Repository navigation
fix(deps): audit scoped CLI YAML override and security patches - #258
Conversation
|
@codex review Exact head |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
Codex Review: Didn't find any major issues. Already looking forward to the next diff. Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
There was a problem hiding this comment.
🔵 Needs a closer look
It is a security-sensitive dependency/override-contract change with a large lockfile whose integrity hashes and published version availability cannot be verified in this environment, and the author's own verification checklist is still incomplete.
0 open findings
What changed in this PR
This PR applies a batch of security/dependency updates to the book project's Node toolchain and codifies a narrowly-scoped exception that lets markdownlint-cli resolve a patched js-yaml (5.4.1) even though it falls outside the CLI's declared upstream range (~5.2.1). It references issue #257 (restore root npm audit gate before the formatter rollout) and is explicitly framed as a verification PR that only touches dependencies and their guarding contracts — not book content, published assets, build, Node/npm, or the formatter pin.
The changes are internally consistent: package.json and package-lock.json version/override edits line up with each other and with the two updated contract scripts, the new transitive dependencies (es-define-property, updated side-channel*, object-inspect) are present, and each forced override (js-yaml, smol-toml, katex, markdown-it) has a single consumer so the hoisted lock entries are correct. The new "audited override tuple" guard in the Chapter 8 contract is matched by 18 negative self-test cases, which I traced individually — each produces the asserted error substring.
Changes:
- Add an
isAuditedMarkdownlintYamlOverrideguard (exact tuple: CLI0.49.1× declared~5.2.1× resolved5.4.1× override5.4.1) plus a malformed-YAML fail-closed smoke check and new negative self-test cases incheck-chapter08-codeql-contract.js. - Bump security-relevant dependencies in
package.json/package-lock.json:js-yaml4.3.2 / nested 5.4.1,markdown-it14.3.1,brace-expansion5.0.12,smol-toml1.9.0,katex0.18.2,qs6.16.1,sharp0.35.5 + platform/libvips 1.3.4 +@emnapi/runtime1.11.3. - Update
check-install-script-policy.jsexpectedsharpVersionto0.35.5to match the new lock resolution.
| File | Description |
|---|---|
| scripts/check-chapter08-codeql-contract.js | Adds audited-tuple override exception, malformed-YAML smoke, installed-CLI tuple check, and new self-test cases covering the exception boundary. |
| scripts/check-install-script-policy.js | Bumps expected sharpVersion 0.35.3 → 0.35.5 to match the updated lockfile resolution. |
| package.json | Updates js-yaml devDependency, refreshes overrides, and adds scoped smol-toml and katex overrides. |
| package-lock.json | Syncs resolved versions/integrity for js-yaml, markdown-it, brace-expansion, smol-toml, katex, qs/side-channel chain, and the full sharp/libvips/@emnapi graph. |
🧠 Review effort: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Review確認と配布検証の補足Copilot review 5529813651 はCOMMENTED / 0 findingsですが、外部npm配布version/SRIを当該review環境で検証できないという制限が付記されています。人間のAPPROVEDとは扱いません。以下を実行環境から補足します。
代表配布のSRI（残りnative platformを含む全37件も照合済み）
対象lock SHA256: |
概要
Refs #257 / portal itdojp/it-engineer-knowledge-architecture#297。ユーザー承認済みの「限定override契約改訂案」の検証PRです。本文・公開assets・build・Node/npm・CLI本体・Pages・formatter pinは変更しません。
7bb50dae86cc57d2febf9bbaf1b828e41d8ef037a48af0b8a2f747bb683cb6036ca3646eeb30901d限定契約
既存CLI0.49.1はjs-yaml
~5.2.1を宣言していますが、公式修正版は5.4.1。上流範囲を書き換えず、CLI0.49.1 × 宣言~5.2.1 × scoped override5.4.1 × nested解決5.4.1 が一致する場合だけ監査済み例外として許可します。generic semver検査とglobal override禁止は維持。別CLI、別範囲、未監査5.4.2、ranged override等は拒否。installed packageと実CLIの正常／lint違反／不正YAMLも検査します。最小依存修正
37 dependency entriesのnpm配布tarball SHA512とlock SRIを照合、official GHSA12件は#257参照。上流CLI宣言とnpm/Node、Puppeteer25.8.0、Sharp宣言
^0.35.3、script-free/allowScripts契約は不変。Sharpの期待lock版1行のみ同期。検証
ci --ignore-scriptsとfull audit:旧C0H5M3L3→新全severity0npm run test:light: security / install-policy63negative・実npm10.9.7+12.0.1隔離fixtures / Puppeteer25mock / metadata / 章別契約 / lint / Jekyll互換性境界・未変更事項
cff9fcf8bae31140f07b358d314fc64173cb7013のfresh audit H3/M3は別件で残存。本PRのroot audit0で抑制/隠蔽せず、pin-onlyは別PR。完了証跡 — 限定override検証・通常merge・actualmain確認
PR #258 を通常matched-head squashでmergeしました。
a48af0b8a2f747bb683cb6036ca3646eeb30901d21d9ce24ae81224cde2176bbb8a28d6a3b751ddf契約・実行検証
CLI0.49.1 / upstream~5.2.1 / scoped+resolvedYAML5.4.1 のexact tuple例外のみ。global override禁止、他のCLI/範囲/未監査版拒否は維持。CodeQL17dependencynegative＋4tuplenegative/1positive、既存workflow7negative/1positive、actualCLI正常/違反/不正設定。Node22/24/npm12.0.1 fulltest成功。
root旧C0H5M3L3→candidateとactualmain fresh install/audit全severity0。npm install-scripts pending0。旧新CLI10ケース/版（nested configPointer含む）、13serialized outputs・3MathML、Sharp実caller2設定×3形式/版が一致。TOML null-prototypeとKaTeX HTML差は別途明示済み、汎用完全互換性は主張しません。37tarball SRI照合済み。
Review / CI
Publication
actualmainでfresh install/fulltest/build/canonical drift0/built29routes5assets成功。公開29routes＋2assets=31HTTP200、root/ch08/searchJS/mainCSS rawbytes不変。Chrome149 local/public root/ch08×1280/393で8DOM/4検索操作成功。mobile画像pixel差分0、desktopは検索input枠だけ差分あり・目視で本文/nav差なし（全面pixel一致とはしない）。反復build41files raw差分0。
残存・境界
本Issueはroot依存の受入条件を満たしました。現行formattercffのH3M3は別pin-only PRで扱い、root0で消えたとは扱いません。既存layoutwarning2/mobileheader clipping・searchhiddenは本文変更せず維持。CLI/Node/npm/allowScripts/build/docs/assets/Pages/pin不変。次は同repo直列の独立formatter pin検証です。