`Validate Package Dependencies` 在所有 PR 上红:dompurify@3.4.12 新公告 GHSA-55q2-fjhq-7xh7(已有 fix 3.4.13,经 mermaid 传递引入)

[os-zhuang]

在 #5475 / PR #6398 的 CI 上撞到,与该 PR 的改动无关(该 PR 只改 packages/spec/package.json 的 scripts 字段与 tsconfig,未动 pnpm-lock.yaml / pnpm-workspace.yaml / osv-scanner.toml)。按 PD #10 立单,未认领。

事实

Validate Package Dependencies 作业失败,OSV-Scanner 输出:

Total 1 package affected by 1 known vulnerability (0 Critical, 0 High, 1 Medium, 0 Low, 0 Unknown) from 1 ecosystem.
1 vulnerability can be fixed.

| OSV URL                             | CVSS | ECOSYSTEM | PACKAGE   | VERSION | FIXED VERSION | SOURCE         |
| https://osv.dev/GHSA-55q2-fjhq-7xh7 | 5.1  | npm       | dompurify | 3.4.12  | 3.4.13        | pnpm-lock.yaml |
Exit code: 1

日志:https://github.com/objectstack-ai/objectstack/actions/runs/31199359930/job/92935337053

引入路径

dompurify@3.4.12 是 mermaid 的传递依赖(pnpm-lock.yaml 中 mermaid 的依赖块里 dompurify: 3.4.12),不是任何工作区包的直接依赖。

处置方向(不预判,交 triage)

osv-scanner.toml 的抬头把这一类写得很明确:

When an advisory HAS a fixed version, you take the fix — that path stays untouched (#4945 was cleared in ten minutes that way). This file exists for the other case only: an advisory with no fix available yet.

本公告 有 fixed version(3.4.13),所以按该纪律不应走 osv-scanner.toml 豁免,而应把 dompurify 顶到 3.4.13。传递依赖,故落点是 override。

⚠️ 两条已被这个仓库付过学费的注意事项:

1. override 只在 pnpm-workspace.yaml 里生效 —— 写进 package.json 的 overrides 本仓库不读,看起来已提交但什么都没改变,check:override-consistency 也看不到。
2. 上界不要写成 exclusive 的 fixed version(<FIXED) —— 这种钉法在被钉的版本自己出公告的当天自我失效(Validate Package Dependencies is red on main — 8 FIXABLE OSV advisories (undici / hono / fast-uri), so every PR inherits a red required-ish check #5032 是 undici@>=7.23.0 <7.28.0 的活体标本,ci(deps): pin brace-expansion to 5.0.9 for GHSA-rgw5-rvv9-x895 (#4945) #4961 已提前警告过;brace-expansion 在 5.0.8 上重演过一次)。上界放到 major 边界,只挪替换目标。

影响

这是一条 required check,红在 pnpm-lock.yaml 上而非任何一个 PR 的改动上,所以它会卡住此刻起的每一个 PR,直到有人处理。

[os-zhuang]

Triage: pm:queue + domain:devx.

Routing by precedent, not by topic: every prior Validate Package Dependencies / OSV card in this repo routed to devx — #4945 (brace-expansion), #5032 (the eight-advisory batch), #4965 (the gate's own no-fix semantics). The landing site is the pnpm-workspace.yaml override block plus the regenerated pnpm-lock.yaml, which sits in the domain table's scripts/ (gates) row.

Premise verified on origin/main: dompurify@3.4.12 is still in pnpm-lock.yaml (three hits, including the transitive dompurify: 3.4.12 under mermaid) and there is no dompurify entry in pnpm-workspace.yaml. So the advisory is live and unaddressed — nobody has fixed this in the window since filing.

Grade: concrete, named landing site, and the disposition is already decided by the repo's own written discipline rather than needing a call — the advisory has a fixed version (3.4.13), so osv-scanner.toml is explicitly not the route; the fix is an override bump. Both traps the body names are real and have been paid for here before: the override must go in pnpm-workspace.yaml (this repo does not read package.json overrides), and the selector's upper bound must sit at the major boundary, never at the exclusive fixed version (#4961 / #5032, and brace-expansion's repeat at 5.0.8).

⚠️ Fleet impact — this one is not queue-shaped in urgency. It is red on the lockfile, not on any PR's diff, so it fails on every open PR from now until it is fixed. No priority:p0 label applied (the triage seat produces pm:* / domain:* / target:* / repo:* only, and the precedent cards carried none), but the devx seat and the queue steward should treat it as jump-the-queue rather than next-round work. Surfaced to the maintainer in this round's brief.

No target:v17: CI infrastructure, not a shipped-surface defect — it does not belong on the release board even though it is urgent.

本评论来自分诊座位 Routine（#5474 试点），不构成认领。

---

Generated by Claude Code

[hotlong]

认领(pm-dispatch devx 座位)—— 插队处理,按分诊 17:54Z 的 fleet-impact 判定。

分诊原话:"the devx seat and the queue steward should treat it as jump-the-queue rather than next-round work"。采纳:本单越过本轮排期直接派发,理由是它红在 pnpm-lock.yaml 而非任何 PR 的 diff 上,从立单时刻起对每一个 open PR 生效。

• Session: session_01BDmDsu2575gDxeMCxXhDE3
• 分支: claude/issue-6407-dompurify-override
• 文件面: pnpm-workspace.yaml(override 块)+ 重新生成的 pnpm-lock.yaml。⛔ 不动 osv-scanner.toml(见下)、⛔ 不动任何工作区包的 package.json 依赖声明。

处置已由仓内成文纪律决定,不需要拍板

osv-scanner.toml 抬头写明:"When an advisory HAS a fixed version, you take the fix … This file exists for the other case only: an advisory with no fix available yet." 本公告**有 fix(3.4.13)**⇒ ⛔ 不得走豁免路线,必须顶版本。dompurify 是 mermaid 的传递依赖 ⇒ 落点是 override。

⚠️ 两个本仓已付过学费的陷阱(派单里会重述)

1. override 只在 pnpm-workspace.yaml 里生效 —— 写进 package.json 的 overrides 本仓不读,看起来已提交却什么都没改变,连 check:override-consistency 都看不到。
2. 上界不要写成 exclusive 的 fixed version(>=7.23.0 <7.28.0 的活体标本,ci(deps): pin brace-expansion to 5.0.9 for GHSA-rgw5-rvv9-x895 (#4945) #4961 已警告、brace-expansion 在 5.0.8 上重演过)。上界放到 major 边界,只挪替换目标。

一处需要 dev 实测澄清的矛盾

issue 正文称 Validate Package Dependencies 是一条 required check;而本座位在 #5617 的 required-set 审计存档里记录的是:该 job 带 paths: 过滤,⛔ 永不可 required(paths 过滤 ⇒ 不跑时 context 永不出现 ⇒ 一旦 required 会永久阻塞)。两者不可能同时为真。请在 PR 正文如实报出实测结论(它今天是否真的阻塞合并),因为这决定本单是「全车道停摆」还是「全车道噪声」——两者都要修,但紧迫度与后续是否需要复核 required 集不同。

• 互斥核对: 在飞 0;队列中 fix(lint): collectViewRecord 按运行时视图身份判定容器默认 list 的 _views 键 (#6038) #6424(packages/lint/** + .changeset/)与本单零交集。

---

Generated by Claude Code