@nuxtjp/dependency-security 0.2.0 → 0.2.2

package/LICENSE-deepmerge

@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright (c) 2012 James Halliday, Josh Duff, and other contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.

package/NOTICE

@@ -1,4 +1,6 @@
 NuxtJP dependency-security
 Apache-2.0 applies to the configuration and verification tool.
 Third-party patch inputs retain the included LICENSE-braces, LICENSE-node-forge
-and LICENSE-simple-git notices; these do not relicense the upstream packages.
+LICENSE-simple-git and LICENSE-deepmerge notices; these do not relicense the upstream packages.
+The deepmerge 4.3.1 backport rejects prototype-sensitive keys in both inputs;
+see https://github.com/TehShrike/deepmerge/issues/273 and CVE-2026-93753.

package/README.md

@@ -15,10 +15,10 @@ pnpm exec nuxtjp-security-check --project-root .
 pnpm audit --json
 ```
 
-The preset requires an installed Nuxt host with the selected braces and node-forge
-targets. The simple-git compatibility patch applies only when that dependency is
-active. Newer DevTools no longer needs it; absence is not a reason to install an
-unused Git process library. Present targets still require the reviewed fixed
+The preset requires an installed Nuxt host with the selected braces target. The
+node-forge and simple-git patches apply only when their exact reviewed targets are
+active. Node-forge 1.4.2 uses its upstream implementation and is checked by the
+same RSA regressions; 1.4.0 still needs the backport. Absence is not a reason to install an unused package. Present targets still require the reviewed fixed
 versions and malformed/escaping graphs fail closed. A bare core-only library
 graph does not need these backports.
 Use an initial install with `--ignore-scripts` before configuring a new host.
@@ -26,12 +26,21 @@ Use an initial install with `--ignore-scripts` before configuring a new host.
 Commit the generated `.nuxtjp-security` patches, manifest and lockfile. Run the
 check after every locked install. Configuration refuses conflicting patches,
 symlink storage and concurrent manifest changes; unrelated settings are retained.
-The check loads the explicitly installed braces/node-forge implementations and
-exercises bounded recursion and malformed RSA signature cases. It creates a
+The check loads the explicitly installed braces implementation and, when present,
+node-forge, and exercises bounded recursion and malformed RSA signature cases. It creates a
 never-issued ephemeral test key in memory and never reads an account key.
 
-Two upstream advisories currently have no fixed registry version:
-GHSA-vfj7-8cjw-p6xm (braces 3.0.3) and GHSA-86w9-cpqp-85rv (node-forge 1.4.0).
+When deepmerge 4.3.1 is present, the reviewed backport rejects `__proto__`,
+`constructor`, and `prototype` keys in both merge inputs. This deliberately
+excludes those keys from merged output. Regression tests check both distributed
+entry points against poisoned prototypes and ordinary nested and array merges.
+The reported issue and proposed remediation are documented at
+https://github.com/TehShrike/deepmerge/issues/273. The patch is omitted when
+deepmerge is absent, and a different installed version requires review.
+
+The following upstream advisories have no recorded fixed registry version:
+GHSA-vfj7-8cjw-p6xm (braces 3.0.3), GHSA-86w9-cpqp-85rv (node-forge 1.4.0)
+and GHSA-gcqx-w48m-w2h4 (deepmerge 4.3.1).
 Version-only audit findings remain visible. Tested patches supplement those
 releases; every other advisory blocks validation. Exact fixed override versions
 for simple-git, its argument parser and esbuild live in `dependency-versions.json`.
@@ -47,13 +56,19 @@ applySecurityPatches('/explicit/application')
 const active = installedDependencies('/explicit/application', 'braces', '3.0.3')
 ```
 
+`verifyAuditedAdvisories(project, ids)` rejects unrelated advisories and reported
+backports with no active target, then runs the installed dependency regressions.
+This binds version-only audit exceptions to the implementations actually tested.
+`verifyAuditReport(project, report)` additionally checks every severity total,
+rejects unaccounted findings and preserves zero critical/moderate thresholds.
+
 A missing target or an installed dependency resolving outside the selected project
 is an error. The API does not execute installs or inspected application scripts.
 The caller must own and explicitly select the project; this is not an OS sandbox
 against another process with the same user privileges.
 
 [LICENSE](LICENSE) and [NOTICE](NOTICE) describe this tool's license. The unchanged
-LICENSE-braces, LICENSE-node-forge and LICENSE-simple-git files retain upstream
+LICENSE-braces, LICENSE-node-forge, LICENSE-simple-git and LICENSE-deepmerge files retain upstream
 patch-input attribution and redistribution terms.
 
 ## Version policy 2
@@ -88,3 +103,25 @@ result before mutation; its owner must project the reviewed rules into that YAML
 rather than create competing configuration in package.json. Graph verification
 still supports an explicitly selected workspace root. No workspace YAML parser or
 second package-manager authority is introduced.
+
+### Explicit workspace graph verification
+
+`verifyProject(workspaceRoot, { projects })` checks the aggregate active dependency
+graphs of explicitly selected projects, including each project's development
+dependencies. Supply the actual owner package manager inventory (for example,
+paths returned by `pnpm list -r --depth -1 --json`), including the workspace root
+exactly once. The caller owns inventory completeness; this API does not parse
+workspace YAML or infer that unselected projects were checked. More than 256
+projects, duplicates, missing root, linked manifests, node_modules selections
+and paths outside the workspace are refused. Dependencies shared within the
+workspace are allowed; external resolutions and missing required dependencies
+remain errors. Unreferenced store entries remain excluded.
+
+The configuration CLI still refuses workspace YAML. Its owner updates that native
+policy using the public policy export and reviewed patch assets. Graph inspection
+does not install dependencies, invoke package lifecycles or grant runtime authority.
+
+The reviewed policy retains fast-uri 3.1.9 for 3.x consumers and selects 4.2.3
+for 4.x consumers; it never forces a cross-major SDK update. The 4.x correction
+follows the upstream release: https://github.com/fastify/fast-uri/releases/tag/v4.2.3 .
+A passing policy check is not an exhaustive advisory audit of unrelated packages.

package/advisories.mjs

@@ -0,0 +1,42 @@
+/** Bind accepted version-only audit findings to actual tested dependency targets. */
+import { readFileSync } from 'node:fs'
+import { verifyProject } from './checks.mjs'
+import resolver from './resolved-dependency.cjs'
+
+const targets = Object.freeze({
+  'GHSA-vfj7-8cjw-p6xm': 'braces',
+  'GHSA-86w9-cpqp-85rv': 'node-forge',
+  'GHSA-gcqx-w48m-w2h4': 'deepmerge',
+})
+
+export function verifyAuditedAdvisories(project, advisories, options = {}) {
+  if (!Array.isArray(advisories)) throw new Error('Expected an advisory identifier array')
+  const policy = JSON.parse(readFileSync(new URL('./dependency-versions.json', import.meta.url)))
+  for (const id of advisories) {
+    const target = targets[id]
+    if (!target || !policy.backportedAdvisories.includes(id)) throw new Error(`Unremediated advisory: ${id}`)
+    if (!resolver.installedDependencies(project, target, undefined, { ...options, allowMissing: true }).length) {
+      throw new Error(`Reported advisory has no active regression target: ${id}`)
+    }
+  }
+  const result = verifyProject(project, options)
+  if (result.exitCode !== 0) throw new Error('Installed dependency regressions failed')
+}
+
+/** Verify audit totals as well as each advisory against the tested active graph. */
+export function verifyAuditReport(project, report, options = {}) {
+  if (!report || typeof report !== 'object' || !report.advisories || typeof report.advisories !== 'object') {
+    throw new Error('Invalid audit report')
+  }
+  const findings = Object.values(report.advisories)
+  const totals = report.metadata?.vulnerabilities
+  for (const severity of ['info', 'low', 'moderate', 'high', 'critical']) {
+    const total = totals?.[severity]
+    if (!Number.isSafeInteger(total) || total < 0) throw new Error(`Invalid ${severity} audit total`)
+    if (['critical', 'moderate'].includes(severity) && total !== 0) throw new Error(`Unexpected ${severity} vulnerabilities`)
+    if (total > findings.filter(item => item?.severity === severity).length) {
+      throw new Error(`Unaccounted ${severity} vulnerabilities`)
+    }
+  }
+  verifyAuditedAdvisories(project, findings.map(item => item?.github_advisory_id), options)
+}

package/checks.mjs

@@ -2,12 +2,17 @@
 import { spawnSync } from 'node:child_process'
 import { fileURLToPath } from 'node:url'
 import { realpathSync } from 'node:fs'
-export function verifyProject(project) {
+import { dirname } from 'node:path'
+import resolver from './resolved-dependency.cjs'
+export function verifyProject(project, options = {}) {
+  const root = realpathSync(project)
+  const projects = resolver.projectManifests(root, options.projects).map(dirname)
   const env = { ...process.env }
   // A parent's node:test context would silently skip a child suite.
-  for (const name of ['NODE_TEST_CONTEXT', 'NODE_OPTIONS', 'NODE_PATH']) delete env[name]
+  for (const name of ['NODE_TEST_CONTEXT', 'NODE_OPTIONS', 'NODE_PATH', 'NUXTJP_SECURITY_PROJECTS']) delete env[name]
+  env.NUXTJP_SECURITY_PROJECTS = JSON.stringify(projects)
   const result = spawnSync(process.execPath,
     ['--test', fileURLToPath(new URL('./dependency-security.check.cjs', import.meta.url))],
-    { cwd: realpathSync(project), env, encoding: 'utf8', timeout: 120000, maxBuffer: 4 * 1024 * 1024 })
+    { cwd: root, env, encoding: 'utf8', timeout: 120000, maxBuffer: 4 * 1024 * 1024 })
   return { exitCode: result.status ?? 2, stdout: result.stdout ?? '', stderr: result.stderr ?? '' }
 }

package/dependency-security.check.cjs

@@ -4,14 +4,17 @@ const { createRequire } = require('node:module');
 const { generateKeyPairSync, sign, privateEncrypt, constants } = require('node:crypto');
 const path = require('node:path');
 const fs = require('node:fs');
+const graphOptions = process.env.NUXTJP_SECURITY_PROJECTS
+  ? { projects: JSON.parse(process.env.NUXTJP_SECURITY_PROJECTS) } : {};
 function dependency(name, version) {
   const { installedDependencies } = require('./resolved-dependency.cjs');
-  const matches = installedDependencies(process.cwd(), name, version);
+  const matches = installedDependencies(process.cwd(), name, version, graphOptions);
   assert.equal(matches.length, 1, 'Expected one active locked dependency implementation');
   return createRequire(matches[0])(name);
 }
 const braces = dependency('braces', '3.0.3');
-const forge = dependency('node-forge', '1.4.0');
+const forgeManifests = require('./resolved-dependency.cjs').installedDependencies(process.cwd(), 'node-forge', undefined, { ...graphOptions, allowMissing: true });
+const deepmergeManifests = require('./resolved-dependency.cjs').installedDependencies(process.cwd(), 'deepmerge', '4.3.1', { ...graphOptions, allowMissing: true });
 test('brace compilation, expansion and stringification retain ordinary behavior', () => {
   assert.equal(braces.compile('src/{a,b}.vue'), 'src/(a|b).vue');
   assert.deepEqual(braces.expand('src/{a,b}.vue'), ['src/a.vue', 'src/b.vue']);
@@ -28,7 +31,11 @@ test('deep brace, parenthesis and caller AST inputs reject before stack exhausti
   const cyclic = { type: 'root', nodes: [] }; cyclic.nodes.push(cyclic);
   assert.throws(() => braces.compile(cyclic), SyntaxError);
 });
-test('RSA verifier accepts standard signatures and rejects extra or malformed DigestAlgorithm elements', () => {
+test('RSA verifier accepts standard signatures and rejects extra or malformed DigestAlgorithm elements', context => {
+  if (!forgeManifests.length) { context.skip('No active node-forge: RSA regression is not applicable'); return; }
+  for (const manifest of forgeManifests) {
+  assert.ok(['1.4.0', '1.4.2'].includes(JSON.parse(fs.readFileSync(manifest, 'utf8')).version), 'Unreviewed node-forge version');
+  const forge = createRequire(manifest)('node-forge');
   const keys = generateKeyPairSync('rsa', { modulusLength: 2048 });
   const publicKey = forge.pki.publicKeyFromPem(keys.publicKey.export({ type: 'spki', format: 'pem' }));
   const data = Buffer.from('never-issued security regression fixture');
@@ -46,18 +53,38 @@ test('RSA verifier accepts standard signatures and rejects extra or malformed Di
     try { accepted = publicKey.verify(digest, signature); } catch { /* Rejection is the expected result for a malformed signature. */ }
     assert.equal(accepted, false, 'Malformed algorithm must not verify');
   }
+  }
 });
 
 test('active dependency graph uses every required upstream security version', () => {
   const policy = JSON.parse(fs.readFileSync(path.join(__dirname, 'dependency-versions.json'), 'utf8'));
-  require('./version-policy.cjs').verifyInstalledPolicy(process.cwd(), policy);
+  require('./version-policy.cjs').verifyInstalledPolicy(process.cwd(), policy, graphOptions);
+});
+
+test('deepmerge rejects prototype keys in both inputs and preserves ordinary merges', context => {
+  if (!deepmergeManifests.length) { context.skip('No active deepmerge: prototype regression is not applicable'); return; }
+  for (const manifest of deepmergeManifests) {
+    for (const entry of ['dist/cjs.js', 'dist/umd.js']) {
+      const merge = require(path.join(path.dirname(manifest), entry));
+      const malicious = JSON.parse('{"session":{"__proto__":{"admin":true}},"__proto__":{"admin":true}}');
+      for (const target of [{ session: null }, Object.create(null), JSON.parse('{"__proto__":{"admin":true}}')]) {
+        const result = merge(target, malicious);
+        assert.equal(result.admin, undefined);
+        assert.equal(result.session?.admin, undefined);
+        assert.equal(Object.getPrototypeOf(result), Object.prototype);
+        assert.equal(Object.getPrototypeOf(result.session), Object.prototype);
+      }
+      const result = merge({ nested: { a: 1 }, list: [1] }, { nested: { b: 2 }, list: [2] });
+      assert.deepEqual(result, { nested: { a: 1, b: 2 }, list: [1, 2] });
+    }
+  }
 });
 
 // Preserve the ESM entry point expected by current Nuxt devtools without downgrading Git protections.
 test('fixed simple-git retains named and legacy ESM factory exports', async context => {
   const { pathToFileURL } = require('node:url');
   const { installedDependencies } = require('./resolved-dependency.cjs');
-  const manifests = installedDependencies(process.cwd(), 'simple-git', '4.0.2', { allowMissing: true });
+  const manifests = installedDependencies(process.cwd(), 'simple-git', '4.0.2', { ...graphOptions, allowMissing: true });
   if (!manifests.length) { context.skip('No active simple-git: compatibility check is not applicable'); return; }
   for (const manifest of manifests) {
     const module = await import(pathToFileURL(path.join(path.dirname(manifest), 'dist/index.mjs')).href);

package/dependency-versions.json

@@ -8,10 +8,12 @@
     "undici@7": "7.30.1",
     "undici@8": "8.12.2",
     "serialize-javascript@7": "7.1.3",
-    "fast-uri@3": "3.1.9"
+    "fast-uri@3": "3.1.9",
+    "fast-uri@4": "4.2.3"
   },
   "backportedAdvisories": [
     "GHSA-vfj7-8cjw-p6xm",
-    "GHSA-86w9-cpqp-85rv"
+    "GHSA-86w9-cpqp-85rv",
+    "GHSA-gcqx-w48m-w2h4"
   ]
 }

package/index.mjs

@@ -5,3 +5,4 @@ import { applySecurityPatches as configure } from './project.mjs'
 export { installedDependencies } from './resolved-dependency.cjs'
 export function applySecurityPatches(project) { configure(project, dirname(fileURLToPath(import.meta.url))) }
 export { verifyProject } from './checks.mjs'
+export { verifyAuditedAdvisories, verifyAuditReport } from './advisories.mjs'

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nuxtjp/dependency-security",
-  "version": "0.2.0",
+  "version": "0.2.2",
   "description": "Explicit pnpm backport configuration and active dependency regression checks without Nuxt peers",
   "type": "module",
   "license": "Apache-2.0",
@@ -28,6 +28,7 @@
     "LICENSE-braces",
     "LICENSE-node-forge",
     "LICENSE-simple-git",
+    "LICENSE-deepmerge",
     "README.md"
   ],
   "exports": {
@@ -59,7 +60,7 @@
     "nuxt"
   ],
   "scripts": {
-    "build": "node --check index.mjs && node --check project.mjs && node --check apply.mjs && node --check check.mjs && node --check resolved-dependency.cjs && node --check version-policy.cjs",
+    "build": "node --check index.mjs && node --check project.mjs && node --check apply.mjs && node --check check.mjs && node --check advisories.mjs && node --check resolved-dependency.cjs && node --check version-policy.cjs",
     "test": "node --test test/*.test.mjs",
     "typecheck": "tsc --strict --noEmit --module NodeNext --moduleResolution NodeNext --target ES2022 test/public-types.mts"
   }

package/patches/deepmerge-4.3.1.patch

@@ -0,0 +1,78 @@
+diff --git a/index.js b/index.js
+index 77968ae..ea40fd2 100644
+--- a/index.js
++++ b/index.js
+@@ -51,15 +51,20 @@ function propertyIsUnsafe(target, key) {
+ 			&& Object.propertyIsEnumerable.call(target, key)) // and also unsafe if they're nonenumerable.
+ }
+ 
++function keyIsForbidden(key) {
++	return key === '__proto__' || key === 'constructor' || key === 'prototype'
++}
++
+ function mergeObject(target, source, options) {
+ 	var destination = {}
+ 	if (options.isMergeableObject(target)) {
+ 		getKeys(target).forEach(function(key) {
++			if (keyIsForbidden(key)) return
+ 			destination[key] = cloneUnlessOtherwiseSpecified(target[key], options)
+ 		})
+ 	}
+ 	getKeys(source).forEach(function(key) {
+-		if (propertyIsUnsafe(target, key)) {
++		if (keyIsForbidden(key) || propertyIsUnsafe(target, key)) {
+ 			return
+ 		}
+ 
+diff --git a/dist/cjs.js b/dist/cjs.js
+index 7c36cbd..3f743f1 100644
+--- a/dist/cjs.js
++++ b/dist/cjs.js
+@@ -76,15 +76,20 @@ function propertyIsUnsafe(target, key) {
+ 			&& Object.propertyIsEnumerable.call(target, key)) // and also unsafe if they're nonenumerable.
+ }
+ 
++function keyIsForbidden(key) {
++	return key === '__proto__' || key === 'constructor' || key === 'prototype'
++}
++
+ function mergeObject(target, source, options) {
+ 	var destination = {};
+ 	if (options.isMergeableObject(target)) {
+ 		getKeys(target).forEach(function(key) {
++			if (keyIsForbidden(key)) return
+ 			destination[key] = cloneUnlessOtherwiseSpecified(target[key], options);
+ 		});
+ 	}
+ 	getKeys(source).forEach(function(key) {
+-		if (propertyIsUnsafe(target, key)) {
++		if (keyIsForbidden(key) || propertyIsUnsafe(target, key)) {
+ 			return
+ 		}
+ 
+diff --git a/dist/umd.js b/dist/umd.js
+index 4071e7c..6a6ab99 100644
+--- a/dist/umd.js
++++ b/dist/umd.js
+@@ -80,15 +80,20 @@
+ 				&& Object.propertyIsEnumerable.call(target, key)) // and also unsafe if they're nonenumerable.
+ 	}
+ 
++	function keyIsForbidden(key) {
++		return key === '__proto__' || key === 'constructor' || key === 'prototype'
++	}
++
+ 	function mergeObject(target, source, options) {
+ 		var destination = {};
+ 		if (options.isMergeableObject(target)) {
+ 			getKeys(target).forEach(function(key) {
++				if (keyIsForbidden(key)) return
+ 				destination[key] = cloneUnlessOtherwiseSpecified(target[key], options);
+ 			});
+ 		}
+ 		getKeys(source).forEach(function(key) {
+-			if (propertyIsUnsafe(target, key)) {
++			if (keyIsForbidden(key) || propertyIsUnsafe(target, key)) {
+ 				return
+ 			}
+ 

package/project.mjs

@@ -5,7 +5,7 @@ import { randomUUID } from 'node:crypto'
 import resolver from './resolved-dependency.cjs'
 import versionPolicy from './version-policy.cjs'
 
-const patches = ['braces@3.0.3', 'node-forge@1.4.0', 'simple-git@4.0.2']
+const patches = ['braces@3.0.3', 'node-forge@1.4.0', 'simple-git@4.0.2', 'deepmerge@4.3.1']
 function regular(path) {
   const stat = lstatSync(path)
   if (stat.isSymbolicLink() || !stat.isFile() || stat.size > 1024 * 1024) {
@@ -49,6 +49,13 @@ export function applySecurityPatches(project, source) {
     throw new Error('Security patch directory must be a real directory')
   }
   const activeSimpleGit = resolver.installedDependencies(root, 'simple-git', undefined, { allowMissing: true }).length > 0
+  const forge = resolver.installedDependencies(root, 'node-forge', undefined, { allowMissing: true })
+  const forgeVersions = forge.map(path => parseJson(regular(path)).version)
+  if (forgeVersions.some(version => !['1.4.0', '1.4.2'].includes(version))) {
+    throw new Error('Dependency version changed; review its security patch')
+  }
+  const activeForge = forgeVersions.includes('1.4.0')
+  const activeDeepmerge = resolver.installedDependencies(root, 'deepmerge', '4.3.1', { allowMissing: true }).length > 0
   const inputs = patches.map(name => {
     const relative = `.nuxtjp-security/${name.replace('@', '-')}.patch`
     if (existing[name] !== undefined && existing[name] !== relative) {
@@ -59,7 +66,9 @@ export function applySecurityPatches(project, source) {
     if (existsSync(target) && !regular(target).equals(bytes)) {
       throw new Error('An existing patch differs; no files were overwritten')
     }
-    return { name, relative, bytes, target, required: name !== 'simple-git@4.0.2' || activeSimpleGit }
+    return { name, relative, bytes, target, required:
+      (name !== 'simple-git@4.0.2' || activeSimpleGit) && (name !== 'node-forge@1.4.0' || activeForge) &&
+      (name !== 'deepmerge@4.3.1' || activeDeepmerge) }
   })
   if (!readFileSync(manifest).equals(original)) throw new Error('Manifest changed during preparation')
   mkdirSync(dir, { recursive: true })

package/resolved-dependency.cjs

@@ -3,9 +3,28 @@ const fs = require('node:fs');
 const path = require('node:path');
 const { createRequire } = require('node:module');
 
+function projectManifests(root, projects = [root]) {
+  root = fs.realpathSync(root);
+  if (!Array.isArray(projects) || projects.length === 0 || projects.length > 256) throw new Error('Invalid selected project inventory');
+  const manifests = projects.map(project => {
+    if (typeof project !== 'string') throw new Error('Invalid selected project');
+    const selected = fs.realpathSync(path.resolve(root, project));
+    const relative = path.relative(root, selected);
+    if (relative === '..' || relative.startsWith('..' + path.sep) || path.isAbsolute(relative)
+      || relative.split(path.sep).includes('node_modules')) throw new Error('Selected project escapes workspace boundary');
+    const manifest = path.join(selected, 'package.json');
+    if (fs.realpathSync(manifest) !== manifest) throw new Error('Linked project manifest refused');
+    return manifest;
+  });
+  if (new Set(manifests).size !== manifests.length || !manifests.includes(path.join(root, 'package.json'))) {
+    throw new Error('Project inventory must include the workspace root exactly once');
+  }
+  return manifests;
+}
 function installedDependencies(root, target, version, options = {}) {
   root = fs.realpathSync(root);
-  const pending = [path.join(root, 'package.json')];
+  const entries = new Set(projectManifests(root, options.projects));
+  const pending = [...entries];
   const seen = new Set();
   const found = new Set();
   while (pending.length) {
@@ -23,7 +42,7 @@ function installedDependencies(root, target, version, options = {}) {
     }
     const request = createRequire(file);
     const names = Object.keys({ ...data.dependencies, ...data.optionalDependencies, ...data.peerDependencies,
-      ...(file === path.join(root, 'package.json') ? data.devDependencies : {}) });
+      ...(entries.has(file) ? data.devDependencies : {}) });
     for (const name of names) {
       let resolved = false;
       for (const location of request.resolve.paths(name + '/package.json') ?? []) {
@@ -37,7 +56,7 @@ function installedDependencies(root, target, version, options = {}) {
         resolved = true;
         break;
       }
-      if (!resolved && Object.hasOwn(data.dependencies ?? {}, name)
+      if (!resolved && Object.hasOwn({ ...data.dependencies, ...(entries.has(file) ? data.devDependencies : {}) }, name)
         && !Object.hasOwn(data.optionalDependencies ?? {}, name)) {
         throw new Error('Incomplete required dependency graph');
       }
@@ -46,4 +65,4 @@ function installedDependencies(root, target, version, options = {}) {
   if (found.size === 0 && options.allowMissing !== true) throw new Error('Dependency not present in the installed application graph');
   return [...found].sort();
 }
-module.exports = { installedDependencies };
+module.exports = { installedDependencies, projectManifests };

package/resolved-dependency.d.cts

@@ -1,2 +1,2 @@
-/** Traverse only the selected installed application graph, with a finite budget. */
-export function installedDependencies(root: string, target: string, version?: string, options?: { allowMissing?: boolean }): string[];
+/** Traverse active graphs within the selected workspace boundary. Projects must include its root once. */
+export function installedDependencies(root: string, target: string, version?: string, options?: { allowMissing?: boolean; projects?: readonly string[] }): string[];

package/types/index.d.mts

@@ -1,6 +1,11 @@
+export interface GraphOptions { projects?: readonly string[] }
 /** Configure reviewed pnpm backports. No installation or network access occurs. */
 export function applySecurityPatches(project: string): void;
 /** Resolve exact active packages; reject external-workspace resolution and missing targets. */
-export function installedDependencies(root: string, target: string, version?: string): string[];
+export function installedDependencies(root: string, target: string, version?: string, options?: GraphOptions & { allowMissing?: boolean }): string[];
 /** Run the known dependency regressions, returning bounded local output and exit status. */
-export function verifyProject(project: string): { exitCode: number; stdout: string; stderr: string };
+export function verifyProject(project: string, options?: GraphOptions): { exitCode: number; stdout: string; stderr: string };
+/** Accept only reported advisories with installed targets whose regressions pass. */
+export function verifyAuditedAdvisories(project: string, advisories: string[], options?: GraphOptions): void;
+/** Check audit totals and bind each advisory to an active, regression-tested target. */
+export function verifyAuditReport(project: string, report: unknown, options?: GraphOptions): void;

package/version-policy.cjs

@@ -47,10 +47,10 @@ function checkVersions(policy, observed) {
     }
   }
 }
-function verifyInstalledPolicy(root, policy) {
+function verifyInstalledPolicy(root, policy, options = {}) {
   const names = new Set(requirements(policy).map(rule => rule.name)), observed = {};
   for (const name of names) {
-    observed[name] = installedDependencies(root, name, undefined, { allowMissing: true })
+    observed[name] = installedDependencies(root, name, undefined, { ...options, allowMissing: true })
       .map(file => JSON.parse(fs.readFileSync(file, 'utf8')).version);
   }
   checkVersions(policy, observed);