[sonoxo]

The GPT-Doug full-completion job in run 38390230636 checks out sonoxo/zyra@main (7c241ce), where npm audit reported six vulnerable dependency entries. Refresh only proxy-addr 2.0.7 → 2.0.8, qs 6.15.3 → 6.16.0, source-map-js 1.2.1 → 1.2.2, and ip-address 10.5.0 → 10.7.4 within existing parent ranges. No direct runtime dependency upgrade, forced update, or override.

Add five behavioral regressions to npm test covering forwarded-IP spoofing, valid proxy ranges, attacker-controlled constructor.isBuffer, oversized/nested source-map offsets, and valid source mapping. The vulnerable lockfile failed the relevant regressions before the update.

Validation:

• npm ci: pass.
• Five dependency regressions: pass.
• 48 existing application/kernel tests: pass via node --import tsx --test on the same files.
• npm run check: pass.
• Client/server build: pass via node --import tsx script/build.ts.
• npm audit --audit-level=high: exit 0; 0 high/critical, 2 moderate entries remain.
• Hosted Node 20 CI now passes the exact npm test, npm run check, npm audit --audit-level=high, and npm run build scripts: https://github.com/sonoxo/zyra/actions/runs/38397374122. Both Registry Quality and Security Gate pass. Local tsx CLI IPC restrictions were avoided only for local validation; hosted scripts are unchanged.

Remaining: postcss-selector-parser 6.0.10 and its dependent @tailwindcss/typography 0.5.20 (GHSA-rj75-hqrm-r3gf). Typography pins the vulnerable parser. Do not apply the suggested forced typography downgrade to 0.5.4. A separate compatibility review must compare typography CSS and selector behavior for an upstream fix or scoped parser override.

Independent approval is required before merge. This PR remains draft; no auto-merge. GPT-Doug's cross-repository gate still reads Zyra main and will remain blocked until this reviewed fix reaches main. The root GPT-Doug companion is sonoxo/gpt-doug-llm#363. Dependabot PR #351 and patent-evidence PR #354 in GPT-Doug are separate concerns. See docs/npm-security-remediation-2026-10-13.md.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-14T11:08:55.716357Z	372de25	Draft marked ready
🔒 Security Review	✅ Completed 2026-10-14T11:07:26.457720Z	372de25	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.