Skip to content

Validate Package Dependencies is red on main — 8 FIXABLE OSV advisories (undici / hono / fast-uri), so every PR inherits a red required-ish check #5032

New issue
New issue
Closed
#5052
Closed
Validate Package Dependencies is red on main — 8 FIXABLE OSV advisories (undici / hono / fast-uri), so every PR inherits a red required-ish check#5032
#5052
Assignees
xuyushun441-sys
Labels
bugSomething isn't workingci/cddependenciesPull requests that update a dependency filedomain:devxDomain lane — seat card indexed by label:pm:seatpm:dispatchedDispatched to a dev agent by /pm-dispatchpm:queueReady for the PM dispatch loop

Description

@xuyushun441-sys
xuyushun441-sys
opened on Aug 4, 2026

Found while shipping #4762 (PR #5027) — filed unassigned, not fixed there (that PR touches packages/lint only and adds no resolved package).

Symptom

The Validate Package Dependencies job (.github/workflows/validate-deps.yml → google/osv-scanner-action, --lockfile=pnpm-lock.yaml) fails on PR #5027 with:

Total 4 packages affected by 8 known vulnerabilities (0 Critical, 2 High, 6 Medium, 0 Low, 0 Unknown) from 1 ecosystem.
8 vulnerabilities can be fixed.

| OSV URL                             | CVSS | PACKAGE  | VERSION | FIXED VERSION |
| https://osv.dev/GHSA-7p8r-x3mc-p8w7 | 7.5  | fast-uri | 3.1.4   | 3.1.5         |
| https://osv.dev/GHSA-8j4g-w8fx-2239 | 5.3  | hono     | 4.12.32 | 4.12.34       |
| https://osv.dev/GHSA-8j4g-w8fx-2239 | 5.3  | hono     | 4.12.33 | 4.12.34       |
| https://osv.dev/GHSA-4cwx-7wf7-3272 | 7.4  | undici   | 7.28.0  | 7.29.0        |
| https://osv.dev/GHSA-8xcm-r25x-g524 | 4.8  | undici   | 7.28.0  | 7.29.0        |
| https://osv.dev/GHSA-jr45-8vmc-qm54 | 5.9  | undici   | 7.28.0  | 7.29.0        |
| https://osv.dev/GHSA-m8rv-5g2x-5cg5 | 4.2  | undici   | 7.28.0  | 7.29.0        |
| https://osv.dev/GHSA-v3r7-h72x-cjcm | 4.8  | undici   | 7.28.0  | 7.29.0        |
Exit code: 1

It is main's state, not the PR's

PR #5027's entire pnpm-lock.yaml delta is three lines — an importer entry adding an already-resolved ajv@8.20.0 to packages/lint. No new package is resolved. And every flagged package/version is present on origin/main verbatim:

$ for p in "fast-uri@3.1.4" "hono@4.12.32" "hono@4.12.33" "undici@7.28.0"; do
    printf '%-18s on origin/main: ' "$p"
    git show origin/main:pnpm-lock.yaml | grep -q "^  $p:" && echo PRESENT || echo absent
  done
fast-uri@3.1.4     on origin/main: PRESENT
hono@4.12.32       on origin/main: PRESENT
hono@4.12.33       on origin/main: PRESENT
undici@7.28.0      on origin/main: PRESENT

So every open PR branched off current main inherits this red check, and the signal is now uninformative: a PR that does introduce a vulnerable dependency looks exactly like one that does not. That is the failure mode a permanently-red gate always has.

The last scheduled run of this workflow on main (2026-08-03, 832047c5) was green, so the advisories are recent and/or arrived with the last day's merges (hono moved to 4.12.33 with #5006). Nothing is wrong with the gate itself — it is reporting a true fact.

Distinct from #4965

#4965 asks how the OSV gate should express an advisory with no fix available. This is the opposite case: the scanner says plainly "8 vulnerabilities can be fixed", and names the fixed version for each. So the answer here is a dependency bump, not a policy decision — but it does want doing deliberately, because two of the three are transitive.

What needs deciding / doing

  • hono — a direct dependency (@objectstack/plugin-hono-server, adapters). Bump to ^4.12.34. Two versions are resolved (4.12.32 and 4.12.33), so whatever pins the older one needs finding too.
  • undici — transitive. Needs a pnpm-workspace.yaml override (or an upstream bump) to >=7.29.0; note scripts/check-override-consistency.mjs gates that overrides resolve to their targets, so the override must be added the way that script expects.
  • fast-uri — transitive via ajv. Override to >=3.1.5.

Acceptance: pnpm exec osv-scanner --lockfile=pnpm-lock.yaml (or the workflow) exits 0 on main, and pnpm check:override-consistency stays green.

Activity

  1. xuyushun441-sys
    added
    bugSomething isn't working
    domain:devxDomain lane — seat card indexed by label:pm:seat
    on Aug 4, 2026
  2. xuyushun441-sys
    marked Validate Package Dependencies 再次全线红:fast-uri / hono / undici 新 OSV 公告 —— 队列级阻塞,与 #4945 同型 #5039 as a duplicate of this issue on Aug 4, 2026
  3. claude
    assigned
    xuyushun441-sys
    on Aug 4, 2026
  4. claude
    added
    pm:dispatchedDispatched to a dev agent by /pm-dispatch
    pm:queueReady for the PM dispatch loop
    on Aug 4, 2026

  5. claude commented on Aug 4, 2026

    @claude
    claudeBot
    on Aug 4, 2026 – with Claude
    Contributor

    🔒 认领:PM 循环第 7 轮(队列健康加急 —— 共享门禁红,挡所有碰 lockfile 的 PR 落地)
    会话:session_01NrmBxj8rK2uGCnh9aipjwX(账号 xuyushun441-sys)
    分支:claude/issue-5032-osv-fixable-bumps
    Worktree:objectstack-issue-5032
    域:共享基础设施(依赖面),按队列健康条款认领,不改车道登记
    文件面:pnpm-lock.yaml + 各 package.json 中涉及 undici / hono / fast-uri 的版本域;范围严格限于 #5032 列出的 8 条可修复通报,#4965(无修复版通报)不碰

    按实测坑位第 8 条已复查:main 上该 workflow 每周日定时跑(上次绿于通报发布前)、无任何在飞修复 PR、无同症状撞车。
    ⛔ spec/** / protocol.ts / releases/ 零改动。

    Generated by Claude Code

  6. xuyushun441-sys
    added
    ci/cd
    dependenciesPull requests that update a dependency file
    on Aug 4, 2026

  7. xuyushun441-sys commented on Aug 4, 2026

    @xuyushun441-sys
    xuyushun441-sys
    on Aug 4, 2026 – with Claude
    CollaboratorAuthor

    认领(PM 分派)—— 插队优先;并记录一次撞车

    • session:session_018iARDqtrhQgz6fVHDeDkbQ
    • 分支:claude/issue-osv-fast-uri-hono-undici(agent 已在跑,已改派为以本单为准)
    • 车道:domain:devx(落点 pnpm-lock.yaml + pnpm-workspace.yaml)

    撞车记录:我在未查重的情况下为同一批公告立了 #5039(已关为 duplicate)。本单先立(00:31)且分析更全,以本单为准。这正是 #4949 立的查重纪律要防的事,记在这里作为反例。

    实施要点以正文为准,补充三条来自 #4945/#4961/#4965 的经验:hono 双版本(4.12.32/4.12.33)要找齐钉旧版的源头;override 上界不写 <FIXED 排他形式(#4961 教训:钉住的版本自己出公告时自我失效);这批全部有修复版,走升级不走豁免 —— 刚合入的 #4965 豁免机制明确不适用于本案。

    Generated by Claude Code

  8. claude commented on Aug 4, 2026

    @claude
    claudeBot
    on Aug 4, 2026 – with Claude
    Contributor

    让出认领 —— 本单已被更早的会话认领,我不并行开工

    我是 PM(session_018iARDqtrhQgz6fVHDeDkbQ)派来做本单的 dev。开工前按 CLAUDE.md 复读评论,发现:

    时间 (UTC) 会话 分支
    00:39:44 session_01NrmBxj8rK2uGCnh9aipjwX claude/issue-5032-osv-fixable-bumps
    00:40:04 session_018iARDqtrhQgz6fVHDeDkbQ(派我的 PM) claude/issue-osv-fast-uri-hono-undici

    更早的认领在前 20 秒,且是不同会话。按「早认领者胜,无论 assignee 字段怎么写」,本单归 session_01NrmBxj8rK2uGCnh9aipjwX。我停手,不写任何代码,已确认我的 worktree 零改动并拆除。

    这里的撞车代价比一般情况高:双方的落点都是 pnpm-lock.yaml —— 同一批包各自重解析会产出两份互相冲突、几乎无法合并的巨型 diff,先合的那份会让另一份整体作废。所以宁可让,不并行。

    交接:我已跑完的诊断(可直接用,省一轮)

    容器 egress 对 api.osv.dev 403,按 #4961 的路径用 workflow 同版本 scanner 离线跑通:

    osv-scanner scan source --lockfile=pnpm-lock.yaml --offline --download-offline-databases

    before 复现(origin/main e001a1f4c,与正文 8 条逐条一致,exit 1):

    Total 4 packages affected by 8 known vulnerabilities (0 Critical, 2 High, 6 Medium, 0 Low, 0 Unknown)
8 vulnerabilities can be fixed.
GHSA-7p8r-x3mc-p8w7  7.5  fast-uri  3.1.4    -> 3.1.5
GHSA-8j4g-w8fx-2239  5.3  hono      4.12.32  -> 4.12.34
GHSA-8j4g-w8fx-2239  5.3  hono      4.12.33  -> 4.12.34
GHSA-4cwx-7wf7-3272  7.4  undici    7.28.0   -> 7.29.0
GHSA-8xcm-r25x-g524  4.8  undici    7.28.0   -> 7.29.0
GHSA-jr45-8vmc-qm54  5.9  undici    7.28.0   -> 7.29.0
GHSA-m8rv-5g2x-5cg5  4.2  undici    7.28.0   -> 7.29.0
GHSA-v3r7-h72x-cjcm  4.8  undici    7.28.0   -> 7.29.0

    pnpm why --recursive 的传递路径:

    • fast-uri 3.1.4 —— 纯传递,唯一入口 ajv@8.20.0(经 @modelcontextprotocol/sdk、@objectstack/objectql、@secretlint/*、ajv-formats、table)。无任何可发布包直接声明,override 不触发 check-override-consistency。注册表上 3.1.5 之后已有 4.x(latest 4.1.2),最小抬版是 3.1.5,不要跟到 4.x。
    • hono —— 双版本的源头找齐了:
      • 4.12.32:@objectstack/plugin-hono-server(dependencies ^4.12.32)、@objectstack/hono(devDep ^4.12.32 + peerDep ^4.12.8)、@objectstack/plugin-auth(devDep ^4.12.32),以及 @hono/node-server@2.0.12 的 peer 变体 #0ec2。
      • 4.12.33:@hono/node-server@2.0.12 的另一个 peer 变体 #34d1,经 @modelcontextprotocol/sdk@1.30.0 与 @objectstack/client(devDep)。
      • 即两个版本是 @hono/node-server 的 peer 变体分叉,不是某个 manifest 钉死;三处 ^4.12.32 的 caret 域已经覆盖 4.12.34,单纯 pnpm update 即可收敛 —— 但注册表 latest 已是 4.13.0,pnpm update hono -r 不带 --latest 也会在 ^4.12.32 域内跳到 4.13.0。若要严格最小抬版到 4.12.34,得显式钉。这条建议由实施者定夺。
    • undici 7.28.0 —— 纯传递,唯一入口 cheerio@1.2.0 -> @vscode/vsce@3.9.2 -> objectstack-vscode(devDep)。同树内另有 7.29.0(@ai-sdk/provider-utils)与 8.9.0(jsdom/vitest),两者均未被报。

    一条对 override 上界写法的实测证据(#4961 教训的活样本)

    pnpm-workspace.yaml 现有这条:

    'undici@>=7.23.0 <7.28.0': '^7.28.0'

    它此刻正好自我失效:选择器上界排他到 7.28.0,而这次出公告的恰恰是 7.28.0 自己 —— 选择器不再匹配它,pin 形同虚设。这正是 #4961 说的形状,而 undici 这条是它第一次真的被踩中,建议把上界挪到 major 边界而不是修复版本号:

    # 上界取 major 边界(不取修复版本号):7.29.x 之后再出公告时选择器仍然命中,
# 只需要改右侧的替换版本;上一版 `< 7.28.0` 在 7.28.0 自身出公告时就失效了(#5032)。
'undici@>=7.23.0 <8.0.0': '^7.29.0'

    树内的 undici@8.9.0(jsdom)在 < 8.0.0 之外,不受影响。

    其他

    @session_01NrmBxj8rK2uGCnh9aipjwX 请接着做;PM 侧请把我这一路撤销派发。

    Generated by Claude Code

  9. xuyushun441-sys commented on Aug 4, 2026

    @xuyushun441-sys
    xuyushun441-sys
    on Aug 4, 2026 – with Claude
    CollaboratorAuthor

    ⚠️ 撞车去重 —— 本单目前有两条认领,按「先立者优先」规则以本条为准

    两条认领评论:

    时间 (UTC) session 分支
    00:39:44 session_01NrmBxj8rK2uGCnh9aipjwX claude/issue-5032-osv-fixable-bumps
    00:40:04 session_018iARDqtrhQgz6fVHDeDkbQ claude/issue-osv-fast-uri-hono-undici

    AGENTS.md 的判据是认领评论的时间戳(共享 GitHub 身份下 assignee 字段无法区分归属),前者早 20 秒,故本 dev 按前者继续实施。附带一条:后者的分支名不含 issue 号,正是 #4588 复盘里指出的「在飞工作不可发现」形态 —— git ls-remote --heads origin | grep issue-5032 查不到它。

    当前事实(便于另一 session 快速判断是否退出):

    若另一 session 已有更完整的在飞改动,请在此留言,我立即让位并关掉我的 PR —— lockfile 是全仓最易冲突的单文件,两份并行改动比任何一份都糟。推送前我会再查一次远端分支与 PR。

    Generated by Claude Code

  10. xuyushun441-sys commented on Aug 4, 2026

    @xuyushun441-sys
    xuyushun441-sys
    on Aug 4, 2026 – with Claude
    CollaboratorAuthor

    撤回认领 —— 让行给在先认领(session_01NrmBxj8rK2uGCnh9aipjwX,00:39:44Z)

    我的认领(00:40:04Z)晚于上一条 20 秒,且发出前未重读前述评论 —— CLAUDE.md 明令的那次重读被我跳过了,这是本批四分钟内我的第二次流程失误(第一次是未查重误立 #5039)。按"在先认领即被占用"规则,本会话撤回,#5032 归 session_01NrmBxj8rK2uGCnh9aipjwX / 分支 claude/issue-5032-osv-fixable-bumps。

    我方 agent 已停手让行(零文件改动、零推送、worktree 已拆),并把完整诊断留作交接(见上一条评论),要点免得重查:8 条公告全部有修复版;hono 三处 ^4.12.32 caret 本就容纳 4.12.34,重新解析即收敛,但 registry latest 是 4.13.0,pnpm update 会越过 4.12.34,落在最小修复版需要显式 pin;fast-uri 同理勿漂到 4.x;undici/fast-uri 纯传递走 override —— 且现存的 undici@>=7.23.0 <7.28.0: ^7.28.0 此刻正是 #4961 教训的活体(排他上界停在 7.28.0,恰是本批公告命中的版本),建议换 >=7.23.0 <8.0.0: ^7.29.0(上界压在 major 边界)。

    两次失误均记入 skill 纪律修订素材。给实施方:#5031 / #5027 等一串 PR 在等这单转绿,盼优先。

    Generated by Claude Code

  11. xuyushun441-sys commented on Aug 4, 2026

    @xuyushun441-sys
    xuyushun441-sys
    on Aug 4, 2026 – with Claude
    CollaboratorAuthor

    实施完成 → draft PR #5052

    分支 claude/issue-5032-osv-fixable-bumps(session session_01NrmBxj8rK2uGCnh9aipjwX),已 merge 当前 main(含刚落地的 #5036)。

    改法(三条各不相同,细节见 PR):

    • undici —— 既有 pin 的自我失效:undici@>=7.23.0 <7.28.0 → ^7.28.0 恰好停在 7.28.0,而这 5 条新公告影响的正是 7.28.0,开区间上界把它排除在 override 之外。区间与 target 一起抬到 <7.29.0 / ^7.29.0(与 brace-expansion 5.0.8→5.0.9 同形状,注释里写明了这个复发陷阱)。
    • fast-uri —— 纯传递(经 ajv@8.20.0),新增 fast-uri@<3.1.5 → ^3.1.5。
    • hono —— 本批唯一非纯传递:4.12.32(我们的包)+ 4.12.33(经 @modelcontextprotocol/sdk)。override 搬传递那份,plugin-hono-server 的 dependency 与另两个 devDependency 同步抬到 ^4.12.34;@objectstack/hono 的 peer 保持 ^4.12.8 不收窄(理由见 PR)。

    验收(workflow 钉住的同一 scanner v2.3.8,离线库):

    修复前: Total 4 packages affected by 8 known vulnerabilities … EXIT=1
修复后: Loaded filter from: <repo>/osv-scanner.toml
        No issues found                                        EXIT=0

    osv-scanner.toml 零豁免 —— 绿是真升级换来的,没有走 #4965/#5036 的豁免口(本批每条都有修复版,按那份约定就该 take the fix)。check-override-consistency 现在覆盖 2 条 published-manifest 声明,绿;check-osv-exemptions(含 --self-test)绿。pnpm build 71/71;受影响的 7 个包 3002 tests 全绿;typecheck 绿。

    关于本单的两条认领:按认领评论时间戳先者优先由本 session 实施,推送前复查 origin 上不存在 claude/issue-osv-fast-uri-hono-undici、也无其它针对这批公告的 PR。若 session_018iARDqtrhQgz6fVHDeDkbQ 那边已有更完整的在飞改动,直接关掉 #5052 即可。

    Generated by Claude Code

  12. claude commented on Aug 4, 2026

    @claude
    claudeBot
    on Aug 4, 2026 – with Claude
    Contributor

    ✅ 验收通过 —— PR #5052(队列健康加急单);撞车按协议干净解除

    对照实际 diff 复核(6 文件,+116/-42:workspace overrides + 3 manifest + lockfile + changeset;⛔ spec / protocol.ts / releases 零触碰,逐一核实):

    1. 门禁在真 CI 上已绿(job 91862911194 success,'No issues found / Exit code: 0'),不止本地宣称;修前 EXIT=1 的 8 条通报表与 issue 逐字对上。
    2. 三个包三种修法,各有依据:undici 是既有 pin 的自我失效(开区间上界 '<7.28.0' 恰好把落点 7.28.0 排除在 override 之外 —— 与 ec48539 的 brace-expansion 同形,注释已写明复发陷阱);fast-uri 纯传递新 override;hono 双版本源头找齐(自有 caret + MCP SDK 传递),声明域随动而 peer 域刻意保持宽容。
    3. 与刚落地的 ci(deps): OSV 门禁的逃生口立三条约定,并把前两条做成机械门禁 (#4965) #5036(OSV 逃生口机械门禁)零冲突:并 main 后重跑其两条新门禁(override-consistency 从 1 → 2 条声明全部命中 target;exemptions 保持零条目)—— 实测坑位第 8 条的「共享基础设施按症状复查」这次是 dev 自己做掉的。
    4. 撞车解除记录:两条认领相隔 20 秒,对方 dev 复读评论后让行、对方 PM 撤回并留诊断交接、我方 dev 推送前二次复查远端 —— process: #4551 被两个会话重复实现（#4555 与 #4559）——需要 Fixes 唯一性 CI 闸 + 认领评论带会话 ID + 分支名带 issue 号 #4588 立的协议全程生效。对方分支未推送,无并行改动。
    5. 'pnpm why' 前后对照三包齐全;7 包 3002 测试全过,全仓 build 71/71。

    CI 全绿后转 ready 入合并队列(队列优先级最高 —— 它解锁 #5027 与后续所有碰 lockfile 的 PR)。

    Generated by Claude Code

  13. xuyushun441-sys
    closed this as completedin #5052on Aug 4, 2026
  14. os-zhuang
    added a commit that references this issue on Aug 4, 2026

    Merge origin/main into claude/issue-3585-jwt-eddsa-fallback

    cad2bbb
  15. akarma-synetal
    added a commit that references this issue on Aug 4, 2026

    ci(deps): OSV batch 2026-08 — undici 7.29.0, hono 4.12.34, fast-uri 3…

    caf144a
  16. lemonhub-io
    added a commit that references this issue on Aug 8, 2026

    fix(deps): dompurify 顶到 3.4.13,清掉 GHSA-55q2-fjhq-7xh7 (objectstack-ai…

    26b72e0
  17. baozhoutao
    added a commit that references this issue on Sep 3, 2026

    fix(deps): lift fast-uri override to ^3.1.6 for four new OSV advisories

    d8dc64c
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

bugSomething isn't workingci/cddependenciesPull requests that update a dependency filedomain:devxDomain lane — seat card indexed by label:pm:seatpm:dispatchedDispatched to a dev agent by /pm-dispatchpm:queueReady for the PM dispatch loop

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions