fix(test): patch isolated consumer security fixtures

[wybaby168]

Summary

Depends on #339. This main-base draft preserves fixture-owned npm policy when installing packed consumers, without inheriting workspace overrides. It aligns Vue/compiler-sfc at 3.5.43 and keeps the Angular 22 framework/toolchain with explicit fixture overrides for Piscina 5.3.2 and MCP SDK 1.31.0.

The latest change upgrades only the Vue CLI fixture's ts-loader from 9.5.4 to 9.6.2. It removes the loader's micromatch/braces route while retaining its declared Node >=12 minimum and the existing Vue CLI 5, TypeScript 5.9.3 and React pins. The incremental scope remains six fixture/helper/test files relative to #339; library manifests, workspace policy, Mermaid/KaTeX ranges and compatibility floors are unchanged by this PR's incremental work.

Related issue

Depends on #339. N/A: security maintenance of consumer regression fixtures; no separate issue closure is requested. The main-base diff includes #339's inherited dependency changes.

Change classification

• User-visible UI or rendering change
• Non-visual change
• File-format or renderer behavior
• Public API, package, Worker, WASM, or deployment-path change

The last two classifications describe inherited #339 changes. The six incremental files cover application fixtures, their packed-consumer helper, tests and documentation.

Verification

Current head: 2e646fe281d44fa888219184c781a28838441c87
Current tree: f7369c9f04136fed9266ea6dae8af1ff98cbbd67

• node apps/component-demo/scripts/verify-packed-issue-closure.mjs — Passed on the exact current head in full Public CI: 21 Vue/React consumer browser cases and Angular development/restart/production Worker plus missing-manifest checks.

The same hosted run completed 48 validation steps successfully; only failure-evidence upload was skipped. Vue/React install reported 39 affected entries and Angular zero. Security and CodeQL also passed. The later metadata-only governance failure is retained; this corrected body requires a fresh governance result.

New candidate checks ran in the independent Linux cloud with Node 24.20.0, pnpm 11.0.9 and NODE_PATH unset:

• Fresh untouched graphs reproduce Angular 0 full/0 production and Vue/React 40 full/7 production findings.
• ts-loader 9.6.2 candidate installation and audits passed: 39 full findings (16 high, 16 moderate, 7 low), 7 production low entries. The vulnerable loader route disappeared; remaining advisory identities and production versions remain reported.
• Direct Webpack 5.111.1 / TypeScript 5.9.3 / Vue 3.5.43 SFC compilation, type checking and exact SSR output passed. Installed loader/dependency policy and all 46 immutable packed-library hashes were checked.
• The standard local Vue CLI build remains blocked before compilation by node-ipc's os.networkInterfaces call returning uv_interface_addresses error 1. No shim or permission bypass was used. Direct compilation is not represented as a complete CLI/browser pass.
• The first registry install attempt encountered ECONNRESET; the same authorized registry retry succeeded. Both attempts are retained.

The 46 library tarballs are unchanged from the previously verified library source; intervening commits change fixtures/helpers/tests only. This is fixture validation, not a newly packed release certification.

The preceding head e149328b1058bef09284cd5d339e5c9c94238610 completed full Public CI, Security, CodeQL and governance. Its local root type checks, 260 Vitest tests (one existing skip), fixture tests and governance checks also passed. Those results remain historical evidence; the current head's separate full hosted run above now validates the loader change.

Sample / fixture evidence

Existing public fixtures only: apps/component-demo/test/webpack5-issues/src/App.vue, apps/component-demo/test/angular-pptx, and apps/viewer-demo/public/example/ppt.pptx. No private samples or customer files are introduced. Original manifests, locks, full/production audits, installed-path evidence and negative attempts are retained.

Visual evidence

N/A: the incremental change is dependency policy and test documentation. Actual rendering, Worker execution, lifecycle and deployment checks remain mandatory in the existing hosted browser suite.

Risk and compatibility

• Affected packages/formats: incremental Angular and Vue CLI/React application fixtures, their packed-consumer helper, tests and documentation. Inherited renderer/package dependency changes belong to fix(deps): use Vitest 5 consistently in the workspace #339.
• Compatibility or migration risk: this fixture uses pinned TypeScript 5.9.3; the loader keeps its declared Node >=12 minimum. Application overrides do not propagate as library-default policy. Remaining legacy advisories and version/API boundaries are detailed below.
• The protected Angular fixture is 0 full/0 production; those explicit host overrides do not establish clean arbitrary library defaults.
• Original Vue/React was 42 full/9 production; Vue's security patch reduced it to 40/7, and this loader repair to 39/7. These are separate full and production results for that specific installed fixture graph; seven production entries propagate the KaTeX advisory. Counts are affected entries, not independent exploit counts. Separately, the repository workspace audit retains the ignored low Vue 2 compiler ReDoS advisory GHSA-5j4c-8p2g-v4jx: its paths include an auto-installed production Vue 2.7.16 peer through packages/compat/vue2.7, plus four component development paths. The workspace exception is therefore not exclusively development-only and is not counted as fixed. Public-upstream Vue 2 has no compatible patched release; a framework migration or an explicitly maintained/licensed backport remains a separate decision.
• Braces 3.0.3 and node-forge 1.4.0 currently have no published fixes. Other legacy CLI remedies cross parent dependency/API or Node-floor boundaries. KaTeX 0.18.2 is outside Mermaid's declared range; even Mermaid 12.1.0 still selects KaTeX ^0.16.47. No forced major upgrade, audit suppression or plugin downgrade was used.
• ts-loader 9.6.2 changes resolver behavior for some old TypeScript scenarios. Validation applies to this fixture's pinned TypeScript 5.9.3, not a new universal support guarantee.
• Rollback: revert the incremental fixture commits while preserving fix(deps): use Vitest 5 consistently in the workspace #339 and the original baselines. No npm publication, workflow change or merge is included.

Checklist

• Focused coverage preserves fixture-owned overrides and no-policy isolation.
• Fixture READMEs document version and security boundaries.
• Existing Angular asset/Worker and Vue/React browser gates remain required for the exact current head.
• No secrets, private fixtures, caches, generated runtime bundles or unrelated source changes are included.

[wybaby168]

Closing as covered by main fa4035f9f133079978ebf33d86606c2dbf00e6ea. Reviewed head: 2e646fe281d44fa888219184c781a28838441c87.

All 19 changed paths are covered, including the inherited security and Vitest requirements from #337/#339. For this PR's six additional consumer-policy paths:

• Both Angular and webpack/Vue/React fixture manifests are byte-for-byte identical to this PR. The original manifest preparation function and consumer-policy test block are preserved verbatim: clone the fixture, retain its own overrides, and keep workspace security policy out of fixtures that do not declare it. Both original READMEs are retained in full, with audit-evidence documentation appended.
• The existing main Core CI passed the nine Angular asset/consumer-policy tests and built the packed consumers. Its recorded cold npm locks install Piscina 5.3.2 and MCP SDK 1.31.0 for Angular, and Vue/compiler 3.5.43 plus ts-loader 9.6.2 for webpack. The loader uses picomatch instead of its former micromatch/braces dependency path and retains its Node >=12 engine; the fixture's Angular, TypeScript, React and Vue CLI pins are retained.
• That same run's audit evidence reports Angular 0 full / 0 production findings, and webpack 32 full / 0 production affected-package entries. The remaining webpack development findings remain visible; the PR's consumer-policy corrections are implemented without representing that graph as entirely clean.

The intended consumer isolation and scoped dependency repairs are present on main, so this older branch can close without merging.