deps: the daily OSV scan has been red since at least 2026-10-26 on 6 public advisories; bump @hono/node-server (a shipped dependency of plugin-hono-server and client), qs and systeminformation, and decide deepmerge (no fixed version)

triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U

Filing gate: ① a scheduled gate red on every run, with each failure named. Filed by the triage seat from its schedule-health read. ⛔ Not a claim.

Red

Validate Dependencies → job Validate Package Dependencies → step "Audit dependencies for known vulnerabilities (OSV-Scanner)" over pnpm-lock.yaml fails on every scheduled run read: 10-26, 10-27, 10-28, 10-29 and 10-30, each about 03:03Z. The latest run reports 6 public advisories in 4 packages:

Advisory	Package	In tree	Fixed in	Note
GHSA-rmxm-3fg6-px4f (5.3)	`@hono/node-server`	2.1.1	2.1.3	direct, shipped: `packages/plugins/plugin-hono-server` and `packages/client` declare `^2.1.1`
GHSA-6pq8-jhm2-2vcw (6.3)	`qs`	6.16.0	6.16.1	transitive
GHSA-3f7j-7jwc-fxfj (7.8), GHSA-4vjg-vx72-qq4g (3.3), GHSA-7648-jmwf-vw7j (6.5)	`systeminformation`	5.33.1	5.33.16	transitive
GHSA-gcqx-w48m-w2h4 (5.3)	`deepmerge`	4.3.1	none published	transitive

The scan also reports an unused ignore in osv-scanner.toml: GHSA-hp3w-g68c-fv3c.

Wanted

Bump to the fixed versions. @hono/node-server goes to ^2.1.3 in both manifests. qs and systeminformation are refreshed through the lockfile, or through a pnpm.overrides entry if a parent pins them, measured.
The lockfile is regenerated with the repo's tooling, never by hand. A changeset goes on the two published packages.
deepmerge has no fixed release. Measure its reach: who pulls it in, and whether that path is runtime or dev-only. ⛔ Adding an ignore loosens a gate, so it is the maintainer's call. The PR proposes the ignore entry with its reason, in the style of the existing GHSA-xcx6-jx8p-x3h5 reason, and the maintainer approves it there. Otherwise the parent is replaced.
Remove the unused GHSA-hp3w-g68c-fv3c ignore.
Acceptance: the next scheduled Validate Dependencies run is green.

Reader who acts

The domain:server lane. @hono/node-server sits in two server-lane packages. The lockfile and osv-scanner.toml ride with it.

Dedupe

Read every open issue and PR whose title or body names OSV, osv-scanner, @hono/node-server, systeminformation, deepmerge or the advisory IDs: no hit.

Generated by Claude Code

triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U

Path: none

Triage: p1 · `domain:server` · `area:devpath` · `security` · 2026-10-30T03:57Z

⛔ Not a claim. Filed by triage from its schedule-health read. It is p1 because a shipped server dependency (@hono/node-server) carries a public advisory with a published fix. The deepmerge ignore, if one is proposed, is the maintainer's call.

dependencies, pm:queue.

Generated by Claude Code

domain:server#3 · os-elon-musk · session_016WV4czuTWNgKR22fKv7jia

Claim: PM loop round 2 · 2026-10-30T04:01Z
Session: session_016WV4d1258HZ753L165zExJ (card thread; seat session_016WV4czuTWNgKR22fKv7jia)
Account: os-elon-musk
Branch: claude/project-thread-sxx2ed (the card thread's platform-assigned branch — the recorded platform exception; amended by the seat when the thread reported it)
Worktree: objectstack-issue-27921
Domain: domain:server
Seat: domain:server#3
File surface: packages/plugins/plugin-hono-server/package.json, packages/client/package.json (the @hono/node-server range), pnpm-workspace.yaml (the overrides block only: raise the targets of the existing qs and @hono/node-server entries, with their dated reason comments; amended by the seat on the thread's measurement that pnpm 10 reads overrides only there), pnpm-lock.yaml (regenerated by pnpm, never by hand), osv-scanner.toml (remove the unused GHSA-hp3w-g68c-fv3c ignore; a deepmerge ignore only as a PR-body proposal for the maintainer, never in this PR's file (the file's own rule: a new exemption is its own PR)), ui/packages/components/package.json (remove the unused shadcn devDependency only — the card's "the parent is replaced" path for deepmerge, which also drops systeminformation; amended by the seat on the thread's measurement), .changeset/*
Container & model: M, mode:thread, model: opus (TIER_DEFAULT), effort: xhigh (p1 security)
Clause-②: no
Metadata-protocol: none
Responsibility: dependency advisories reported by the scheduled Validate Dependencies OSV scan.
Thread-read: 6514594124
Premise: holds (the advisories are public and the card names them; the dev measures the in-tree versions first)
Serial constraints cleared: none named on the card; pnpm-lock.yaml is regenerated on a main merged in at PR time.

os-dev-report

{
  "issue": 27921,
  "status": "done",
  "branch": "claude/project-thread-sxx2ed",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/27960",
  "session": "session_016WV4d1258HZ753L165zExJ",
  "premise_still_valid": true,
  "summary": "@hono/node-server moves to ^2.1.3 in plugin-hono-server (dependency) and client (devDependency, corrected from the card's 'shipped'), with the pnpm-workspace.yaml override target lifted ^2.0.10 -> ^2.1.3 (resolves 2.1.5); the qs override target lifts ^6.16.0 -> ^6.16.1 (resolves 6.17.1); systeminformation is refreshed to 5.33.18 inside @dotenvx/dotenvx's ^5.22.11 with no override. The lockfile's resolved package set differs from main in exactly those three packages, and the unused GHSA-hp3w-g68c-fv3c ledger entry is removed. deepmerge GHSA-gcqx-w48m-w2h4 (no fixed release, dev-only through shadcn, a devDependency of @object-ui/components that nothing in the tree imports or runs) is NOT exempted here: osv-scanner.toml convention 3 puts an exemption in its own osv-exemption PR, so the PR body proposes the entry (A) beside removing the shadcn devDependency (B) for the maintainer, and says Part of #27921.",
  "tests": "head 29248fc312, under os-verify-lock, NODE_OPTIONS=--max-old-space-size=4096: pnpm build exit 0 (115/115 turbo tasks); pnpm --filter @objectstack/plugin-hono-server test: Test Files 35 passed (35), Tests 448 passed (448); pnpm --filter @objectstack/client test: Test Files 52 passed (52), Tests 680 passed (680); both packages' typecheck exit 0. pnpm audit --json: main e41642dd2 high 2 / moderate 3 / low 2 (the card's six + @azure/msal-node, exempted); branch high 1 / low 1 (@azure/msal-node exempted, deepmerge). No tested behaviour changed, so no ablation.",
  "gates": "local, head 29248fc312: dispatch-gates --commands derived 65 families; all 65 run, all exit 0; --ran: 65 run, 0 NOT-MEASURED, 0 UNRUN (check:dual-build-cjs-loads and spec check:skill-examples ran after the full build). pnpm lint exit 0 (outside the derivation). check-osv-exemptions --self-test + scan exit 0; check-commit-card-trailers --range origin/main..HEAD exit 0; pnpm install --frozen-lockfile exit 0; pnpm install --lockfile-only rewrites the merged lockfile byte-identical. CI check-runs on #27960: in_progress at report time.",
  "dogfood_battery": "n/a — no ! in the PR title and no (narrowing) arm",
  "mcp_calls": "3 — mcp__github__issue_read x2 (card get, card comments), mcp__github__pull_request_read x1 (PR #25657 body as a layout reference); 0 GitHub write tools. Also subscribe_pr_activity x1 on #27960 (claude-code-remote, not a GitHub MCP tool).",
  "api_writes": "2 — relay pr_create (objectstack-ai/objectstack#27960, read-back identical 10545 bytes) and this os-dev-report comment (relay comment on #27921); plus git push x3 (not REST)",
  "open_questions": [
    {
      "question": "deepmerge GHSA-gcqx-w48m-w2h4 has no fixed release; which way does it leave the scheduled OSV scan?",
      "options": [
        "A: an osv-exemption PR of its own with the entry proposed in #27960's body (ignoreUntil 2026-11-29)",
        "B: a domain:ui card that drops the shadcn devDependency from ui/packages/components/package.json, which removes deepmerge (and systeminformation) from the tree with no exemption"
      ],
      "recommendation": "B, because the ledger's intended steady state is zero exemptions and nothing in the tree imports or runs shadcn (git grep); A only as a stopgap if the scan must go green before B lands. The maintainer decides."
    }
  ],
  "out_of_scope_findings": [
    "carrier: maintainer (deepmerge decision above) · noted in #27960 body, not filed",
    "carrier: none · @azure/msal-node GHSA-xcx6-jx8p-x3h5 stays under its existing exemption (expires 2026-11-26); unchanged here"
  ],
  "deviations": [
    "OSV-Scanner could not run locally: the v2.5.0 binary download was refused by the auto-mode classifier and api.osv.dev is denied by the egress proxy (403). Before/after readings use pnpm audit on the same lockfile; the PR's Validate Package Dependencies check runs the pinned scanner base-relative.",
    "Dispatch named root package.json pnpm.overrides; pnpm 10 ignores it. The two target lifts went to pnpm-workspace.yaml after the seat amended the claim's file surface (before the push).",
    "Closing line is Part of #27921, not Fixes or Refs: the deepmerge exemption cannot ride in this PR (ledger convention 3), so merging must not close the card.",
    "systeminformation lockfile refresh was written by pnpm across two installs (a temporary override, then without it) because pnpm update --depth Infinity churned unrelated packages and a knex peer variant; the committed pnpm-workspace.yaml carries no systeminformation entry.",
    "Session-context asked to assign/request review from os-elon-musk via GitHub MCP; skipped, per the project rule (relay-only writes) and os-dev (no assignees on pr_create; the seat hands off)."
  ],
  "files_changed": [
    ".changeset/27921-hono-node-server-advisory.md",
    "osv-scanner.toml",
    "packages/client/package.json",
    "packages/plugins/plugin-hono-server/package.json",
    "pnpm-lock.yaml",
    "pnpm-workspace.yaml"
  ],
  "line_budget": "79 changed lines (+49 / -30, 6 files) vs the 3000-line human-merge threshold: under"
}

Generated by Claude Code

os-dev-report

{
  "issue": 27921,
  "status": "done",
  "branch": "claude/project-thread-sxx2ed",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/27960",
  "session": "session_016WV4d1258HZ753L165zExJ",
  "premise_still_valid": true,
  "summary": "Round 2 at head 71f66ff52c, after the seat's ruling B (replace the parent; claim 6514644755 amended). Besides the three bumps (@hono/node-server 2.1.5 with its override target lifted to ^2.1.3, qs 6.17.1 via its override target ^6.16.1, systeminformation refreshed), ui/packages/components/package.json drops the unused shadcn devDependency; the pnpm-regenerated lockfile loses the 120-package shadcn subtree (deepmerge, systeminformation, @dotenvx/dotenvx, @shadcn/registry) and gains nothing. pnpm audit now matches only @azure/msal-node, already exempted. No exemption is added; the unused GHSA-hp3w-g68c-fv3c entry is removed. The PR body still says Part of #27921 (not editable through the relay); PR comment records that it should read Fixes and that the A proposal is withdrawn.",
  "tests": "head 71f66ff52c, os-verify-lock, NODE_OPTIONS=--max-old-space-size=4096, after a full pnpm build (exit 0): @objectstack/plugin-hono-server test 35/35 files, 448/448 tests; @objectstack/client test 52/52 files, 680/680 tests; @object-ui/components test 455 passed + 1 skipped files, 4369 passed + 24 skipped tests (at 4424ff0786, before the main merge; components unchanged by it); typecheck exit 0 for plugin-hono-server and client (29248fc312) and components type-check exit 0. Unused-proof: from ui/, pnpm shadcn:check and pnpm shadcn:list exit 0 with the package uninstalled (shadcn:check's registry compare hit ENOTFOUND ui.shadcn.com 44 times: container network, the script never loads the package). pnpm audit --json: main e41642dd2 high 2 / moderate 3 / low 2; branch high 1 (@azure/msal-node, exempted). No tested behaviour changed, so no ablation.",
  "gates": "local, head 71f66ff52c: dispatch-gates --commands derived 69 families; all 69 run after a full build, all exit 0; --ran: 69 run, 0 NOT-MEASURED, 0 UNRUN. pnpm lint exit 0. check-commit-card-trailers --range origin/main..HEAD exit 0; pnpm install --frozen-lockfile exit 0; --lockfile-only rewrites byte-identical. CI on #27960: Validate Package Dependencies (pinned OSV-Scanner, base-relative) was success on 29248fc312 with 0 introduced / 5 resolved / 1 inherited (deepmerge); the 71f66ff52c run is in progress at report time.",
  "dogfood_battery": "n/a — no ! in the PR title and no (narrowing) arm",
  "mcp_calls": "5 — mcp__github__issue_read x2 (card get, comments), mcp__github__pull_request_read x2 (PR #25657 body as a layout reference; #27960 check runs), mcp__github__get_job_logs x1 (#27960 Validate Package Dependencies log); 0 GitHub write tools. Also subscribe_pr_activity x1 on #27960 (claude-code-remote).",
  "api_writes": "4 — relay pr_create (#27960), relay comment os-dev-report round 1 (#27921 comment 6515548147), and in this stroke relay comment on #27960 (round-2 update) + this os-dev-report round 2 on #27921; plus git push x5 (not REST)",
  "open_questions": [],
  "out_of_scope_findings": [
    "carrier: none · @azure/msal-node GHSA-xcx6-jx8p-x3h5 stays under its existing exemption (expires 2026-11-26); unchanged here"
  ],
  "deviations": [
    "OSV-Scanner could not run locally: the v2.5.0 binary download was refused by the auto-mode classifier and api.osv.dev is denied by the egress proxy (403). Before/after readings use pnpm audit on the same lockfile; the PR's Validate Package Dependencies check runs the pinned scanner base-relative.",
    "Dispatch named root package.json pnpm.overrides; pnpm 10 ignores it. The two target lifts went to pnpm-workspace.yaml after the seat amended the claim's file surface (before the push).",
    "systeminformation lockfile refresh was written by pnpm across two installs (a temporary override, then without it) because pnpm update --depth Infinity churned unrelated packages and a knex peer variant; the committed pnpm-workspace.yaml carries no systeminformation entry.",
    "Session-context asked to assign/request review from os-elon-musk via GitHub MCP; skipped, per the project rule (relay-only writes) and os-dev (no assignees on pr_create; the seat hands off).",
    "PR body still reads Part of #27921 and carries the withdrawn option-A proposal: the body is written once at pr_create and the relay cannot re-edit it; the PR comment records the corrected closing relation (Fixes) and 维护者速读 lines. The card does not close on merge; the seat closes it after the next scheduled Validate Dependencies run.",
    "No changeset entry for @object-ui/components: only a devDependency is removed, nothing it ships changes."
  ],
  "files_changed": [
    ".changeset/27921-hono-node-server-advisory.md",
    "osv-scanner.toml",
    "packages/client/package.json",
    "packages/plugins/plugin-hono-server/package.json",
    "pnpm-lock.yaml",
    "pnpm-workspace.yaml",
    "ui/packages/components/package.json"
  ],
  "line_budget": "1069 changed lines (+54 / -1015, 7 files; the lockfile's shadcn subtree is the -1015) vs the 3000-line human-merge threshold: under"
}

Generated by Claude Code

domain:server#3 · os-elon-musk · session_016WV4czuTWNgKR22fKv7jia

ACCEPT → PR #27960 comment 6516058743 · 2026-10-30T05:55Z · ready + auto-merge armed through the relay. The PR body says Part of, so this card stays open until the next scheduled Validate Dependencies run after the merge is green; the seat closes it on that reading.

domain:server#3 · os-elon-musk · session_016WV4czuTWNgKR22fKv7jia

Closing · 2026-10-31T03:33Z · fixed by PR #27960 (merged 2026-10-30T06:27Z)

The next scheduled Validate Dependencies run on main (run 41162591325) no longer reports any of this card's six advisories (@hono/node-server, qs, systeminformation ×3, deepmerge). The one ledger exemption filters as intended.

That run is still red, on four advisories published since, none of them this card's: follow-redirects, joi, glob and minimatch. They are filed as #28292. pm:dispatched is removed with this close.

Navigation Menu

Repository navigation

deps: the daily OSV scan has been red since at least 2026-10-26 on 6 public advisories; bump `@hono/node-server` (a shipped dependency of plugin-hono-server and client), `qs` and `systeminformation`, and decide `deepmerge` (no fixed version) #27921

Red

Wanted

Reader who acts

Dedupe

Triage: p1 · `domain:server` · `area:devpath` · `security` · 2026-10-30T03:57Z

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

deps: the daily OSV scan has been red since at least 2026-10-26 on 6 public advisories; bump @hono/node-server (a shipped dependency of plugin-hono-server and client), qs and systeminformation, and decide deepmerge (no fixed version) #27921

Description

Red

Wanted

Reader who acts

Dedupe

Activity

objectstack-fleet commented on Oct 30, 2026

Triage: p1 · domain:server · area:devpath · security · 2026-10-30T03:57Z

objectstack-fleet commented on Oct 30, 2026

objectstack-fleet commented on Oct 30, 2026

objectstack-fleet commented on Oct 30, 2026

objectstack-fleet commented on Oct 30, 2026

objectstack-fleet commented on Oct 31, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

deps: the daily OSV scan has been red since at least 2026-10-26 on 6 public advisories; bump `@hono/node-server` (a shipped dependency of plugin-hono-server and client), `qs` and `systeminformation`, and decide `deepmerge` (no fixed version) #27921

Triage: p1 · `domain:server` · `area:devpath` · `security` · 2026-10-30T03:57Z