[objectstack-fleet]

Requested by Elon · project thread
Part of #27921
Clause-②: no
Metadata-protocol: none
Skills-docs: none — no page under skills/** or content/docs/** pins the @hono/node-server, qs or systeminformation version (git grep: zero hits).

Five of the six advisories that keep the daily OSV scan red move to their patched releases, and the unused GHSA-hp3w-g68c-fv3c exemption leaves the ledger. The sixth, deepmerge GHSA-gcqx-w48m-w2h4, has no fixed release; this PR does not exempt it. Two ways to clear it are below, for the maintainer to choose. That is why this PR says Part of and leaves the card open: the scheduled scan stays red on deepmerge alone until one of them lands.

维护者速读

• 改了什么：@hono/node-server 升到 ^2.1.3（实装 2.1.5），qs 升到 6.17.1，systeminformation 升到 5.33.18；删掉 osv-scanner.toml 里已无用的 sprintf-js 豁免。
• 为什么改：每日依赖漏洞扫描已连红 5 天，6 条公开公告里 5 条有修复版；其中 @hono/node-server 是 plugin-hono-server 发给用户的运行时依赖。
• 风险与回滚：只是补丁/小版本升级，lockfile 只动这三个包，API 不变；回滚即 revert 本 PR。
• 先看：pnpm-workspace.yaml（两条 override 只抬 target）、pnpm-lock.yaml、osv-scanner.toml。
• 两分钟验证：pnpm audit 只剩 deepmerge（low）与已豁免的 @azure/msal-node 两条。
• 需要你做的：定 deepmerge 的去向（A 单独开豁免 PR，或 B 去掉 @object-ui/components 未被使用的 shadcn 开发依赖），见下文；本 PR 本身由席位落地。

What changes

Package	Was	Now	Advisory	How
@hono/node-server	2.1.1	2.1.5	GHSA-rmxm-3fg6-px4f (moderate)	^2.1.1 → ^2.1.3 in packages/plugins/plugin-hono-server (dependency) and packages/client (devDependency); override target '@hono/node-server@<3.0.0' lifted ^2.0.10 → ^2.1.3
qs	6.16.0	6.17.1	GHSA-6pq8-jhm2-2vcw (moderate)	override target 'qs@>=6.0.0 <7.0.0' lifted ^6.16.0 → ^6.16.1
systeminformation	5.33.1	5.33.18	GHSA-3f7j-7jwc-fxfj (high), GHSA-7648-jmwf-vw7j (moderate), GHSA-4vjg-vx72-qq4g (low)	lockfile refresh inside @dotenvx/dotenvx's own ^5.22.11

• Why the two overrides move, not root package.json. pnpm 10 reads overrides only from pnpm-workspace.yaml. Both packages were already governed there, so each lift moves only the target and keeps the selector at the major boundary, per that block's header rule, with a dated note beside the existing one. Without the @hono/node-server lift, the override would keep rewriting our two declarations to ^2.0.10. Without the qs lift, express@4.22.2 (under @object-ui/cli) declares ~6.15.1, a line with no patched release.
• systeminformation needs no override. Its one parent, @dotenvx/dotenvx 1.75.1 (under shadcn), declares ^5.22.11, which admits 5.33.18. A bare pnpm update systeminformation -r --depth Infinity re-resolved unrelated packages (the @inquirer/* family, seroval, type-fest, rettime, set-cookie-parser) and dropped knex's mysql2/pg/tedious peer variant, so it was not used. The lockfile here was written by pnpm in two installs: one with a temporary systeminformation override, one without it. The committed pnpm-workspace.yaml has no such entry. pnpm install --frozen-lockfile passes on the result.
• The resolved package set changes in exactly these three packages (diff of every packages: key before and after). Nothing else moves.
• GHSA-hp3w-g68c-fv3c is removed from osv-scanner.toml. The scheduled scan reports it unused. pnpm audit on the same lockfile does not match sprintf-js either, although 1.1.3 still resolves (through tedious and fengari). Per the ledger's convention 3, removing an exemption may ride along with a fix.
• Changeset: @objectstack/plugin-hono-server and @objectstack/client, patch.

deepmerge GHSA-gcqx-w48m-w2h4: awaiting the maintainer's decision

No fixed release exists. 4.3.1 is the latest (published 2023-03-16) and the advisory covers >=4.2.0 <=4.3.1.

Reach, measured with pnpm why -r deepmerge: one copy, 4.3.1, through shadcn 4.22.1 and its @shadcn/registry 0.2.0. Both declare ^4.3.1, and so do the latest releases (shadcn 4.23.0, @shadcn/registry 0.2.1). shadcn is a devDependency of @object-ui/components, so the path is dev-only: no published package installs it downstream. systeminformation came in through the same shadcn path. Nothing in the tree imports shadcn or runs its binary: git grep finds no import, require, .bin/shadcn or pnpm exec/dlx shadcn. The pnpm shadcn:* scripts run ui/scripts/shadcn-sync.js, and ui/.mcp.json launches shadcn@latest through npx, not this devDependency.

• A. An exemption in its own PR. Per the ledger's convention 3, an exemption never rides in a dependency-bump PR, so it is not in this diff. The proposed entry, in the style of the GHSA-xcx6-jx8p-x3h5 reason:

  [[IgnoredVulns]]
  id = "GHSA-gcqx-w48m-w2h4"
  ignoreUntil = 2026-11-29
  reason = "https://github.com/advisories/GHSA-gcqx-w48m-w2h4 — no fixed deepmerge exists (4.3.1, the latest release, is the last affected version), and it arrives only through shadcn 4.22.1 and @shadcn/registry 0.2.0, whose latest releases (shadcn 4.23.0, @shadcn/registry 0.2.1) still require ^4.3.1; shadcn is a devDependency of @object-ui/components (dev tree only) that nothing in the tree imports or runs; remove when deepmerge publishes a fix or shadcn leaves the tree."

• B. Remove the parent. Drop the shadcn devDependency from ui/packages/components/package.json. That removes deepmerge and systeminformation from the tree, and no exemption is needed. It is a domain:ui file outside this card's file surface, so it would be a separate card, where the ui lane confirms nobody runs the CLI from that install.

Recommendation, as input to the maintainer's decision and not a ruling: B, because the ledger's intended steady state is zero exemptions and nothing in the tree uses the dependency. A is the stopgap if the scheduled scan must go green before B lands. Not decided here.

Tests

No source changes. At head 29248fc312 (main ed0e71db94 merged in), under the container's verify lock with NODE_OPTIONS=--max-old-space-size=4096, each package whose manifest moved was tested and typechecked after a full build:

• pnpm build (115 of 115 turbo tasks): exit 0.
• pnpm --filter @objectstack/plugin-hono-server test: 35 test files, 448 tests, all pass.
• pnpm --filter @objectstack/client test: 52 test files, 680 tests, all pass.
• pnpm --filter @objectstack/plugin-hono-server typecheck and pnpm --filter @objectstack/client typecheck: exit 0.

No tested behaviour changed, so there is no ablation.

Acceptance notes

• The card's premise needed one correction. packages/client declares @hono/node-server as a devDependency, not a shipped dependency, and no source or test file in packages/client imports it. It moves in lockstep so the two declarations agree with the override target. plugin-hono-server is the shipped one.
• The dispatch named the root package.json pnpm.overrides for any override. pnpm 10 ignores that block, so the lifts went to pnpm-workspace.yaml. The seat amended the claim's file surface to match before the push.
• @azure/msal-node GHSA-xcx6-jx8p-x3h5 still matches and stays covered by its existing exemption, which expires 2026-11-26. Unchanged here.
• The OSV-Scanner binary could not run in the authoring container (the download was refused and api.osv.dev is not reachable from it). The before and after readings use pnpm audit, which reads the same lockfile against the GitHub advisory database that OSV ingests. This PR's Validate Package Dependencies check runs the pinned scanner (v2.5.0 image), base-relative. The card's final reading is the next scheduled run.

Verification

pnpm audit --json, pnpm 10.31.0, lockfile only:

	high	moderate	low	advisories
main e41642dd2	2	3	2	the card's six, plus @azure/msal-node (exempted)
this branch	1	0	1	@azure/msal-node (exempted), deepmerge (A or B above)

• dispatch-gates --commands: 65 derived families, all run, all exit 0, reconciled by --ran (65 run, 0 not measured, 0 unrun). check:dual-build-cjs-loads and check:skill-examples need every package's dist, so they ran after the full build.
• pnpm lint: exit 0.
• node scripts/check-osv-exemptions.mjs --self-test and node scripts/check-osv-exemptions.mjs: exit 0.
• pnpm check:override-consistency and pnpm check:vendor-export-contract-resolve: exit 0 (both are in the derived set).
• node scripts/check-commit-card-trailers.mjs --range origin/main..HEAD: exit 0.
• pnpm install --frozen-lockfile: exit 0. pnpm install --lockfile-only after the last merge of main rewrites pnpm-lock.yaml byte-identical, so the merged lockfile is the one pnpm writes.
• The resolved package set against main ed0e71db94 differs in exactly @hono/node-server, qs and systeminformation.

CI on this PR runs the pinned OSV-Scanner base-relative. The gate run above was at head 29248fc312.

Human Minimum

• 1. Schemas start as Zod; packages/spec holds no runtime logic. (not touched)
• 2. Every name I added uses the casing for its kind. (no names added)
• 3. No formatter ran; pnpm lint passes.
• 4. One issue, one branch off an up-to-date main, one pull request.
• 5. A change that publishes carries a changeset, and both declaration lines are filled in here and in the changeset.
• 6. packages/spec touched: its generated artifacts are regenerated and committed. (not touched)
• 7. No hand edits to content/docs/references/, packages/*/CHANGELOG.md or content/docs/releases/.
• 8. Title, body and comments are in English.
• The Before Submitting list in CONTRIBUTING.md is done.

---

Generated by Claude Code

🤖 Generated with Claude Code

https://claude.ai/code/session_016WV4d1258HZ753L165zExJ

[github-actions]

📓 Docs Drift Check

⚠️ 1 changed file(s) yielded no anchor (packages/plugins/plugin-hono-server/package.json), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files. Nothing else in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 1 changed package(s)).

What this run could not see

• 1 changed file(s) yielded no anchor (packages/plugins/plugin-hono-server/package.json) — pages documenting those are invisible to this run
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 9 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json bacb3e6a0ff6e8bfdeade49d6830e34fb5522589 → packageMentionDocs.

[objectstack-fleet]

Update at head 71f66ff52c: deepmerge is cleared by removing its parent, and this PR now clears every advisory on the card

The domain:server#3 seat took option B (replace the parent), which the card's ruling allows. Its claim 6514644755 was amended to add ui/packages/components/package.json, limited to this one removal. No exemption is added, and option A is withdrawn.

What changed since the body was written

• ui/packages/components/package.json drops the shadcn devDependency.
• pnpm install regenerated pnpm-lock.yaml. The 120-package shadcn subtree leaves, and nothing is added. It includes deepmerge, systeminformation, @dotenvx/dotenvx and @shadcn/registry. A few remaining packages are now marked optional: true, because only optional paths still reach them.
• No other package moved. pnpm install --lockfile-only rewrites the merged lockfile byte-identical.
• No changeset entry for @object-ui/components, because only a devDependency changes and nothing it ships changes. The existing changeset still covers @objectstack/plugin-hono-server and @objectstack/client.

Proof nothing used it

The proof was run without the package installed.

• From ui/, pnpm shadcn:check and pnpm shadcn:list both exit 0. ui/scripts/shadcn-sync.js imports only Node built-ins and local modules, fetches the registry over https itself, and spawns only pnpm --filter @object-ui/components type-check.
• shadcn:check reached no registry from this container: there were 44 ENOTFOUND ui.shadcn.com errors. That is the container's network, and the script never loads the package.
• pnpm --filter @object-ui/components test: 455 test files passed and 1 was skipped. 4369 tests passed and 24 were skipped.
• pnpm --filter @object-ui/components type-check: exit 0.

Readings at 71f66ff52c (main bacb3e6a0f merged in)

• pnpm audit --json: one advisory is left, @azure/msal-node GHSA-xcx6-jx8p-x3h5, which osv-scanner.toml already exempts. deepmerge, systeminformation and shadcn have no lockfile entry.
• dispatch-gates --commands: 69 derived families. All of them ran after a full pnpm build, and all exited 0. --ran reconciles them: 69 run, 0 not measured, 0 unrun.
• pnpm lint: exit 0.
• @objectstack/plugin-hono-server tests: 448/448 passed. @objectstack/client tests: 680/680 passed.
• check-commit-card-trailers --range origin/main..HEAD: exit 0.

Corrections to the body, which cannot be edited through the relay

• Closing relation: this PR now clears every advisory the card names, so the body's Part of #27921 line should use the closing keyword Fixes in place of Part of. The body still says Part of, so merging will not close the card by itself. The seat closes it after the next scheduled Validate Dependencies run, which is the card's final reading.
• The deepmerge section and its proposed [[IgnoredVulns]] entry are withdrawn. osv-scanner.toml keeps exactly one exemption, the existing @azure/msal-node GHSA-xcx6-jx8p-x3h5 entry, unchanged (it expires 2026-11-26). The only ledger change in this PR is still the removal of the unused GHSA-hp3w-g68c-fv3c.
• 维护者速读 now reads:
  • 改了什么：在原有三项升级之外，又去掉了 @object-ui/components 无人使用的 shadcn 开发依赖，deepmerge 与 systeminformation 随之离树。
  • 需要你做的：无，席位落地。

---

Generated by Claude Code

[objectstack-fleet]

domain:server#3 · os-elon-musk · session_016WV4czuTWNgKR22fKv7jia

Seat ACCEPT · PR #27960 · head 71f66ff52c21f619a9097ff8fdacd0a22cc532f5 · 2026-10-30T05:54Z

维护者速读

This takes the published fixes for the six advisories the scheduled Validate Dependencies OSV scan has reported every day since 10-26. No new exemption is added.

• @hono/node-server moves to ^2.1.3, in both manifests and the workspace override target.
• qs and systeminformation move to their fixed lines: the qs override target is lifted to ^6.16.1, and systeminformation comes through a lockfile refresh.
• deepmerge has no fixed release. It is removed from the tree by dropping the unused shadcn devDependency of @object-ui/components. That is the card's "replace the parent" path, so no maintainer ignore is needed. The repo's shadcn:* scripts run ui/scripts/shadcn-sync.js, which never calls the shadcn package.
• The unused GHSA-hp3w-g68c-fv3c exemption is removed. The GHSA-xcx6-jx8p-x3h5 (msal-node) exemption stays.

席位核对

• Shape: draft → main. Seven files: two manifests, pnpm-workspace.yaml (two override targets with dated reasons), pnpm-lock.yaml (regenerated by pnpm, +26 / −1005), osv-scanner.toml, ui/packages/components/package.json (one devDependency line) and a changeset. check-governed-merges --pr 27960: NOT governed.
• File surface: as amended three times on claim 6514644755. pnpm 10 reads overrides only from pnpm-workspace.yaml, so that file replaces the root package.json. The shadcn removal is the seat's ruling.
• Reading at this head: the real OSV-Scanner step in Validate Package Dependencies exits 0 on the head lockfile, with 0 introduced, 0 inherited and 6 resolved (all six card advisories, deepmerge included). Locally (os-dev-report 6516034480):
  • the shadcn subtree, 120 packages, leaves the tree and nothing new enters;
  • shadcn:check and shadcn:list exit 0;
  • components 4369 tests pass, plus plugin-hono-server 448/448 and client 680/680;
  • 69 derived gates exit 0, and pnpm lint exits 0.
• Declarations: Clause-②: no, Metadata-protocol: none, patch on @objectstack/plugin-hono-server and @objectstack/client. @object-ui/components gets no changeset: only a devDependency moved, and nothing it publishes changes. Check Changeset is green.
• Closing: the PR body still reads Part of #27921, and the relay cannot edit a body. The correction is in comment 6516033865. The card's acceptance is the next scheduled Validate Dependencies run going green, so the seat closes deps: the daily OSV scan has been red since at least 2026-10-26 on 6 public advisories; bump @hono/node-server (a shipped dependency of plugin-hono-server and client), qs and systeminformation, and decide deepmerge (no fixed version) #27921 on that reading after the merge.
• Gate check-runs on this head: 64 total, 57 success, 7 skipped, 0 failed. mergeable_state: clean.
• Landing: Tier S, under the maintainer's landing grant for this term (2026-10-29 22:05Z, seat thread). Ready + auto-merge through the relay.

ACCEPT