[wybaby168]

Summary

Cold packed consumers were discarding fixture-owned npm overrides and still installing Vue 3.5.21 and ts-loader 9.5.4. Preserve the Angular fixture's Piscina 5.3.2 and MCP SDK 1.31.0 policy, align Vue/compiler-sfc at 3.5.43, and use ts-loader 9.6.2.

Capture full and production-only npm audits separately after each cold install, with affected-entry totals and distinct advisory identities. Public CI retains the raw audits, installed lockfiles, fixture manifests and candidate tarball hashes.

This is a narrow current-main replacement for the consumer scope of #342. It preserves main's newer compatibility-engine packing, renderer work and package/lockfile. It does not supersede #339's remaining Vitest 5 upgrade and runtime-cohort assertions.

Related issue

N/A: consumer security maintenance and evidence preservation. Supersedes only the six-file consumer scope of #342; #339's independent remaining scope stays separate.

Change classification

• User-visible UI or rendering change
• Non-visual change
• File-format or renderer behavior
• Public API, package, Worker, WASM, or deployment-path change

Verification

• node --check apps/component-demo/scripts/build-packed-issue-consumer.mjs — Passed.
• Independent Linux cloud, Node 24.20.0, NODE_PATH/NODE_OPTIONS cleared: focused Vitest 4.1.11 fixture-policy, lifecycle and audit-evidence tests passed (9 tests); helper syntax and all seven changed files' formatting passed.
• Audit parser controls reject malformed zero-finding reports and missing advisory URLs; positive findings remain visible even if npm returns exit 0 under a configured threshold.
• The exact remote tree was verified against main: seven changed files, with all other blobs and file modes retained.
• node apps/component-demo/scripts/verify-packed-issue-closure.mjs — Passed in full Public CI on ca18e313a0429819af209e1657b6dced2a11e599: 21 Vue/React browser cases and Angular development/restart/production Worker plus missing-manifest checks.
• The same full run passed 51 steps; only failure-evidence upload was skipped. Security, CodeQL and PR governance passed. No merge or release was performed.
• Fresh installed audits: Angular 0 full / 0 production. Vue/React full: 39 affected entries (16 high, 16 moderate, 7 low), spanning 19 distinct advisories; production: 7 low entries from one KaTeX advisory (GHSA-238p-pmpm-9mq7). These results do not claim a clean legacy graph or universal downstream defaults.
• The Public CI packed-consumer-security-evidence artifact contains exactly 14 allowlisted JSON files: both projects' full/production audits, summaries, installed locks, manifests, candidate hashes and engine provenance. All 48 candidate tarball hashes agree between projects. Archive SHA-256: abdbca6908bbb188fa30b58f3905eb91fa6c4bb1bd8a0385bfd18ba85fcaed17.
• Both installed locks confirm Vue/compiler-sfc 3.5.43, ts-loader 9.6.2, Piscina 5.3.2 and MCP SDK 1.31.0 in their respective fixtures. Existing workspace audit policy separately retains 1 low ignored Vue 2 finding.
• Local browser/socket execution is unavailable in this cloud environment; no local browser pass is claimed.

Sample / fixture evidence

Existing public repository fixtures only: apps/component-demo/test/webpack5-issues/src/App.vue, apps/component-demo/test/angular-pptx, and apps/viewer-demo/public/example/ppt.pptx. No private samples are introduced.

Visual evidence

N/A: this change repairs test-application dependency policy and preserves audit evidence. Rendering and Worker behavior are verified by the existing hosted browser suite.

Risk and compatibility

• Affected packages/formats: Angular and Vue CLI/React packed-consumer fixtures, their helper/tests, and CI audit artifact retention.
• Compatibility or migration risk: Angular remains on its existing 22.1 cohort; Vue/CLI/React majors, TypeScript pins and library compatibility floors remain unchanged. Fixture npm overrides do not become library-default policy. No Mermaid or KaTeX override is added.
• Remaining security boundary: legacy Vue CLI tooling and the transitive KaTeX advisory remain reportable. An audit total counts affected entries, not distinct exploits. A passing browser build does not mean a clean full or production audit.
• Vue 2 compatibility is outside the Vue 3 patch. The workspace exception for GHSA-5j4c-8p2g-v4jx can include an auto-installed production Vue 2 peer; it is not exclusively development-only. Vue 2 hosts must use application-controlled templates and must not compile untrusted templates, including during SSR. This boundary does not fix the advisory; a maintained backport or migration remains separate.
• npm audit registry/data failures fail evidence generation rather than being reported as clean. Vulnerability findings are retained without pretending this maintenance change resolves the legacy dependency graph.
• Rollback: revert this focused commit; no package release, version bump or lockfile migration is involved.

Checklist

• I added or updated focused automated coverage, or explained why it is not needed.
• I updated user-facing documentation or release notes when behavior or API changed, or marked them not applicable.
• I verified offline/private-deployment paths when changing Worker, WASM, fonts, vendor assets, or URLs. N/A: paths are unchanged; existing hosted Worker/browser checks remain required.
• I did not commit secrets, customer files, private samples, generated caches, or unrelated changes.