@nuxtjp/local-runtime 0.1.1 → 0.1.2

package/README.ja.md

@@ -6,7 +6,7 @@
 
 ## 導入と使い方
 
-`0.1.0`はnpmで公開済みです。Node `^22.19.0`または`^24.11.0`、Nuxt `^4.5.1`、Vue `^3.5.40`を使用してください。
+`0.1.1`はnpmで公開済みです。Node `^22.19.0`または`^24.11.0`、Nuxt `^4.5.1`、Vue `^3.5.40`を使用してください。
 
 ```sh
 npm install @nuxtjp/local-runtime@0.1.0

package/README.md

@@ -6,7 +6,7 @@ Connect a browser interface to one explicitly configured local Rust runtime, aft
 
 ## Install and use
 
-Version `0.1.0` is published on npm. Use Node `^22.19.0` or `^24.11.0`, Nuxt `^4.5.1` and Vue `^3.5.40`.
+Version `0.1.1` is published on npm. Use Node `^22.19.0` or `^24.11.0`, Nuxt `^4.5.1` and Vue `^3.5.40`.
 
 ```sh
 npm install @nuxtjp/local-runtime@0.1.0
@@ -60,7 +60,7 @@ pnpm test
 pnpm build
 ```
 
-The verification inputs pin Nuxt/kit/schema to `4.5.1`, Vue to `3.5.43` and Vitest to `4.1.11`. Compatible dependency fixes remove advisories; assess remaining advisories and untested environments before a release. Node and host compatibility floors were raised to match Nuxt.
+The verification inputs pin Nuxt/kit/schema to `4.5.2`, Vue to `3.5.43` and Vitest to `4.1.11`. Compatible dependency fixes remove advisories; assess remaining advisories and untested environments before a release. Node and host compatibility floors were raised to match Nuxt.
 The module/client API, loopback endpoint rules, explicit connection behavior and license terms are retained.
 A local TGZ test proves archive behavior, not registry availability. Operations, deployment and publication require their own permissions and settings.
 
@@ -69,3 +69,7 @@ A local TGZ test proves archive behavior, not registry availability. Operations,
 [Usage guide](https://github.com/nuxtjp/nuxt-local-runtime/blob/main/docs/getting-started.md) · [Schemas](schemas) · [Source](https://github.com/nuxtjp/nuxt-local-runtime/tree/main/src) · [Tests](https://github.com/nuxtjp/nuxt-local-runtime/tree/main/test) · [Contributing](https://github.com/nuxtjp/nuxt-local-runtime/blob/main/CONTRIBUTING.md) · [Security reporting](https://github.com/nuxtjp/nuxt-local-runtime/blob/main/SECURITY.md)
 
 Code: [Apache-2.0](LICENSE). Retain [NOTICE](NOTICE) and the prior grants in [LICENSE-PREVIOUS](LICENSE-PREVIOUS).
+
+## Consumer dependency security
+
+See [dependency security backports](security/README.md) before installing this package in a Nuxt application. pnpm consumers must explicitly apply the included backports and verify their locked dependency tree; ordinary npm installation does not apply them.

package/dist/module.json

@@ -4,7 +4,7 @@
   "compatibility": {
     "nuxt": "^4.5.1"
   },
-  "version": "0.1.1",
+  "version": "0.1.2",
   "builder": {
     "@nuxt/module-builder": "1.0.2",
     "unbuild": "unknown"

package/package.json

@@ -1,9 +1,10 @@
 {
   "name": "@nuxtjp/local-runtime",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "Fail-closed Nuxt client for a loopback local runtime",
   "type": "module",
   "license": "Apache-2.0",
+  "packageManager": "pnpm@10.29.3",
   "engines": {
     "node": "^22.19.0 || ^24.11.0",
     "pnpm": ">=10 <11"
@@ -16,7 +17,8 @@
     "README.md",
     "NOTICE",
     "LICENSE-PREVIOUS",
-    "README.ja.md"
+    "README.ja.md",
+    "security"
   ],
   "main": "./dist/module.mjs",
   "types": "./dist/types.d.mts",
@@ -39,19 +41,27 @@
     },
     "./schema": "./schemas/local-runtime-v1.schema.json"
   },
+  "scripts": {
+    "build": "nuxt-module-build build && nuxt build playground",
+    "typecheck": "vue-tsc --noEmit --project tsconfig.json",
+    "test": "vitest run && pnpm run test:dependency-security && pnpm run test:consumer-security",
+    "prepack": "pnpm run test && pnpm run typecheck && pnpm run build",
+    "test:dependency-security": "node --test scripts/dependency-security.check.cjs",
+    "test:consumer-security": "node --test scripts/consumer-security.check.mjs"
+  },
   "peerDependencies": {
     "nuxt": "^4.5.1",
     "vue": "^3.5.40"
   },
   "dependencies": {
-    "@nuxt/kit": "4.5.1",
+    "@nuxt/kit": "4.5.2",
     "@nuxt/schema": "4.5.1"
   },
   "devDependencies": {
     "@nuxt/module-builder": "1.0.2",
     "@types/node": "24.12.0",
     "ajv": "8.20.0",
-    "nuxt": "4.5.1",
+    "nuxt": "4.5.2",
     "typescript": "5.9.3",
     "vitest": "4.1.11",
     "vue": "3.5.43",
@@ -70,9 +80,13 @@
     "registry": "https://registry.npmjs.org",
     "provenance": true
   },
-  "scripts": {
-    "build": "nuxt-module-build build && nuxt build playground",
-    "typecheck": "vue-tsc --noEmit --project tsconfig.json",
-    "test": "vitest run"
+  "pnpm": {
+    "overrides": {
+      "@nuxt/devtools>simple-git": "4.0.2"
+    },
+    "patchedDependencies": {
+      "braces@3.0.3": "patches/braces@3.0.3.patch",
+      "node-forge@1.4.0": "patches/node-forge@1.4.0.patch"
+    }
   }
-}
+}

package/security/README.md

@@ -0,0 +1,17 @@
+# Dependency security backports
+
+Two upstream dependencies have no fixed release: braces 3.0.3 (GHSA-vfj7-8cjw-p6xm) and node-forge 1.4.0 (GHSA-86w9-cpqp-85rv). The included patches bound brace AST recursion and reject malformed RSA DigestAlgorithm parameters. Regression tests cover ordinary behavior and the malicious input shapes.
+
+The package is distributed through npm. A consumer must use pnpm 10 and explicitly configure the reviewed backports at its project root. Dependency packages cannot impose root-level npm overrides or pnpm patches on a consuming application. Installing this module alone does not apply the patches.
+
+```sh
+node node_modules/@nuxtjp/local-runtime/security/apply.mjs --project-root . --apply
+pnpm install --no-frozen-lockfile
+pnpm install --frozen-lockfile
+```
+
+Commit the generated `.nuxtjp-security/*.patch`, `package.json`, and lockfile in your application. The command does not run installs, access the network, or replace an existing conflicting patch. It preserves unrelated pnpm settings. Each root application must apply the patches, including CI checkouts.
+
+Run `node node_modules/@nuxtjp/local-runtime/security/dependency-security.check.cjs` after installing the locked project to verify that the actual resolved dependencies reject the affected inputs. These are backports, not upstream fixed versions. Version-only advisory tools still report the two vulnerable upstream versions; retain their findings and link the lockfile/patch hashes and regression results. Reapply and reverify when dependency versions change. npm-only consumers require a separately reviewed override distribution; they are not certified by this pnpm procedure.
+
+The RSA test creates an ephemeral key in memory and never reads a user key. Patches contain code only and do not include credentials, customer content, or private endpoints.

package/security/apply.mjs

@@ -0,0 +1,19 @@
+#!/usr/bin/env node
+/** Apply reviewed Nuxt dependency backports to an explicitly selected pnpm project. */
+import { fileURLToPath } from 'node:url'
+import { dirname } from 'node:path'
+import { applySecurityPatches } from './project.mjs'
+
+const args = process.argv.slice(2)
+if (args.length !== 3 || args[0] !== '--project-root' || args[2] !== '--apply') {
+  console.error('Usage: node apply.mjs --project-root PROJECT --apply')
+  process.exitCode = 2
+} else {
+  try {
+    applySecurityPatches(args[1], dirname(fileURLToPath(import.meta.url)))
+    console.log('Reviewed backports configured. Run pnpm install --no-frozen-lockfile to refresh the lockfile.')
+  } catch (error) {
+    console.error(error.message)
+    process.exitCode = 1
+  }
+}

package/security/dependency-security.check.cjs

@@ -0,0 +1,51 @@
+const assert = require('node:assert/strict');
+const { test } = require('node:test');
+const { createRequire } = require('node:module');
+const { generateKeyPairSync, sign, privateEncrypt, constants } = require('node:crypto');
+const path = require('node:path');
+const fs = require('node:fs');
+function dependency(name, version) {
+  const explicit = process.env['SECURITY_TEST_' + name.toUpperCase().replace('-', '_')];
+  if (explicit) return require(path.resolve(explicit));
+  const { installedDependencies } = require('./resolved-dependency.cjs');
+  const matches = installedDependencies(process.cwd(), name, version);
+  assert.equal(matches.length, 1, 'Expected one active locked dependency implementation');
+  return createRequire(matches[0])(name);
+}
+const braces = dependency('braces', '3.0.3');
+const forge = dependency('node-forge', '1.4.0');
+test('brace compilation, expansion and stringification retain ordinary behavior', () => {
+  assert.equal(braces.compile('src/{a,b}.vue'), 'src/(a|b).vue');
+  assert.deepEqual(braces.expand('src/{a,b}.vue'), ['src/a.vue', 'src/b.vue']);
+  assert.equal(braces.stringify(braces.parse('src/{a,b}.vue')), 'src/{a,b}.vue');
+  assert.equal(braces.compile('src/\\{a,b\\}.vue'), 'src/{a,b}.vue');
+});
+test('deep brace, parenthesis and caller AST inputs reject before stack exhaustion', () => {
+  for (const pattern of ['{'.repeat(6000) + 'a,b' + '}'.repeat(6000), '('.repeat(6000) + 'x' + ')'.repeat(6000), '{'.repeat(6000) + 'x']) {
+    for (const fn of [braces.compile, braces.expand, braces.stringify, braces.parse]) assert.throws(() => fn(pattern), SyntaxError);
+  }
+  let ast = { type: 'text', value: 'x' };
+  for (let i = 0; i < 6000; i++) ast = { type: 'root', nodes: [ast] };
+  for (const fn of [braces.compile, braces.expand, braces.stringify]) assert.throws(() => fn(ast), SyntaxError);
+  const cyclic = { type: 'root', nodes: [] }; cyclic.nodes.push(cyclic);
+  assert.throws(() => braces.compile(cyclic), SyntaxError);
+});
+test('RSA verifier accepts standard signatures and rejects extra or malformed DigestAlgorithm elements', () => {
+  const keys = generateKeyPairSync('rsa', { modulusLength: 2048 });
+  const publicKey = forge.pki.publicKeyFromPem(keys.publicKey.export({ type: 'spki', format: 'pem' }));
+  const data = Buffer.from('never-issued security regression fixture');
+  const md = forge.md.sha256.create(); md.update(data.toString('binary'));
+  const digest = md.digest().getBytes();
+  assert.equal(publicKey.verify(digest, sign('sha256', data, keys.privateKey).toString('binary')), true);
+  const a = forge.asn1;
+  const oid = () => a.create(a.Class.UNIVERSAL, a.Type.OID, false, a.oidToDer(forge.oids.sha256).getBytes());
+  const nil = value => a.create(a.Class.UNIVERSAL, a.Type.NULL, false, value);
+  for (const parameters of [[oid(), nil(''), oid()], [oid(), a.create(a.Class.UNIVERSAL, a.Type.SEQUENCE, true, [oid()])], [oid(), nil('x')]]) {
+    const info = a.create(a.Class.UNIVERSAL, a.Type.SEQUENCE, true, [a.create(a.Class.UNIVERSAL, a.Type.SEQUENCE, true, parameters), a.create(a.Class.UNIVERSAL, a.Type.OCTETSTRING, false, digest)]);
+    const encoded = Buffer.from(a.toDer(info).getBytes(), 'binary');
+    const signature = privateEncrypt({ key: keys.privateKey, padding: constants.RSA_PKCS1_PADDING }, encoded).toString('binary');
+    let accepted = false;
+    try { accepted = publicKey.verify(digest, signature); } catch { /* Rejection is the expected result for a malformed signature. */ }
+    assert.equal(accepted, false, 'Malformed algorithm must not verify');
+  }
+});

package/security/patches/braces@3.0.3.patch

@@ -0,0 +1,92 @@
+diff --git a/lib/depth-guard.js b/lib/depth-guard.js
+new file mode 100644
+--- /dev/null
++++ b/lib/depth-guard.js
+@@ -0,0 +1,19 @@
++'use strict';
++
++// Wonderland security backport: bound recursive walkers, including caller ASTs.
++module.exports = ast => {
++  const pending = [[ast, 0]];
++  const seen = new Set();
++  let count = 0;
++  while (pending.length) {
++    const [node, depth] = pending.pop();
++    if (depth > 64 || ++count > 100000 || seen.has(node)) {
++      throw new SyntaxError('Brace pattern exceeds safe AST bounds');
++    }
++    if (!node || typeof node !== 'object') continue;
++    seen.add(node);
++    if (Array.isArray(node.nodes)) {
++      for (const child of node.nodes) pending.push([child, depth + 1]);
++    }
++  }
++};
+diff --git a/lib/parse.js b/lib/parse.js
+--- a/lib/parse.js
++++ b/lib/parse.js
+@@ -144,6 +144,7 @@
+ 
+     if (value === CHAR_LEFT_PARENTHESES) {
+       block = push({ type: 'paren', nodes: [] });
++      if (stack.length >= 64) throw new SyntaxError('Brace pattern exceeds safe nesting depth');
+       stack.push(block);
+       push({ type: 'text', value });
+       continue;
+@@ -210,6 +211,7 @@
+       };
+ 
+       block = push(brace);
++      if (stack.length >= 64) throw new SyntaxError('Brace pattern exceeds safe nesting depth');
+       stack.push(block);
+       push({ type: 'open', value });
+       continue;
+diff --git a/lib/compile.js b/lib/compile.js
+--- a/lib/compile.js
++++ b/lib/compile.js
+@@ -1,9 +1,12 @@
+ 'use strict';
++
++const assertDepth = require('./depth-guard');
+ 
+ const fill = require('fill-range');
+ const utils = require('./utils');
+ 
+ const compile = (ast, options = {}) => {
++  assertDepth(ast);
+   const walk = (node, parent = {}) => {
+     const invalidBlock = utils.isInvalidBrace(parent);
+     const invalidNode = node.invalid === true && options.escapeInvalid === true;
+diff --git a/lib/expand.js b/lib/expand.js
+--- a/lib/expand.js
++++ b/lib/expand.js
+@@ -1,4 +1,6 @@
+ 'use strict';
++
++const assertDepth = require('./depth-guard');
+ 
+ const fill = require('fill-range');
+ const stringify = require('./stringify');
+@@ -31,6 +33,7 @@
+ };
+ 
+ const expand = (ast, options = {}) => {
++  assertDepth(ast);
+   const rangeLimit = options.rangeLimit === undefined ? 1000 : options.rangeLimit;
+ 
+   const walk = (node, parent = {}) => {
+diff --git a/lib/stringify.js b/lib/stringify.js
+--- a/lib/stringify.js
++++ b/lib/stringify.js
+@@ -1,8 +1,11 @@
+ 'use strict';
++
++const assertDepth = require('./depth-guard');
+ 
+ const utils = require('./utils');
+ 
+ module.exports = (ast, options = {}) => {
++  assertDepth(ast);
+   const stringify = (node, parent = {}) => {
+     const invalidBlock = options.escapeInvalid && utils.isInvalidBrace(parent);
+     const invalidNode = node.invalid === true && options.escapeInvalid === true;

package/security/patches/node-forge@1.4.0.patch

@@ -0,0 +1,20 @@
+diff --git a/lib/rsa.js b/lib/rsa.js
+--- a/lib/rsa.js
++++ b/lib/rsa.js
+@@ -1172,7 +1172,15 @@
+           var capture = {};
+           var errors = [];
+           if(!asn1.validate(obj, digestInfoValidator, capture, errors) ||
+-            obj.value.length !== 2) {
++            obj.value.length !== 2 ||
++            // Wonderland security backport: AlgorithmIdentifier has one OID
++            // and, optionally, exactly one empty primitive NULL parameter.
++            obj.value[0].value.length < 1 || obj.value[0].value.length > 2 ||
++            (obj.value[0].value.length === 2 &&
++              (obj.value[0].value[1].tagClass !== asn1.Class.UNIVERSAL ||
++               obj.value[0].value[1].type !== asn1.Type.NULL ||
++               obj.value[0].value[1].constructed !== false ||
++               obj.value[0].value[1].value !== ''))) {
+             var error = new Error(
+               'ASN.1 object does not contain a valid RSASSA-PKCS1-v1_5 ' +
+               'DigestInfo value.');

package/security/project.mjs

@@ -0,0 +1,61 @@
+/** Configure caller-owned pnpm backports without executing installs or changing unrelated settings. */
+import { existsSync, lstatSync, readFileSync, mkdirSync, writeFileSync, renameSync, unlinkSync, realpathSync } from 'node:fs'
+import { join, resolve } from 'node:path'
+import { randomUUID } from 'node:crypto'
+
+const patches = ['braces@3.0.3', 'node-forge@1.4.0']
+function regular(path) {
+  const stat = lstatSync(path)
+  if (stat.isSymbolicLink() || !stat.isFile() || stat.size > 1024 * 1024) {
+    throw new Error('Expected a bounded regular project or patch file')
+  }
+  return readFileSync(path)
+}
+function object(value) {
+  return value !== null && typeof value === 'object' && !Array.isArray(value)
+}
+
+/** Reject conflicting patches and links before mutating a project. No network access occurs. */
+export function applySecurityPatches(project, source) {
+  const root = realpathSync(resolve(project))
+  const manifest = join(root, 'package.json')
+  const original = regular(manifest)
+  const data = JSON.parse(original)
+  if (!object(data) || (data.pnpm !== undefined && !object(data.pnpm))) {
+    throw new Error('Expected a package manifest with object-valued pnpm settings')
+  }
+  const pnpm = data.pnpm ?? {}
+  const existing = pnpm.patchedDependencies ?? {}
+  if (!object(existing)) throw new Error('Expected object-valued patchedDependencies')
+  const dir = join(root, '.nuxtjp-security')
+  if (existsSync(dir) && (lstatSync(dir).isSymbolicLink() || !lstatSync(dir).isDirectory())) {
+    throw new Error('Security patch directory must be a real directory')
+  }
+  const inputs = patches.map(name => {
+    const relative = `.nuxtjp-security/${name}.patch`
+    if (existing[name] !== undefined && existing[name] !== relative) {
+      throw new Error('An existing dependency patch conflicts; review it before applying')
+    }
+    const bytes = regular(join(source, 'patches', `${name}.patch`))
+    const target = join(root, relative)
+    if (existsSync(target) && !regular(target).equals(bytes)) {
+      throw new Error('An existing patch differs; no files were overwritten')
+    }
+    return { name, relative, bytes, target }
+  })
+  if (!readFileSync(manifest).equals(original)) throw new Error('Manifest changed during preparation')
+  mkdirSync(dir, { recursive: true })
+  for (const patch of inputs) {
+    if (!existsSync(patch.target)) writeFileSync(patch.target, patch.bytes, { flag: 'wx' })
+    existing[patch.name] = patch.relative
+  }
+  data.pnpm = { ...pnpm, patchedDependencies: existing }
+  const temporary = join(root, `.nuxtjp-manifest-${randomUUID()}.tmp`)
+  try {
+    writeFileSync(temporary, JSON.stringify(data, null, 2) + '\n', { flag: 'wx' })
+    if (!readFileSync(manifest).equals(original)) throw new Error('Manifest changed; retry after review')
+    renameSync(temporary, manifest)
+  } finally {
+    if (existsSync(temporary)) unlinkSync(temporary)
+  }
+}

package/security/resolved-dependency.cjs

@@ -0,0 +1,40 @@
+/** Resolve a dependency through the installed application graph, ignoring unused store entries. */
+const fs = require('node:fs');
+const path = require('node:path');
+const { createRequire } = require('node:module');
+
+function installedDependencies(root, target, version) {
+  root = fs.realpathSync(root);
+  const pending = [path.join(root, 'package.json')];
+  const seen = new Set();
+  const found = new Set();
+  while (pending.length) {
+    if (seen.size > 5000) throw new Error('Installed dependency graph exceeds verification budget');
+    const file = pending.pop();
+    if (seen.has(file)) continue;
+    seen.add(file);
+    const data = JSON.parse(fs.readFileSync(file, 'utf8'));
+    if (data.name === target) {
+      if (data.version !== version) throw new Error('Dependency version changed; review its security patch');
+      found.add(file);
+    }
+    const request = createRequire(file);
+    const names = Object.keys({ ...data.dependencies, ...data.optionalDependencies, ...data.peerDependencies,
+      ...(file === path.join(root, 'package.json') ? data.devDependencies : {}) });
+    for (const name of names) {
+      for (const location of request.resolve.paths(name) ?? []) {
+        const candidate = path.join(location, name, 'package.json');
+        if (!fs.existsSync(candidate)) continue;
+        const real = fs.realpathSync(candidate);
+        if (!real.startsWith(path.join(root, 'node_modules') + path.sep)) {
+          throw new Error('Dependency resolves outside the selected project; select the workspace root');
+        }
+        pending.push(real);
+        break;
+      }
+    }
+  }
+  if (found.size === 0) throw new Error('Dependency not present in the installed application graph');
+  return [...found].sort();
+}
+module.exports = { installedDependencies };