From c0700692913a32dc51c4ee8be200bb58f4011eea Mon Sep 17 00:00:00 2001 From: Robert DeLanghe <1240090+bdelanghe@users.noreply.github.com> Date: Tue, 27 Oct 2026 09:21:25 -0400 Subject: [PATCH 1/2] deps: fast-uri ^3.1.9 (osv red) Clears the 7 fast-uri 3.1.6 advisories osv-scan reports (GHSA-58mr-gqgx-xq4g, GHSA-qw65-cvwx-89v3, GHSA-333x-w4r6-6crp, GHSA-hrr3-gc8f-f4qj, GHSA-w74x-v6f9-j3xg, GHSA-wjr9-j795-jxcr, GHSA-xhq7-xmqj-769h) by raising the existing rung-3 import-map override. Lock regenerated with deno install; only the fast-uri entry moved. Refs #49 (zod 3 -> 4 and markdown-it via lume remain open there) Co-Authored-By: Claude Opus 5.5 (1M context) Claude-Session: https://claude.ai/code/session_0117AAnztxdG2tNqQSCsQB7q --- deno.json | 2 +- deno.lock | 8 ++++---- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/deno.json b/deno.json index 1f29d68..479db5a 100644 --- a/deno.json +++ b/deno.json @@ -43,7 +43,7 @@ // Accepting this one would have been wrong — it is fixable, and 7.5 is the // highest severity this lane has flagged here since the linkify-it 8.7. // Remove once deno advances the transitive unaided. - "fast-uri": "npm:fast-uri@^3.1.6", + "fast-uri": "npm:fast-uri@^3.1.9", "ajv-formats": "npm:ajv-formats@^3.0.1", "deno-dom-wasm": "https://deno.land/x/deno_dom/deno-dom-wasm.ts", "lume/": "https://deno.land/x/lume@v3.2.5/", diff --git a/deno.lock b/deno.lock index 6781d97..bafddb9 100644 --- a/deno.lock +++ b/deno.lock @@ -36,7 +36,7 @@ "npm:ajv-formats@^3.0.1": "3.0.1_ajv@8.20.0", "npm:ajv@^8.17.1": "8.20.0", "npm:esbuild@0.28.0": "0.28.0", - "npm:fast-uri@^3.1.6": "3.1.6", + "npm:fast-uri@^3.1.9": "3.1.9", "npm:lightningcss-wasm@1.32.0": "1.32.0", "npm:markdown-it-attrs@4.5.0": "4.5.0_markdown-it@14.1.1", "npm:markdown-it-deflist@3.0.0": "3.0.0", @@ -450,8 +450,8 @@ "fast-deep-equal@3.1.3": { "integrity": "sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q==" }, - "fast-uri@3.1.6": { - "integrity": "sha512-7Ical1vFEMr0onbVzEDIreM22I4khW+fzyQPwvAFWBp1iwdshSZRsL4jjRvPG9JP1uiqMHRto+YU6R2/CzDz5Q==" + "fast-uri@3.1.9": { + "integrity": "sha512-hS/0Wt3Ya043oKXs0sIxrMpKQITXhMLIrVAKKXi4gozGC9v7YRWVnXIZzjNPTO02M9BdxLCWqK1yRXgNziVyJQ==" }, "json-schema-traverse@1.0.0": { "integrity": "sha512-NM8/P9n3XjXhIZn1lLhkFaACTOURQXjWhV4BA/RnOv8xvgqtqpAX9IO4mRQxSx1Rlo4tqzeqb0sOlruaOy3dug==" @@ -720,7 +720,7 @@ "jsr:@std/path@^1.1.4", "npm:ajv-formats@^3.0.1", "npm:ajv@^8.17.1", - "npm:fast-uri@^3.1.6", + "npm:fast-uri@^3.1.9", "npm:zod@^3.25.76" ] } From ba02aa716892c187e252db1de26ebe8e9a80cfe5 Mon Sep 17 00:00:00 2001 From: Robert DeLanghe <1240090+bdelanghe@users.noreply.github.com> Date: Tue, 27 Oct 2026 09:25:31 -0400 Subject: [PATCH 2/2] osv: accept lume-pinned markdown-it advisories until 2026-11-27 (build-time, trusted input), re-date the two existing entries Refs #51. Co-Authored-By: Claude Opus 5.5 (1M context) Claude-Session: https://claude.ai/code/session_0117AAnztxdG2tNqQSCsQB7q --- osv-scanner.toml | 28 +++++++++++++++++++++++++--- 1 file changed, 25 insertions(+), 3 deletions(-) diff --git a/osv-scanner.toml b/osv-scanner.toml index 27d2bc4..bcb4ce6 100644 --- a/osv-scanner.toml +++ b/osv-scanner.toml @@ -1,6 +1,8 @@ # Acceptances for the shared osv-scan lane. See ci-workflows/REMEDIATION.md. # -# Two entries, both reached only through lume's exact npm pins, both dated. +# Six entries, all reached only through lume's exact npm pins, all dated. 2026-10-27: the two original +# entries were re-checked (lume v3.2.5 is still the newest and still pins markdown-it 14.1.1 and esbuild 0.28.0) +# and re-dated to 2026-11-27; four new markdown-it advisories were added on the same footing (bounded-systems/fold-engine#51). # Everything else this repo was failing on — 8 of 9 advisories, including a # CVSS 8.7 in linkify-it — was FIXED at rungs 1 and 2, not accepted. # @@ -18,10 +20,30 @@ [[IgnoredVulns]] id = "GHSA-6v5v-wf23-fmfq" -ignoreUntil = 2026-10-31 +ignoreUntil = 2026-11-27 reason = "MARKDOWN-IT. 14.1.1, fixed in 14.2.0. Reached only through lume, whose deps/markdown_it.ts pins npm:markdown-it@14.1.1 EXACTLY — checked v3.2.2, v3.2.4 and v3.2.5, the newest published, and all three carry the same exact pin, so rung 2 is exhausted. Rung 3 was attempted and does not apply: promoting markdown-it to a direct import in deno.json leaves the lock resolving 14.1.1, because an import-map entry can only redirect a BARE specifier and lume's is fully qualified. Nothing in src/ imports markdown-it directly. Remaining options were this or vendoring lume. Severity 5.3, the lowest of the nine findings this lane surfaced here. REMOVE THIS when lume's deps/markdown_it.ts moves to >=14.2.0 — check with: curl -s https://deno.land/x/lume@/deps/markdown_it.ts | grep markdown-it, and get from https://cdn.deno.land/lume/meta/versions.json" [[IgnoredVulns]] id = "GHSA-g7r4-m6w7-qqqr" -ignoreUntil = 2026-10-31 +ignoreUntil = 2026-11-27 reason = "ESBUILD. 0.28.0, affected range is introduced 0.27.3 / fixed 0.28.1 — so this is narrow, and no lume release pins inside the fixed window: v3.2.2 pins 0.27.3, v3.2.4 and v3.2.5 pin 0.28.0. Same exact-pin structure as the markdown-it entry above, so rungs 1-3 fail for the same reason: nothing in src/ imports esbuild, and an import-map entry cannot redirect lume's fully-qualified specifier. Introduced BY the lume v3.1.4 -> v3.2.5 bump in this PR, deliberately and with the trade recorded in the header comment. CVSS 2.5, and the vector is local with integrity-only impact (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N) — it needs local access to a build host, which is a narrower exposure than the 8.7 this bump helped clear. REMOVE THIS when lume pins esbuild >=0.28.1 — check with: curl -s https://deno.land/x/lume@/deps/esbuild.ts | grep esbuild, and get from https://cdn.deno.land/lume/meta/versions.json" + +[[IgnoredVulns]] +id = "GHSA-253c-mchw-3w2r" +ignoreUntil = 2026-11-27 +reason = "MARKDOWN-IT 14.1.1 (CVSS 6.3), fixed in 14.3.3. Reached only through lume v3.2.5's deps/markdown_it.ts, which pins npm:markdown-it@14.1.1 EXACTLY; v3.2.5 is the newest lume (checked 2026-10-27), and an import-map entry cannot redirect lume's fully qualified specifier (see the GHSA-6v5v-wf23-fmfq entry). Exposure: markdown-it runs at BUILD time in src/unfold/site/site.ts over this repo's own content and Bobby's own vault, never over third-party or request-time input. Decided by recommendation in fold-engine#51 (accept, dated) over vendoring lume. REMOVE THIS when lume pins markdown-it >=14.3.3; same check as the GHSA-6v5v-wf23-fmfq entry." + +[[IgnoredVulns]] +id = "GHSA-gfr2-rv44-r23c" +ignoreUntil = 2026-11-27 +reason = "MARKDOWN-IT 14.1.1 (CVSS 7.5), fixed in 14.3.3. Reached only through lume v3.2.5's deps/markdown_it.ts, which pins npm:markdown-it@14.1.1 EXACTLY; v3.2.5 is the newest lume (checked 2026-10-27), and an import-map entry cannot redirect lume's fully qualified specifier (see the GHSA-6v5v-wf23-fmfq entry). Exposure: markdown-it runs at BUILD time in src/unfold/site/site.ts over this repo's own content and Bobby's own vault, never over third-party or request-time input. Decided by recommendation in fold-engine#51 (accept, dated) over vendoring lume. REMOVE THIS when lume pins markdown-it >=14.3.3; same check as the GHSA-6v5v-wf23-fmfq entry." + +[[IgnoredVulns]] +id = "GHSA-r7fv-28h4-cvq7" +ignoreUntil = 2026-11-27 +reason = "MARKDOWN-IT 14.1.1 (CVSS 7.5), fixed in 14.3.3. Reached only through lume v3.2.5's deps/markdown_it.ts, which pins npm:markdown-it@14.1.1 EXACTLY; v3.2.5 is the newest lume (checked 2026-10-27), and an import-map entry cannot redirect lume's fully qualified specifier (see the GHSA-6v5v-wf23-fmfq entry). Exposure: markdown-it runs at BUILD time in src/unfold/site/site.ts over this repo's own content and Bobby's own vault, never over third-party or request-time input. Decided by recommendation in fold-engine#51 (accept, dated) over vendoring lume. REMOVE THIS when lume pins markdown-it >=14.3.3; same check as the GHSA-6v5v-wf23-fmfq entry." + +[[IgnoredVulns]] +id = "GHSA-vfgh-jcmw-g37q" +ignoreUntil = 2026-11-27 +reason = "MARKDOWN-IT 14.1.1 (CVSS 3.7), fixed in 14.3.3. Reached only through lume v3.2.5's deps/markdown_it.ts, which pins npm:markdown-it@14.1.1 EXACTLY; v3.2.5 is the newest lume (checked 2026-10-27), and an import-map entry cannot redirect lume's fully qualified specifier (see the GHSA-6v5v-wf23-fmfq entry). Exposure: markdown-it runs at BUILD time in src/unfold/site/site.ts over this repo's own content and Bobby's own vault, never over third-party or request-time input. Decided by recommendation in fold-engine#51 (accept, dated) over vendoring lume. REMOVE THIS when lume pins markdown-it >=14.3.3; same check as the GHSA-6v5v-wf23-fmfq entry."