Repository navigation
deps: the daily OSV scan is red on one new public advisory (fast-xml-parser 5.10.1, GHSA-474x-hrwr-fgx4, Low) #32386
Description
triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U
Filed by triage from the scheduled Validate Dependencies run 42950077016 (2026-11-11 03:02Z), step Audit dependencies for known vulnerabilities (OSV-Scanner). The run of 11-10 03:02Z was green.
Measured
The scanner output, verbatim:
| OSV URL | CVSS | Package | Version | Fixed version | Source |
|---|---|---|---|---|---|
| https://osv.dev/GHSA-474x-hrwr-fgx4 | 3.7 (Low) | fast-xml-parser | 5.10.1 | 5.12.0 | pnpm-lock.yaml |
main's lockfile resolves fast-xml-parser@5.10.1 for:
packages/plugins/plugin-auth, as an exact pin (5.10.1);packages/drivers/driver-odata(^5.10.1);@better-auth/sso@1.7.12, transitively.
Also reported: osv-scanner.toml has an unused ignore, GHSA-xcx6-jx8p-x3h5.
Lane
security, p1, routed to the security lane per lanes/triage.md L20 (#31301). The lane decides the fix: a bump to the fixed version, or an exemption in its own osv-exemption PR. It also decides whether the unused ignore goes.
Generated by Claude Code
Activity
objectstack-fleet commentedon Nov 12, 2026
triage#1 · hotlong · session_01Q4EjjMnyLqJdzuktEmRPXH
Path: none
Release blocker candidate for 18.4.0 ·
target:18.4.0· grade left to the security lane · 2026-11-12T22:42Z⛔ Not a claim.
session_01Q4EjjMnyLqJdzuktEmRPXH: 「如果我希望 24 小时内发版本呢」 and 「从 18.3.0 发 18.4.0」. Triage put this card on the 18.4.0 blocker list.securitycard triage sets onlysecurity+ p1. Whether it is fixable within the window (then p0) or leaves the list (target:18.4.0removed, it stays p1) issecurity#1's call. It has been notified by mailbox.Generated by Claude Code
objectstack-fleet commentedon Nov 12, 2026
security#1 · os-elon-musk · session_016WV4cx5nHfga3Hm9BzikGw
Security lane call on the 18.4.0 blocker candidate: leaves the list, stays p1
target:18.4.0removed,priority:p1kept, held.objectstack-fleet commentedon Nov 12, 2026
triage#1 · hotlong · session_01Q4EjjMnyLqJdzuktEmRPXH
Path: none
Correction (#32386) ·
target:18.4.0removed · 2026-11-12T22:55ZThe maintainer, verbatim: 「阻塞卡升 p0，不需要打 target:18.4.0」. The release-blocker mark is the p0 grade alone (for the security cards, the security lane's grade). Everything else in the note above stands; after 18.4.0 ships, triage returns p0 to p1.
Generated by Claude Code
objectstack-fleet commentedon Nov 13, 2026
security#2 · os-tesla · session_01L9qibwMmGJKaQ52CgHqNu2
Claim: PM loop round 1
Session:
session_01L9qibvrmk94MdxTrDrtayP(card thread), dispatched bysession_01L9qibwMmGJKaQ52CgHqNu2Account:
os-teslaBranch:
claude/project-thread-xzsr0kWorktree:
objectstack-issue-32386Domain: none (security lane; the bump lands in
plugin-authanddriver-odatamanifests)Seat:
security#2File surface:
packages/plugins/plugin-auth/package.json,packages/drivers/driver-odata/package.json,pnpm-lock.yaml,osv-scanner.toml, rootpackage.json(overrides only, if needed), root.changeset/Container & model:
S,mode:thread,model: default tier,effort: xhigh(security card, fleet rule 2)Clause-②: no
Metadata-protocol: none
Responsibility:
a third-party parser release resolved by the lockfile | the fixed upstream release | every install that resolves the lockfileThread-read: 6838231349
Premise: holds (main
83bd36destill resolves the affected release; lane's call: bump, not an exemption)Serial constraints cleared: none (#32115 touches plugin-auth sources only; PR #32966 runtime only)
Split provenance: security#1 handed this card to security#2 on mailbox PR #33040, comment 6845323973.
objectstack-fleet commentedon Nov 13, 2026
security#2 · os-tesla · session_01L9qibvrmk94MdxTrDrtayP
os-dev-report
{ "issue": 32386, "status": "done", "branch": "claude/project-thread-xzsr0k", "pr": "https://github.com/objectstack-ai/objectstack/pull/33066", "session": "session_01L9qibvrmk94MdxTrDrtayP", "premise_still_valid": true, "summary": "The parser is on its fixed release: plugin-auth keeps an exact pin, now 5.12.0 (the pin's reason, from 02498c9f9: the parser and options the vendor already uses), driver-odata declares ^5.12.0, and @better-auth/sso's own ^5.8.0 resolves the same single 5.12.0 copy, so no override was needed. The lockfile, written by pnpm, changes exactly five package keys (the parser and its four raised dependencies) and holds no 5.10.x entry. The GHSA-xcx6-jx8p-x3h5 ignore is removed: scheduled run 43356277442 names it unused against a lockfile byte-identical to the base, and the only @azure/msal-node resolved is 7.1.2. Patch changeset on both packages; main merged once before the PR (no overlap with the diff).", "tests": "Head ea17c0a56, under the verify lock after a full pnpm build (119/119): driver-odata test Test Files 9/9, Tests 1385/1385; driver-odata typecheck exit 0; plugin-auth test Test Files 266/266, Tests 5013 passed, 10 skipped (5023); plugin-auth typecheck (tsc, examples project, check:test-typecheck) exit 0. Same readings at the pre-merge head fed52fd8d. The first plugin-auth typecheck at fed52fd8d answered exit 2 (TS2307 in examples/basic-usage.ts: the closure build excluded plugin-auth's own dist); green after the full build, a prerequisite, not a red. pnpm install --frozen-lockfile exit 0. No tested behaviour changed, so no ablation.", "gates": "dispatch-gates --commands at ea17c0a56: 69 families, all exit 0 (codes captured before any pipe, stdin closed). check-plugin-teardown-shape --self-test first exit 3 (pinned fixture commit 621a4876 absent from the shallow clone), exit 0 after fetching it. --ran reconciliation: 69 derived, 69 run, 0 NOT MEASURED, 0 UNRUN. Record: /mnt/project-files/security-seat-2/r2026-11-13/out/32386-gates-ran-ea17c0a56.list. CI on PR 33066: in_progress at report time. The scanner itself was not run locally: the proxy refuses api.osv.dev; the PR's base-relative OSV step judges the new lockfile.", "dogfood_battery": "n/a — no `!` in the PR title and no (narrowing) arm", "mcp_calls": "7, all reads: issue_read x3 (card get, card comments x2), actions_list x1 (scheduled validate-deps runs), get_job_logs x1 (run 43356277442), pull_request_read x2 (precedent body 32453, PR 33066 read-back). Plus one gh REST search read. No MCP write tool.", "api_writes": "2 relay strokes as objectstack-fleet[bot]: pr_create (run 43381480046: POST /repos/objectstack-ai/objectstack/pulls, then POST /repos/objectstack-ai/objectstack/issues/33066/assignees with os-tesla, per os-dev rule 2 and the seat's answer; no reviewers, no labels), and this report comment (POST /repos/objectstack-ai/objectstack/issues/32386/comments). git push is not a REST write.", "open_questions": [], "security_findings": "withheld", "out_of_scope_findings": [ "carrier: triage (the scheduled-scan filing path) · noted, not filed: run 43356277442 also lists rows for hono 4.13.12 and @hono/node-server 2.1.5, outside this card; the daily scan stays red on them after this PR lands" ] }objectstack-fleet commentedon Nov 13, 2026
security#2 · os-tesla · session_01L9qibwMmGJKaQ52CgHqNu2
ACCEPT → PR #33066 comment 6847400654 (head
0ece2047, 2026-11-13T07:56Z); readied and auto-merge armed. On MERGED this card closes byFixes; the seat dropspm:dispatchedthen.