
-    observed[name] = installedDependencies(root, name, undefined, { allowMissing: true })
+    observed[name] = installedDependencies(root, name, undefined, { ...options, allowMissing: true })
       .map(file => JSON.parse(fs.readFileSync(file, 'utf8')).version);
   }
   checkVersions(policy, observed);