Repository navigation
deps: the daily OSV scan is red again on 4 newly published advisories (follow-redirects, joi, glob, minimatch); glob is a shipped dependency of @objectstack/metadata and @object-ui/cli #28292
Description
domain:server#3 · os-elon-musk · session_016WV4czuTWNgKR22fKv7jia
Filing gate: ① a scheduled gate red, with each failure named. Filed by domain:server seat 3 while closing #27921, whose six advisories this run no longer reports. ⛔ Not a claim. No grade: triage sets the lane and grade.
Red
Validate Dependencies → job Validate Package Dependencies → step "Audit dependencies for known vulnerabilities (OSV-Scanner)" over pnpm-lock.yaml, scheduled run 41162591325 (the 10-31 run), on main. All six #27921 advisories are gone. The one exemption in osv-scanner.toml (GHSA-xcx6-jx8p-x3h5) still filters as intended. Four advisories are new to the scan:
| Advisory | Package | In tree | Fixed in | Reached through (lockfile) |
|---|---|---|---|---|
| GHSA-mrwp-f3q8-3g9p (8.2) | follow-redirects |
1.16.1 | 1.16.2 | axios 1.20.0 ← wait-on 9.5.1 (ui devDependency); mongodb-memory-server-core 11.3.0 (driver-mongodb dev) |
| GHSA-4528-x5fx-h6hg (7.5) | joi |
18.3.0 | 18.3.1 | wait-on 9.5.1 (ui devDependency) |
| GHSA-3g3m-2fjr-6pw4 (6.3) | glob |
13.0.6 | 14.0.2 | direct, shipped: packages/metadata and ui/packages/cli declare glob: ^13.0.6 in dependencies; also @types/glob |
| GHSA-g3hv-75wg-m249 (6.9) | minimatch |
10.2.6 | 11.0.1 | transitive: eslint, @typescript-eslint, @microsoft/api-extractor, @oclif/core, @ts-morph/common |
Wanted (route is triage's)
follow-redirectsandjoiare patch-level fixes inside their parents' ranges, so a lockfile refresh should be enough.glob14 andminimatch11 are majors.globis a runtime dependency of two published packages, so the bump needs a read of the call sites. Forminimatch, see whether the parents accept 11 yet. If a parent does not, anosv-exemptionPR of its own applies, per the ledger convention, with a reason and an advisory link.- The scan goes green on its next scheduled run.
Dedupe
Searched open issues for follow-redirects, GHSA-mrwp, OSV, minimatch and joi: no match. #27921 (the previous red, six other advisories) closes with a pointer here. New.
Activity
objectstack-fleet commentedon Oct 31, 2026
triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U
Path: 真挡得住的权限 | none | P②
Triage: p1 ·
security·domain:server·area:devpath·pm:queue· 2026-10-31T03:55Z⛔ Not a claim.
Validate Dependenciesscan is red on 4 new advisories.glob(6.3) is a shipped runtime dependency of@objectstack/metadataand@object-ui/cli, so the grade is p1 under 「发版本优先的都p1」.follow-redirectsandjoineed a lockfile refresh inside their ranges.glob14 needs a read of the call sites in both packages.minimatch11 moves only where its parents accept it; otherwise it needs its own exemption PR with a reason.ui/packages/cli/package.json. The scan goes green on its next scheduled run. ⛔ No blanket exemption.Generated by Claude Code
objectstack-fleet commentedon Oct 31, 2026
domain:server#2 · os-project-manager · session_0186vfjHHMsRXC9EUT9hTFMo
Claim: PM loop round 2 · card thread · 2026-10-31T04:17Z
Session:
session_0186vfjHHMsRXC9EUT9hTFMo(the seat); the card thread issession_01FEkQ5pWbjNiQvAXymrfTHXAccount:
os-project-manager(the seat's linked user; the card's assignee)Branch:
claude/project-thread-n94g89(the card thread's harness-pinned branch; it names no issue, so this claim is the identity record)Worktree: the card thread's own container checkout
Domain:
domain:serverSeat:
domain:server#2Ruling-ref: triage
6538684656(p1 under 「发版本优先的都p1」; the route: lockfile refresh forfollow-redirectsandjoi, a call-site read forglob14,minimatch11 only where its parents accept it, else its own dated exemption PR; one PR with a one-PR cross-domain exception forui/packages/cli/package.json; ⛔ no blanket exemption). Security card: 「所有的安全卡不要创建issue，直接派发处理修复」.File surface:
pnpm-lock.yaml,packages/metadata/package.json,ui/packages/cli/package.json(triage's cross-domain exception), theglobcall sites in those two packages if the major forces it,osv-scanner.tomlonly for a datedminimatchentry in its own PR, tests, and changesets.Container & model:
M,mode:thread,model: opus(--tiernames no path mandate: PM's call, default),effort: highClause-②: no (expected: dependency versions move, no accept set does; the dev measures and declares)
Metadata-protocol: none
Responsibility: the code is the repo's dependency set (
pnpm-lock.yamland two published packages'dependencies) · the platform path is the scheduled OSV gate (validate-deps.yml), red on 4 advisories · reached by every install of@objectstack/metadataand@object-ui/cli(globships at runtime)Thread-read: none
Premise: holds (read 2026-10-31T04:17Z at
origin/main91e46522c:glob: ^13.0.6in thedependenciesofpackages/metadata/package.jsonL100 andui/packages/cli/package.jsonL69); the dev re-measures the scan firstSerial constraints cleared: none of the 33 open PRs at this read names this card or touches
osv-scanner.toml; apnpm-lock.yamlconflict with another PR is re-derived with pnpm, never hand-mergedResume-from: none — fresh from
origin/mainState:
pm:queue→pm:dispatched, assigned toos-project-manager, recorded by this claim.Generated by Claude Code
objectstack-fleet commentedon Oct 31, 2026
domain:server#2 · os-project-manager · session_01FEkQ5pWbjNiQvAXymrfTHX
os-dev-report
{
"issue": 28292,
"status": "done",
"branch": "claude/project-thread-n94g89",
"pr": "#28324",
"session": "session_01FEkQ5pWbjNiQvAXymrfTHX",
"premise_still_valid": true,
"summary": "Three of the four advisories are cleared in PR #28324 (head 6100dd7, base 57f8ca2): glob ^13.0.6 -> ^14.0.3 in @objectstack/metadata and @object-ui/cli (GHSA-3g3m-2fjr-6pw4, fixed 14.0.2), plus removal of the deprecated @types/glob stub from @object-ui/cli dependencies; follow-redirects 1.16.1 -> 1.16.2 and joi 18.3.0 -> 18.3.1 as a nine-line lockfile-only re-resolve (a plain pnpm update -r was measured first and moved unrelated packages, so it was discarded). minimatch GHSA-g3hv-75wg-m249 is NOT cleared: every version before 11.0.1 is affected, 11 is a breaking major (drops makeRe and AST), and no parent's latest release accepts it (eslint 10.14.0, @eslint/config-array 0.23.5, @typescript-eslint/typescript-estree 8.72.1, @microsoft/api-extractor 7.60.1 exact 10.2.3, @oclif/core 5.1.10, @ts-morph/common 0.29.0, typedoc 0.28.20, readdir-glob all ^10); the existing workspace override already holds every copy on 10.2.6. So the PR says Part of #28292 and the minimatch remainder needs its own osv-exemption PR, routed by the seat; a drafted ledger entry with the measurements is at /mnt/project-files/pm-orders/server/28292-minimatch-exemption.md. Until it lands the scheduled scan stays red on minimatch alone.",
"tests": "At head 6100dd7. Build: pnpm --filter '@objectstack/metadata...' --filter '@object-ui/cli...' build under os-verify-lock: VERDICT command-exit 0. @objectstack/metadata vitest run: Test Files 64 passed (64), Tests 906 passed (906); tsc --noEmit exit 0. @object-ui/cli vitest run packages/cli/ from ui/: Test Files 31 passed (31), Tests 418 passed (418); tsc --noEmit exit 0. Existing suites reach every glob call site (filesystem-loader-.test.ts for loadMany/list; workspace-vite.test.ts and check-.test.ts for globSync); both packages resolve glob 14.0.3; metadata dist/node.cjs and dist/node.js load with it. Lint: eslint packages/metadata --no-inline-config exit 0; ui/packages/cli pnpm lint exit 0 (5 pre-existing warnings, 0 errors). No ablation: config-only diff. OSV scan reproduction NOT MEASURED, reason: the OSV-Scanner binary download was refused by the auto-mode classifier and api.osv.dev by the egress proxy (403); closest measurement is lockfile versions vs each advisory's fixed version (osv.dev and github.com advisory pages read via WebFetch for glob and minimatch ranges; card table for the other two).",
"gates": "dispatch-gates --commands derived 66 families on the 4 changed paths; 65 exit 0; node scripts/check-plugin-teardown-shape.mjs --self-test exit 3 on shallow clone, exit 0 after git fetch --depth=1 of its pinned fixture commit; pnpm check:dual-build-cjs-loads exit 3 PREREQUISITE NOT MET (about 34 unrelated packages without dist/), narrowed locally to loading @objectstack/metadata CJS and ESM entries with glob 14 (both load), full gate declared to CI. --ran: '66 derived famil(ies) accounted for — 65 run, 1 NOT-MEASURED'. check:published-files and check-osv-exemptions green. PR check-runs: in_progress at report time (not waited on, per contract).",
"dogfood_battery": "n/a — no ! in the PR title and no (narrowing) arm",
"mcp_calls": "4 — mcp__github__issue_read get x1, issue_read get_comments x2, search_pull_requests x1; all reads, no MCP write",
"api_writes": "2 relay writes — fleet-write pr_create (run 41169821206, read-back identical, assignees none, no labels) and this os-dev-report comment via post-stamped.mjs; plus 1 git push (not REST). Write budget spent: 3 of 3.",
"open_questions": [],
"out_of_scope_findings": [
"carrier: domain:server#2 seat · minimatch GHSA-g3hv-75wg-m249 remainder needs its own osv-exemption PR (ledger convention 3, triage route); drafted entry and parent-range table at /mnt/project-files/pm-orders/server/28292-minimatch-exemption.md. Shipped reach for the exemption review: @objectstack/cli dependencies @oclif/core and ts-morph, and @objectstack/rest dependency exceljs (archiver 5 -> readdir-glob / glob 7), all on minimatch 10.2.6. Not filed (security-card standing rule)."
]
}
Generated by Claude Code
objectstack-fleet commentedon Oct 31, 2026
domain:server#2 · os-project-manager · session_0186vfjHHMsRXC9EUT9hTFMo
Claim: PM loop round 2 · second PR on this card · card thread · 2026-10-31T04:50Z
Session:
session_0186vfjHHMsRXC9EUT9hTFMo(the seat); the card thread issession_01FEkQ5nTvSCGM9p4u9HnrV7Account:
os-project-manager(the seat's linked user; the card's assignee)Branch:
claude/project-thread-rptrod(the card thread's harness-pinned branch; it names no issue, so this claim is the identity record). The first claim6538901035(branchclaude/project-thread-n94g89, PR #28324) stands for the first PR; this claim adds the second.Worktree: the card thread's own container checkout
Domain:
domain:serverSeat:
domain:server#2Ruling-ref: triage
6538684656("minimatch11 moves only where its parents accept it; otherwise it needs its own exemption PR with a reason"; "⛔ No blanket exemption");osv-scanner.tomlconvention 3 (an exemption lands in its own PR, labelledosv-exemption). Security card: 「所有的安全卡不要创建issue，直接派发处理修复」.File surface:
osv-scanner.tomlonly (one dated[[IgnoredVulns]]entry for GHSA-g3hv-75wg-m249), unless a parent now acceptsminimatch11 inside our ranges.Container & model:
S,mode:thread,model: opus(--tiernames no path mandate: PM's call, default),effort: highClause-②: no
Metadata-protocol: none
Responsibility: the code is the repo's OSV exemption ledger · the platform path is the scheduled OSV gate (
validate-deps.yml), which after PR #28324 stays red on this advisory alone · reached by the shippedminimatch10.2.6 copies the first PR's report names; the dev reads that reach first and stops for a decision if it is reachableThread-read: none
Premise: holds (PR #28324's report
6539181263: no parent's newest release acceptsminimatch≥11.0.1, and every copy is on 10.2.6 through the workspace override); the dev re-reads the registry firstSerial constraints cleared: no open PR touches
osv-scanner.toml; disjoint from PR #28324's filesResume-from: none — fresh from
origin/mainState:
pm:dispatched, assigned toos-project-manager(unchanged since6538901035).Generated by Claude Code
objectstack-fleet commentedon Oct 31, 2026
domain:server#2 · os-project-manager · session_01FEkQ5nTvSCGM9p4u9HnrV7
os-dev-report
{
"issue": 28292,
"status": "done",
"branch": "claude/project-thread-rptrod",
"pr": "#28328",
"session": "session_01FEkQ5nTvSCGM9p4u9HnrV7",
"premise_still_valid": true,
"summary": "PR #28328 (head 469d535, base b339465) adds one dated [[IgnoredVulns]] entry to osv-scanner.toml for minimatch GHSA-g3hv-75wg-m249: ignoreUntil = 2026-11-30 (bare date, 30-day default), reason = advisory URL plus one sentence (patched 11.0.1 is a breaking major no published parent accepts; every copy already on 10.2.6 via the workspace override). Premise re-read on the npm registry at base: eslint 10.14.0, @eslint/config-array 0.23.5, @typescript-eslint/typescript-estree 8.72.1, @microsoft/api-extractor 7.60.1 (exact 10.2.3), @oclif/core 5.1.10, @ts-morph/common 0.29.0, typedoc 0.28.20, readdir-glob 3.0.0 all still declare ^10, so no copy moves. Shipped reach read privately at /mnt/project-files/pm-orders/server/28292-minimatch-reach.md: a request-influenced pattern reaching the vulnerable code: no. PR body says Part of #28292 because PR #28324 is still open; the seat switches it to Fixes if it lands both together, and the reach file recommends landing #28324 first or together.",
"tests": "At head 469d535: node scripts/check-osv-exemptions.mjs --self-test exit 0 (self-test passed: valid ledgers accepted, every convention breach rejected.); node scripts/check-osv-exemptions.mjs exit 0 (2 OSV exemption(s) in osv-scanner.toml: all carry an unexpired ignoreUntil within 90 days and a reason with an advisory link.). No new tests and no ablation: one ledger entry, config is not ablated. OSV scan reproduction NOT MEASURED, reason: OSV-Scanner binary and api.osv.dev refused by this container egress; affected range (introduced 0, fixed 11.0.1) read from the osv.dev page via WebFetch.",
"gates": "dispatch-gates --commands --repo objectstack-ai/objectstack at 469d535 derived 14 commands over 1 path (osv-scanner.toml); all 14 exit 0 (check-closing-keyword-parity and --self-test, check-comment-mask-corpus, check-osv-exemptions and --self-test, osv-base-relative --self-test, check:changeset-fixed, check:driver-memory-census, check:gitlink-declared, check:nul-bytes, check:override-consistency, check:refd-timer-probe, check:vendor-export-contract-resolve, check:watch-hint-literal). --ran: 14 derived famil(ies) accounted for, 14 run, 0 NOT-MEASURED. pnpm lint scoped to touched packages: none touched (repo-root toml). PR check-runs: in_progress at report time (not waited on, per contract).",
"dogfood_battery": "n/a — no ! in the PR title and no (narrowing) arm",
"mcp_calls": "4 — mcp__github__pull_request_read get x2 (#28324 merge state, #28328 label read-back), issue_read get_comments x1 (claim check), issue_read get_labels x1 (failed: PR number is not an issue to that tool); all reads, no MCP write",
"api_writes": "2 relay writes — fleet-write pr_create (run 41170736220, read-back identical 5011 bytes, assignees none, labels osv-exemption + skip-changeset read back on the PR) and this os-dev-report comment via post-stamped.mjs; plus 1 git push (not REST). Write budget spent: 3 of 3.",
"open_questions": [],
"out_of_scope_findings": []
}
Generated by Claude Code
objectstack-fleet commentedon Oct 31, 2026
domain:server#2 · os-project-manager · session_0186vfjHHMsRXC9EUT9hTFMo
Landing record · #28292 · PRs #28324 and #28328
domain:serverseat 2 ·session_0186vfjHHMsRXC9EUT9hTFMo· 2026-10-31T05:47Zgit ls-remote origin 'refs/heads/gh-readonly-queue/main/pr-28324-*'andpr-28328-*git merge-base --is-ancestor 28c274fa origin/main;… b4ccbc6f origin/maingit grep -c '"glob": "^14.0.3"' origin/main -- packages/metadata/package.json ui/packages/cli/package.json;git grep -c GHSA-g3hv-75wg-m249 origin/main -- osv-scanner.toml28c274fa.glob14.0.3 ships in@objectstack/metadataand@object-ui/cli, andfollow-redirects1.16.2 andjoi18.3.1 are in the lockfile.b4ccbc6f, after it. It adds one dated exemption forminimatchGHSA-g3hv-75wg-m249,ignoreUntil = 2026-11-30, reviewed as its own decision.minimatchcopy, which stays on 10.2.6 through the workspace override.Part of, so the seat closes this card now that both are merged.pm:dispatchedis removed.Validate Dependenciesrun on amainthat containsb4ccbc6fmust be green. If it reds on any of these four advisories, this card reopens.Generated by Claude Code