deps: @azure/msal-node GHSA-xcx6-jx8p-x3h5 (high) stays in the lockfile until an @azure/identity release admits msal-node 7.1.0

Filing gate ①: a named advisory, measured on main, that its producer card (#25631, PR #25657) could not clear. Filed by the domain:devx seat (seat post #6023, session session_01LKHDniRQSWjRJyDtacwpEd). ⛔ Not a claim.
Business reason: once #25657 lands, this is the only high left in pnpm audit --prod for the framework, so --audit-level=high keeps exiting 1. The vulnerable path is used only by a deployment that installs the optional mssql driver and signs in to Azure AD through it.
Reader: the domain:devx lane, when the upstream release named below ships. Until then the card is pm:blocked.
Dedupe (open AND closed): "msal-node GHSA-xcx6-jx8p-x3h5 azure identity tedious" → 0 hits besides #25631.
reach: optional driver path, measured once (#25631 os-dev-report, comment 6385752021).
type: Bug

Measured

@azure/msal-node 5.4.1 resolves through @azure/identity 4.13.1 (which declares ^5.1.0), under tedious 18.6.2. tedious sits under @objectstack/driver-sql's optional mssql peer.
The fix for GHSA-xcx6-jx8p-x3h5 exists only in msal-node 7.1.0.
No @azure/identity release admits 7.1.0: both 4.14.0 and 4.15.0-beta.1 declare ^6.0.0.
Forcing msal-node to 7.x with a pnpm.overrides entry would take it two majors past identity's declared range, on a sign-in path no test in this workspace runs. Dependency advisories in the framework lockfile: zod below 4.6.6 (GHSA-mrhx-c7xc-m3w5) blocks every consumer's fix; pnpm audit --prod on the pin reads 5 critical and 10 high #25631 left it out on purpose and recorded why in pnpm-workspace.yaml.

Wanted

When an @azure/identity release admits @azure/msal-node ≥ 7.1.0, take it: lift the override or the lockfile, regenerate with pnpm, and confirm that pnpm audit --prod --audit-level=high exits 0.
Until that release exists, nothing is to be built. If the maintainer prefers to force the override now, that is the maintainer's decision, and it needs an mssql/Azure AD sign-in test before it lands.

Half-state closed: `pm:blocked` → `pm:on-hold` · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-25T01:46Z

The card waits on an upstream release, not on a card, so it had no Blocked-by: target the unlock scan could read. Grade unchanged. ⛔ Not a claim.

Read today: npm view @azure/identity latest is 4.14.0, which still declares @azure/msal-node: ^6.0.0. No release admits the 7.1.0 fix yet.

Restart-when: npm view @azure/identity@latest dependencies declares an @azure/msal-node range that admits 7.1.0 or later

Generated by Claude Code

domain:devx#1 · os-zhuang · session_01QUs3BvP5Aq9USg5GtmgAAR

Wake: pm:on-hold → pm:queue · 2026-10-31T07:48Z — the Restart-when: line of the triage hold (2026-10-25T01:46Z) now holds. ⛔ Not a claim.

Probe	Reading
`npm view @azure/identity@latest version`	`4.14.1` (published 2026-10-29T22:16Z)
`npm view @azure/identity@latest dependencies`	`'@azure/msal-node': '^7.1.0'` — admits the GHSA-xcx6-jx8p-x3h5 fix
`npm view tedious@18.6.2 dependencies`	`'@azure/identity': '^4.2.1'` — 4.14.1 sits inside it, so no `tedious` bump and no override is needed
`pnpm-lock.yaml` on `origin/main`	still `@azure/identity@4.13.1` → `@azure/msal-node@5.4.1`

Re-derived scope: refresh the lockfile so tedious resolves @azure/identity 4.14.1 (msal-node 7.x), drop the "NOT cleared" note in pnpm-workspace.yaml (lines ~729–735), and show pnpm audit --prod --audit-level=high exits 0. The card's "Wanted" section is unchanged; nothing in it needed the maintainer's override ruling.

State change: pm:on-hold removed, pm:queue added in this stroke.

domain:devx#1 · os-zhuang · session_01QUs3BvP5Aq9USg5GtmgAAR

Claim: PM loop round 2
Session: session_01QUs3BvP5Aq9USg5GtmgAAR
Account: os-zhuang
Branch: claude/project-thread-2bmn7u (the card thread's platform-assigned push branch, the measured platform exception to the protocol branch shape)
Worktree: objectstack-issue-25676
Domain: domain:devx
Seat: domain:devx#1
File surface: pnpm-lock.yaml, pnpm-workspace.yaml (stop on breach; explain in the report)
Container & model: S, mode:thread, model: default (targeted lockfile refresh), effort: medium (p3, two files)
Clause-②: no
Metadata-protocol: none
Responsibility: the lockfile's @azure/msal-node resolution | pnpm audit --prod --audit-level=high | every audit run; no product change
Thread-read: 6540799369
Premise: holds (wake reading 6540799369: @azure/identity@latest 4.14.1 declares @azure/msal-node ^7.1.0; tedious@18.6.2 declares @azure/identity ^4.2.1; origin/main lockfile still pins identity 4.13.1 → msal-node 5.4.1)
Serial constraints cleared: no in-flight card names pnpm-lock.yaml (#27114 / PR #28375 touches packages/cli/test only); none

check-governed-merges.mjs --test pnpm-lock.yaml pnpm-workspace.yaml → NOT governed.

{
  "issue": 25676,
  "status": "pr-open",
  "branch": "claude/project-thread-2bmn7u",
  "pr": 28377,
  "summary": "Lockfile-only move: tedious 18.6.2 now resolves @azure/identity 4.14.1 (was 4.13.1) and @azure/msal-node 7.1.2 (was 5.4.1), inside both declared ranges; no override added. Targeted re-resolve of the identity/msal/tedious entries with pnpm 10.31.0; frozen-lockfile check clean. The NOT-cleared msal-node note in pnpm-workspace.yaml is removed. pnpm audit --prod --audit-level=high exits 0 (exit 1 on main); left in --prod: one moderate, minimatch GHSA-g3hv-75wg-m249, already exempted on main. Files: pnpm-lock.yaml, pnpm-workspace.yaml only."
}

Generated by Claude Code

domain:devx#1 · os-zhuang · session_01QUs3BvP5Aq9USg5GtmgAAR

Landing paused · 2026-10-31T07:57Z — PR #28377 is ACCEPTed, but Check Changeset is red: the PR adds no changeset. The diff is lockfile-only (pnpm-lock.yaml, pnpm-workspace.yaml comment), so no published package changes and the check's own instruction is to apply skip-changeset.

The seat's label-write.mjs --issue 28377 --add skip-changeset was refused by this session's action classifier. Per the seat rule the seat does not retry under another spelling; the call is with the maintainer, either to apply skip-changeset on PR #28377 or to tell the seat to. The rest of CI is still running. ⛔ Not a state change.

domain:devx#1 · os-zhuang · session_01QUs3BvP5Aq9USg5GtmgAAR

Landed · 2026-10-31T10:10Z — PR #28377 merged through the queue as fa74b48930.

Probe	Result
PR #28377	merged, `merged=true`
Content on origin/main	`pnpm-lock.yaml`, `pnpm-workspace.yaml` — blob sha1 identical to PR head `318cdbe1`
`skip-changeset`	applied by the seat on the maintainer's decision-card answer (lockfile-only, releases nothing)

GHSA-xcx6-jx8p-x3h5 is cleared: @azure/msal-node 7.1.2 via @azure/identity 4.14.1, no override.

State change: card closed completed by Fixes; pm:dispatched removed in this stroke.

Navigation Menu

Repository navigation

deps: @azure/msal-node GHSA-xcx6-jx8p-x3h5 (high) stays in the lockfile until an @azure/identity release admits msal-node 7.1.0 #25676

Measured

Wanted

Half-state closed: `pm:blocked` → `pm:on-hold` · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-25T01:46Z

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

deps: @azure/msal-node GHSA-xcx6-jx8p-x3h5 (high) stays in the lockfile until an @azure/identity release admits msal-node 7.1.0 #25676

Description

Measured

Wanted

Activity

objectstack-fleet commented on Oct 25, 2026

Half-state closed: pm:blocked → pm:on-hold · triage seat · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-25T01:46Z

objectstack-fleet commented on Oct 31, 2026

objectstack-fleet commented on Oct 31, 2026

os-zhuang commented on Oct 31, 2026

objectstack-fleet commented on Oct 31, 2026

objectstack-fleet commented on Oct 31, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Half-state closed: `pm:blocked` → `pm:on-hold` · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-25T01:46Z