@nuxtjp/dependency-security 0.2.1 → 0.2.2

package/LICENSE-deepmerge

@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright (c) 2012 James Halliday, Josh Duff, and other contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.

package/NOTICE

@@ -1,4 +1,6 @@
 NuxtJP dependency-security
 Apache-2.0 applies to the configuration and verification tool.
 Third-party patch inputs retain the included LICENSE-braces, LICENSE-node-forge
-and LICENSE-simple-git notices; these do not relicense the upstream packages.
+LICENSE-simple-git and LICENSE-deepmerge notices; these do not relicense the upstream packages.
+The deepmerge 4.3.1 backport rejects prototype-sensitive keys in both inputs;
+see https://github.com/TehShrike/deepmerge/issues/273 and CVE-2026-93753.

package/README.md

@@ -15,10 +15,10 @@ pnpm exec nuxtjp-security-check --project-root .
 pnpm audit --json
 ```
 
-The preset requires an installed Nuxt host with the selected braces and node-forge
-targets. The simple-git compatibility patch applies only when that dependency is
-active. Newer DevTools no longer needs it; absence is not a reason to install an
-unused Git process library. Present targets still require the reviewed fixed
+The preset requires an installed Nuxt host with the selected braces target. The
+node-forge and simple-git patches apply only when their exact reviewed targets are
+active. Node-forge 1.4.2 uses its upstream implementation and is checked by the
+same RSA regressions; 1.4.0 still needs the backport. Absence is not a reason to install an unused package. Present targets still require the reviewed fixed
 versions and malformed/escaping graphs fail closed. A bare core-only library
 graph does not need these backports.
 Use an initial install with `--ignore-scripts` before configuring a new host.
@@ -26,12 +26,21 @@ Use an initial install with `--ignore-scripts` before configuring a new host.
 Commit the generated `.nuxtjp-security` patches, manifest and lockfile. Run the
 check after every locked install. Configuration refuses conflicting patches,
 symlink storage and concurrent manifest changes; unrelated settings are retained.
-The check loads the explicitly installed braces/node-forge implementations and
-exercises bounded recursion and malformed RSA signature cases. It creates a
+The check loads the explicitly installed braces implementation and, when present,
+node-forge, and exercises bounded recursion and malformed RSA signature cases. It creates a
 never-issued ephemeral test key in memory and never reads an account key.
 
-Two upstream advisories currently have no fixed registry version:
-GHSA-vfj7-8cjw-p6xm (braces 3.0.3) and GHSA-86w9-cpqp-85rv (node-forge 1.4.0).
+When deepmerge 4.3.1 is present, the reviewed backport rejects `__proto__`,
+`constructor`, and `prototype` keys in both merge inputs. This deliberately
+excludes those keys from merged output. Regression tests check both distributed
+entry points against poisoned prototypes and ordinary nested and array merges.
+The reported issue and proposed remediation are documented at
+https://github.com/TehShrike/deepmerge/issues/273. The patch is omitted when
+deepmerge is absent, and a different installed version requires review.
+
+The following upstream advisories have no recorded fixed registry version:
+GHSA-vfj7-8cjw-p6xm (braces 3.0.3), GHSA-86w9-cpqp-85rv (node-forge 1.4.0)
+and GHSA-gcqx-w48m-w2h4 (deepmerge 4.3.1).
 Version-only audit findings remain visible. Tested patches supplement those
 releases; every other advisory blocks validation. Exact fixed override versions
 for simple-git, its argument parser and esbuild live in `dependency-versions.json`.
@@ -47,13 +56,19 @@ applySecurityPatches('/explicit/application')
 const active = installedDependencies('/explicit/application', 'braces', '3.0.3')
 ```
 
+`verifyAuditedAdvisories(project, ids)` rejects unrelated advisories and reported
+backports with no active target, then runs the installed dependency regressions.
+This binds version-only audit exceptions to the implementations actually tested.
+`verifyAuditReport(project, report)` additionally checks every severity total,
+rejects unaccounted findings and preserves zero critical/moderate thresholds.
+
 A missing target or an installed dependency resolving outside the selected project
 is an error. The API does not execute installs or inspected application scripts.
 The caller must own and explicitly select the project; this is not an OS sandbox
 against another process with the same user privileges.
 
 [LICENSE](LICENSE) and [NOTICE](NOTICE) describe this tool's license. The unchanged
-LICENSE-braces, LICENSE-node-forge and LICENSE-simple-git files retain upstream
+LICENSE-braces, LICENSE-node-forge, LICENSE-simple-git and LICENSE-deepmerge files retain upstream
 patch-input attribution and redistribution terms.
 
 ## Version policy 2

package/advisories.mjs

@@ -0,0 +1,42 @@
+/** Bind accepted version-only audit findings to actual tested dependency targets. */
+import { readFileSync } from 'node:fs'
+import { verifyProject } from './checks.mjs'
+import resolver from './resolved-dependency.cjs'
+
+const targets = Object.freeze({
+  'GHSA-vfj7-8cjw-p6xm': 'braces',
+  'GHSA-86w9-cpqp-85rv': 'node-forge',
+  'GHSA-gcqx-w48m-w2h4': 'deepmerge',
+})
+
+export function verifyAuditedAdvisories(project, advisories, options = {}) {
+  if (!Array.isArray(advisories)) throw new Error('Expected an advisory identifier array')
+  const policy = JSON.parse(readFileSync(new URL('./dependency-versions.json', import.meta.url)))
+  for (const id of advisories) {
+    const target = targets[id]
+    if (!target || !policy.backportedAdvisories.includes(id)) throw new Error(`Unremediated advisory: ${id}`)
+    if (!resolver.installedDependencies(project, target, undefined, { ...options, allowMissing: true }).length) {
+      throw new Error(`Reported advisory has no active regression target: ${id}`)
+    }
+  }
+  const result = verifyProject(project, options)
+  if (result.exitCode !== 0) throw new Error('Installed dependency regressions failed')
+}
+
+/** Verify audit totals as well as each advisory against the tested active graph. */
+export function verifyAuditReport(project, report, options = {}) {
+  if (!report || typeof report !== 'object' || !report.advisories || typeof report.advisories !== 'object') {
+    throw new Error('Invalid audit report')
+  }
+  const findings = Object.values(report.advisories)
+  const totals = report.metadata?.vulnerabilities
+  for (const severity of ['info', 'low', 'moderate', 'high', 'critical']) {
+    const total = totals?.[severity]
+    if (!Number.isSafeInteger(total) || total < 0) throw new Error(`Invalid ${severity} audit total`)
+    if (['critical', 'moderate'].includes(severity) && total !== 0) throw new Error(`Unexpected ${severity} vulnerabilities`)
+    if (total > findings.filter(item => item?.severity === severity).length) {
+      throw new Error(`Unaccounted ${severity} vulnerabilities`)
+    }
+  }
+  verifyAuditedAdvisories(project, findings.map(item => item?.github_advisory_id), options)
+}

package/dependency-security.check.cjs

@@ -13,7 +13,8 @@ function dependency(name, version) {
   return createRequire(matches[0])(name);
 }
 const braces = dependency('braces', '3.0.3');
-const forge = dependency('node-forge', '1.4.0');
+const forgeManifests = require('./resolved-dependency.cjs').installedDependencies(process.cwd(), 'node-forge', undefined, { ...graphOptions, allowMissing: true });
+const deepmergeManifests = require('./resolved-dependency.cjs').installedDependencies(process.cwd(), 'deepmerge', '4.3.1', { ...graphOptions, allowMissing: true });
 test('brace compilation, expansion and stringification retain ordinary behavior', () => {
   assert.equal(braces.compile('src/{a,b}.vue'), 'src/(a|b).vue');
   assert.deepEqual(braces.expand('src/{a,b}.vue'), ['src/a.vue', 'src/b.vue']);
@@ -30,7 +31,11 @@ test('deep brace, parenthesis and caller AST inputs reject before stack exhausti
   const cyclic = { type: 'root', nodes: [] }; cyclic.nodes.push(cyclic);
   assert.throws(() => braces.compile(cyclic), SyntaxError);
 });
-test('RSA verifier accepts standard signatures and rejects extra or malformed DigestAlgorithm elements', () => {
+test('RSA verifier accepts standard signatures and rejects extra or malformed DigestAlgorithm elements', context => {
+  if (!forgeManifests.length) { context.skip('No active node-forge: RSA regression is not applicable'); return; }
+  for (const manifest of forgeManifests) {
+  assert.ok(['1.4.0', '1.4.2'].includes(JSON.parse(fs.readFileSync(manifest, 'utf8')).version), 'Unreviewed node-forge version');
+  const forge = createRequire(manifest)('node-forge');
   const keys = generateKeyPairSync('rsa', { modulusLength: 2048 });
   const publicKey = forge.pki.publicKeyFromPem(keys.publicKey.export({ type: 'spki', format: 'pem' }));
   const data = Buffer.from('never-issued security regression fixture');
@@ -48,6 +53,7 @@ test('RSA verifier accepts standard signatures and rejects extra or malformed Di
     try { accepted = publicKey.verify(digest, signature); } catch { /* Rejection is the expected result for a malformed signature. */ }
     assert.equal(accepted, false, 'Malformed algorithm must not verify');
   }
+  }
 });
 
 test('active dependency graph uses every required upstream security version', () => {
@@ -55,6 +61,25 @@ test('active dependency graph uses every required upstream security version', ()
   require('./version-policy.cjs').verifyInstalledPolicy(process.cwd(), policy, graphOptions);
 });
 
+test('deepmerge rejects prototype keys in both inputs and preserves ordinary merges', context => {
+  if (!deepmergeManifests.length) { context.skip('No active deepmerge: prototype regression is not applicable'); return; }
+  for (const manifest of deepmergeManifests) {
+    for (const entry of ['dist/cjs.js', 'dist/umd.js']) {
+      const merge = require(path.join(path.dirname(manifest), entry));
+      const malicious = JSON.parse('{"session":{"__proto__":{"admin":true}},"__proto__":{"admin":true}}');
+      for (const target of [{ session: null }, Object.create(null), JSON.parse('{"__proto__":{"admin":true}}')]) {
+        const result = merge(target, malicious);
+        assert.equal(result.admin, undefined);
+        assert.equal(result.session?.admin, undefined);
+        assert.equal(Object.getPrototypeOf(result), Object.prototype);
+        assert.equal(Object.getPrototypeOf(result.session), Object.prototype);
+      }
+      const result = merge({ nested: { a: 1 }, list: [1] }, { nested: { b: 2 }, list: [2] });
+      assert.deepEqual(result, { nested: { a: 1, b: 2 }, list: [1, 2] });
+    }
+  }
+});
+
 // Preserve the ESM entry point expected by current Nuxt devtools without downgrading Git protections.
 test('fixed simple-git retains named and legacy ESM factory exports', async context => {
   const { pathToFileURL } = require('node:url');

package/dependency-versions.json

@@ -13,6 +13,7 @@
   },
   "backportedAdvisories": [
     "GHSA-vfj7-8cjw-p6xm",
-    "GHSA-86w9-cpqp-85rv"
+    "GHSA-86w9-cpqp-85rv",
+    "GHSA-gcqx-w48m-w2h4"
   ]
 }

package/index.mjs

@@ -5,3 +5,4 @@ import { applySecurityPatches as configure } from './project.mjs'
 export { installedDependencies } from './resolved-dependency.cjs'
 export function applySecurityPatches(project) { configure(project, dirname(fileURLToPath(import.meta.url))) }
 export { verifyProject } from './checks.mjs'
+export { verifyAuditedAdvisories, verifyAuditReport } from './advisories.mjs'

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nuxtjp/dependency-security",
-  "version": "0.2.1",
+  "version": "0.2.2",
   "description": "Explicit pnpm backport configuration and active dependency regression checks without Nuxt peers",
   "type": "module",
   "license": "Apache-2.0",
@@ -28,6 +28,7 @@
     "LICENSE-braces",
     "LICENSE-node-forge",
     "LICENSE-simple-git",
+    "LICENSE-deepmerge",
     "README.md"
   ],
   "exports": {
@@ -59,7 +60,7 @@
     "nuxt"
   ],
   "scripts": {
-    "build": "node --check index.mjs && node --check project.mjs && node --check apply.mjs && node --check check.mjs && node --check resolved-dependency.cjs && node --check version-policy.cjs",
+    "build": "node --check index.mjs && node --check project.mjs && node --check apply.mjs && node --check check.mjs && node --check advisories.mjs && node --check resolved-dependency.cjs && node --check version-policy.cjs",
     "test": "node --test test/*.test.mjs",
     "typecheck": "tsc --strict --noEmit --module NodeNext --moduleResolution NodeNext --target ES2022 test/public-types.mts"
   }

package/patches/deepmerge-4.3.1.patch

@@ -0,0 +1,78 @@
+diff --git a/index.js b/index.js
+index 77968ae..ea40fd2 100644
+--- a/index.js
++++ b/index.js
+@@ -51,15 +51,20 @@ function propertyIsUnsafe(target, key) {
+ 			&& Object.propertyIsEnumerable.call(target, key)) // and also unsafe if they're nonenumerable.
+ }
+ 
++function keyIsForbidden(key) {
++	return key === '__proto__' || key === 'constructor' || key === 'prototype'
++}
++
+ function mergeObject(target, source, options) {
+ 	var destination = {}
+ 	if (options.isMergeableObject(target)) {
+ 		getKeys(target).forEach(function(key) {
++			if (keyIsForbidden(key)) return
+ 			destination[key] = cloneUnlessOtherwiseSpecified(target[key], options)
+ 		})
+ 	}
+ 	getKeys(source).forEach(function(key) {
+-		if (propertyIsUnsafe(target, key)) {
++		if (keyIsForbidden(key) || propertyIsUnsafe(target, key)) {
+ 			return
+ 		}
+ 
+diff --git a/dist/cjs.js b/dist/cjs.js
+index 7c36cbd..3f743f1 100644
+--- a/dist/cjs.js
++++ b/dist/cjs.js
+@@ -76,15 +76,20 @@ function propertyIsUnsafe(target, key) {
+ 			&& Object.propertyIsEnumerable.call(target, key)) // and also unsafe if they're nonenumerable.
+ }
+ 
++function keyIsForbidden(key) {
++	return key === '__proto__' || key === 'constructor' || key === 'prototype'
++}
++
+ function mergeObject(target, source, options) {
+ 	var destination = {};
+ 	if (options.isMergeableObject(target)) {
+ 		getKeys(target).forEach(function(key) {
++			if (keyIsForbidden(key)) return
+ 			destination[key] = cloneUnlessOtherwiseSpecified(target[key], options);
+ 		});
+ 	}
+ 	getKeys(source).forEach(function(key) {
+-		if (propertyIsUnsafe(target, key)) {
++		if (keyIsForbidden(key) || propertyIsUnsafe(target, key)) {
+ 			return
+ 		}
+ 
+diff --git a/dist/umd.js b/dist/umd.js
+index 4071e7c..6a6ab99 100644
+--- a/dist/umd.js
++++ b/dist/umd.js
+@@ -80,15 +80,20 @@
+ 				&& Object.propertyIsEnumerable.call(target, key)) // and also unsafe if they're nonenumerable.
+ 	}
+ 
++	function keyIsForbidden(key) {
++		return key === '__proto__' || key === 'constructor' || key === 'prototype'
++	}
++
+ 	function mergeObject(target, source, options) {
+ 		var destination = {};
+ 		if (options.isMergeableObject(target)) {
+ 			getKeys(target).forEach(function(key) {
++				if (keyIsForbidden(key)) return
+ 				destination[key] = cloneUnlessOtherwiseSpecified(target[key], options);
+ 			});
+ 		}
+ 		getKeys(source).forEach(function(key) {
+-			if (propertyIsUnsafe(target, key)) {
++			if (keyIsForbidden(key) || propertyIsUnsafe(target, key)) {
+ 				return
+ 			}
+ 

package/project.mjs

@@ -5,7 +5,7 @@ import { randomUUID } from 'node:crypto'
 import resolver from './resolved-dependency.cjs'
 import versionPolicy from './version-policy.cjs'
 
-const patches = ['braces@3.0.3', 'node-forge@1.4.0', 'simple-git@4.0.2']
+const patches = ['braces@3.0.3', 'node-forge@1.4.0', 'simple-git@4.0.2', 'deepmerge@4.3.1']
 function regular(path) {
   const stat = lstatSync(path)
   if (stat.isSymbolicLink() || !stat.isFile() || stat.size > 1024 * 1024) {
@@ -49,6 +49,13 @@ export function applySecurityPatches(project, source) {
     throw new Error('Security patch directory must be a real directory')
   }
   const activeSimpleGit = resolver.installedDependencies(root, 'simple-git', undefined, { allowMissing: true }).length > 0
+  const forge = resolver.installedDependencies(root, 'node-forge', undefined, { allowMissing: true })
+  const forgeVersions = forge.map(path => parseJson(regular(path)).version)
+  if (forgeVersions.some(version => !['1.4.0', '1.4.2'].includes(version))) {
+    throw new Error('Dependency version changed; review its security patch')
+  }
+  const activeForge = forgeVersions.includes('1.4.0')
+  const activeDeepmerge = resolver.installedDependencies(root, 'deepmerge', '4.3.1', { allowMissing: true }).length > 0
   const inputs = patches.map(name => {
     const relative = `.nuxtjp-security/${name.replace('@', '-')}.patch`
     if (existing[name] !== undefined && existing[name] !== relative) {
@@ -59,7 +66,9 @@ export function applySecurityPatches(project, source) {
     if (existsSync(target) && !regular(target).equals(bytes)) {
       throw new Error('An existing patch differs; no files were overwritten')
     }
-    return { name, relative, bytes, target, required: name !== 'simple-git@4.0.2' || activeSimpleGit }
+    return { name, relative, bytes, target, required:
+      (name !== 'simple-git@4.0.2' || activeSimpleGit) && (name !== 'node-forge@1.4.0' || activeForge) &&
+      (name !== 'deepmerge@4.3.1' || activeDeepmerge) }
   })
   if (!readFileSync(manifest).equals(original)) throw new Error('Manifest changed during preparation')
   mkdirSync(dir, { recursive: true })

package/types/index.d.mts

@@ -5,3 +5,7 @@ export function applySecurityPatches(project: string): void;
 export function installedDependencies(root: string, target: string, version?: string, options?: GraphOptions & { allowMissing?: boolean }): string[];
 /** Run the known dependency regressions, returning bounded local output and exit status. */
 export function verifyProject(project: string, options?: GraphOptions): { exitCode: number; stdout: string; stderr: string };
+/** Accept only reported advisories with installed targets whose regressions pass. */
+export function verifyAuditedAdvisories(project: string, advisories: string[], options?: GraphOptions): void;
+/** Check audit totals and bind each advisory to an active, regression-tested target. */
+export function verifyAuditReport(project: string, report: unknown, options?: GraphOptions): void;