[finding] main's lockfile matches two new OSV advisories on @vitest/mocker 4.1.11 (GHSA-qxg6-89mg-rqv8, GHSA-xp26-3454-mjgp; fixed in 4.1.12): the scheduled OSV scan is red again

Filed by domain:devx seat 1 (seat post #6023) · os-warren · session session_01FM29ZqLTrnPNXxijioZwMp, while reading the scheduled run that #25041's landing record named as its owed check. ⛔ Not a claim.

What is red

Validate Dependencies' scheduled run 39714768704 (main 6b44efa7b4, 2026-10-22 03:03 UTC), job 119614140669, fails at Audit dependencies for known vulnerabilities (OSV-Scanner). The previous scheduled run, 39536495453, was red on #25041's four packages, which PR #25047 fixed. None of those four appears in this run.

The scanner read pnpm-lock.yaml (1340 packages) under osv-scanner.toml. The one exemption (GHSA-hp3w-g68c-fv3c, sprintf-js) is still filtered. It reports:

OSV	CVSS	Package	Locked	Fixed
GHSA-qxg6-89mg-rqv8	4.7	`@vitest/mocker`	4.1.11	4.1.12
GHSA-xp26-3454-mjgp	5.9	`@vitest/mocker`	4.1.11	4.1.12

"Total 1 package affected by 2 known vulnerabilities (0 Critical, 0 High, 2 Medium, 0 Low, 0 Unknown)", "2 vulnerabilities can be fixed."

Where it enters (read from `main`'s lockfile, to confirm)

@vitest/mocker@4.1.11 comes in under vitest@4.1.11. The workspace declares vitest as ^4.1.11 in 79 manifests, and as ~4.0.0 in 2. vitest 4.1.12 is on npm (2026-10-15) and inside the caret, so this looks like a lockfile refresh of the vitest / @vitest/* family in lockstep.
No published package declares vitest as a runtime, peer or optional dependency: the advisories reach the test toolchain, not a shipped artifact. The dev confirms the two ~4.0.0 declarations and what they resolve to.
The advisory texts were not readable from this container (osv.dev is outside the network allowlist). The dev reads them from the run's links.

Why p2

Validate Dependencies is not in RELEASE_GATE_WORKFLOWS, and a pull request's OSV leg is judged against its merge base (#22082). But while the daily scan stays red, a new High or Critical advisory on main does not change its conclusion. The daily cadence exists to narrow that discovery window.

Done when

pnpm-lock.yaml on main resolves @vitest/mocker at or above 4.1.12, with every vitest / @vitest/* entry moved in lockstep. A refresh is preferred. An override is used only if a refresh cannot reach it, following the pnpm-workspace.yaml overrides convention.
The workflow's own gates pass on the PR, including check:vendor-export-contract-resolve and the published-manifest override check.
The next scheduled Validate Dependencies run on main concludes success at its OSV step, or the card reopens with that run's reading.

Dedupe

search_issues on objectstack, "vitest mocker vulnerability OSV advisory GHSA-qxg6-89mg-rqv8 GHSA-xp26-3454-mjgp Validate Dependencies": 15 hits, none open. The precedents are #25041, #22148, #21945 and #22013 (the same step, each a different advisory). No open PR touches pnpm-lock.yaml at the time of filing. Dedupe words: vitest mocker 4.1.11 advisory, scheduled OSV scan red, Validate Package Dependencies vitest.

Generated by Claude Code

Claim: PM loop round 40 · a p2 security finding this seat filed while reading #25041's owed check; serial dispatch under the maintainer's 「串行派发」
Session: session_01FM29ZqLTrnPNXxijioZwMp
Account: os-warren (the seat's linked user as GET /user answers it; the card's assignee)
Branch: claude/issue-25163-vitest-mocker-osv
Worktree: objectstack-issue-25163
Domain: domain:devx
Seat: domain:devx#1
File surface:

pnpm-lock.yaml: the vitest / @vitest/* family moves to 4.1.12 or above in lockstep, regenerated by pnpm, never by hand.
package.json manifests, only if a declared range cannot reach 4.1.12. The caret ^4.1.11 reaches it, so none is expected. The two ~4.0.0 declarations are read and reported, not widened unless they resolve to an affected version.
pnpm-workspace.yaml overrides, only if a refresh cannot reach the fixed release.
⛔ No osv-scanner.toml exemption, no workflow, no gate script.
⛔ No release act.
Container & model: S (a lockfile refresh of one devDependency family, proved by the workflow's own OSV step), mode:subagent, model: TIER_DEFAULT
Clause-②: no
Responsibility: the scheduled OSV scan on main is red on @vitest/mocker 4.1.11 (GHSA-qxg6-89mg-rqv8, GHSA-xp26-3454-mjgp, fixed in 4.1.12), so a new High or Critical advisory would not change its conclusion (#25163) | none: vitest's 4.1.12 is inside the workspace's caret, and the lockfile has not been refreshed since it published (2026-10-15) | every contributor and CI job that runs vitest; no published package ships it
Thread-read: none
Serial constraints cleared: no open PR touches pnpm-lock.yaml or pnpm-workspace.yaml (read at 2026-10-22T03:10Z). The one live Claim: naming the lockfile, plugin-auth: SSO domain verification refuses the TXT record request-domain-verification tells the operator to publish (502 DOMAIN_VERIFICATION_FAILED; measured, same on better-auth 1.7.3 and 1.7.12) #25111's 6330409738, excludes it from its own surface. No dev of this session is in flight: [Decision] Previous-major support after 18.0 GA: correct the published N-1 promise to latest-only (A), an on-demand security line for N-1 (B), or a better-auth-style two-branch model (C)? #25102 landed as PR docs(protocol): Support Windows states latest-only support, and the releases index closes the v17 line #25146.

Generated by Claude Code

os-dev-report

{
  "issue": 25163,
  "status": "done",
  "branch": "claude/issue-25163-vitest-mocker-osv",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/25164",
  "session": "session_01FM29ZqLTrnPNXxijioZwMp (mode:subagent; the dispatching PM's id, the Claude-Session line this run was handed; the identity bit is the branch named in claim 6331741181, which matches)",
  "premise_still_valid": true,
  "summary": "Draft PR #25164 (head 9ada86315f; 'Fixes #25163', 'Clause-②: no'; label skip-changeset; assignee os-warren) re-locks vitest and the whole @vitest/* family from 4.1.11 to 4.1.12. 4.1.12 is the newest 4.1.x, and 5.x was not touched. The nine members are vitest, mocker, coverage-v8, expect, pretty-format, runner, snapshot, spy and utils; no @vitest/ui is present. The diff is pnpm-lock.yaml only (+159/-159). packages: 1340 to 1340 (9 removed, 9 added: exactly the family). snapshots: 1347 to 1347 (15 removed, 15 added: 11 family, plus 4 better-auth 1.7.12 snapshots that only rewrite their optional vitest peer suffix). 0 importer specifier moves; overrides, settings and patchedDependencies unchanged; chai stays 6.2.2. pnpm why confirms the paths. vitest is a direct devDependency ^4.1.11 in 79 importers (78 under one peer variation, @objectstack/account under the other). @vitest/mocker is vitest's exact dependency. @vitest/coverage-v8 is a direct ^4.1.11 in @objectstack/spec. The two ~4.0.0 declarations are both in packages/create-objectstack/src/templates/blank/package.json (devDependencies plus npm overrides). That file is not a workspace importer, and no 4.0.x entry is in the lockfile, so they were left alone per Ruling 1. They are affected in a scaffolded project; see out_of_scope_findings. CONFLICT NAMED, NOT SILENTLY RESOLVED: Ruling 2 names 'a targeted pnpm update' as the method and also says 'prefer the narrowest lockfile change'. I measured the targeted update (pnpm update -r --no-save vitest @vitest/coverage-v8). It reached 4.1.12 but touched 29 package names outside the family (+317/-284: @inquirer/*, seroval, chai 6.3.0, rolldown 1.2.15 and its 15 bindings, @oxc-project/types, 5 new copies, and knex/tsup/postcss-load-config/fumadocs-mdx snapshot keys). I therefore took the narrower re-lock recipe of #21951/#25047. Two temporary exact overrides went in pnpm-workspace.yaml under an EXIT trap, then install, restore, install. The restore is hash-proven: git hash-object equals the HEAD blob d9b99fcddf13011318845269277987410889b7c0, and git diff HEAD is empty. Advisory texts were read from the OSV npm database archive, because api.osv.dev, api.github.com/advisories and github.com/advisories all answer 403 here. GHSA-qxg6-89mg-rqv8 is a code injection via unauthenticated manual mock registration (affected from 2.1.0-beta.7 up to the fix in 4.1.12). GHSA-xp26-3454-mjgp is a Windows backslash traversal bypass of the redirect allowlist (affected only 4.1.11 on the 4.x line). Both were published 2026-10-21 ~19:50Z. A tarball diff of all nine members, 4.1.11 against 4.1.12, shows the only behavioural code change is the two @vitest/mocker fixes; runner, expect, snapshot, spy, utils and pretty-format have 0 non-manifest diff lines. Cleanup: the scanner binary, the tarballs and both copies of the 218 MB OSV database (scratch, and /root/.cache/osv-scalibr, where osv-scanner 2.5.0 caches regardless of OSV_SCANNER_LOCAL_DB_CACHE_DIRECTORY) are deleted. The worktree's node_modules and the worktree itself are removed right after this comment posts (no --force; the branch is pushed at 9ada86315f).",
  "tests": "All at HEAD 9ada86315f. (1) pnpm install --frozen-lockfile --prefer-offline: exit 0. (2) os-verify-lock -c 'pnpm --filter @objectstack/spec build': VERDICT command-exit 0. (3) os-verify-lock -c 'pnpm --filter @objectstack/formula test && pnpm --filter @objectstack/types test': VERDICT command-exit 0. formula 'RUN v4.1.12', 'Test Files 51 passed (51)', 'Tests 1367 passed (1367)'; this includes src/cel-env-reuse.test.ts, which module-mocks @marcbachmann/cel-js through vi.mock with importOriginal (the @vitest/mocker path). Resolved from that package: vitest 4.1.12, @vitest/mocker 4.1.12. types 'RUN v4.1.12', 'Test Files 29 passed (29)', 'Tests 774 passed (774)'. (4) os-verify-lock, @objectstack/spec's six vi.mock test files with --coverage (provider v8): VERDICT command-exit 0, 'Coverage enabled with v8', 'Test Files 6 passed (6)', 'Tests 101 passed (101)'; this loads @vitest/coverage-v8 4.1.12 against its exact vitest 4.1.12 peer. (5) OSV: osv-scanner 2.5.0, sha256 edcfc41d...524e0c, matching the release SHA256SUMS and the binary the action's v2.5.0 image ships. Offline (--offline-vulnerabilities --download-offline-databases) against the npm database downloaded 2026-10-22 03:24 UTC, each side under its own osv-scanner.toml, identical invocation. Base 6b44efa7b4: exit 1, the scheduled run's 2 rows (1340 packages; @vitest/mocker 4.1.11, fixed 4.1.12, CVSS 4.7 / 5.9). Head 9ada86315f: exit 0, 'No issues found'. The sprintf-js exemption is filtered on both sides, which is the DB-loaded control. The scheduled run's own invocation (--lockfile=pnpm-lock.yaml at the worktree root, ledger auto-loaded): exit 0, 'No issues found', with 'Loaded npm local db' and the exemption filtered. scripts/osv-base-relative.mjs over both JSON results: exit 0, '0 introduced, 0 inherited, 2 resolved'. One void reading, declared: the first root invocation without --download-offline-databases printed 'No issues found' at exit 0 with 0 'Loaded npm local db' lines and no filtered exemption. It loaded no database and is not counted. (6) Changeset measurement: the diff is pnpm-lock.yaml alone, a root config file with no package.json change. 0 tracked manifests declare vitest or @vitest/* as a dependency, peer or optional dependency. 0 tsup configs name vitest in noExternal. The built @objectstack/spec dist has 0 files naming '@vitest/' or createManualModuleSource, against a positive control of 7 files in @vitest/mocker 4.1.12's own dist. Result: skip-changeset. No typecheck was run: no package source changed, and the tarball diff shows no .d.ts change in the family. No ablation: no tested behaviour changed (a lockfile re-lock). test:repo not run locally: the diff changes none of its tests and the derivation does not name it; CI's Test Core runs it.",
  "gates": "Local: node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack at 9ada86315f (1 path vs merge base 6b44efa7b) derived 19 commands. All 19 ran through the header's capture loop, exit recorded before any pipe. Exit 0: check-changeset-fixed ('in sync with 73 public workspace packages'); check-closing-keyword-parity (+ --self-test); check-comment-mask-corpus; check-dts-emitted --self-test; check-osv-exemptions (+ --self-test); osv-base-relative --self-test ('23 case(s), all held (floor 23)'); check:driver-memory-census; check:dts-closure; check:gitlink-declared; check:nul-bytes; check:override-consistency ('9 published-manifest declaration(s) covered by pnpm-workspace.yaml overrides all resolve to their override targets'); check:refd-timer-probe; check:sourcemap-no-sources-content; check:vendor-export-contract-resolve ('VERDICT: PASS ... 3 edge(s) verified'); check:watch-hint-literal. check:dts-closure and check:sourcemap-no-sources-content swept only the one built package, @objectstack/spec. NOT MEASURED: check:dual-build-cjs-loads and check:lean-entry-closure, both exit 3, PREREQUISITE NOT MET (built output absent; both need a full pnpm build). CI's Build Core and Lint & Repo Gates measure them. --ran: 'Run reconciliation — 19 derived, 17 run, 2 NOT-MEASURED, 0 UNRUN', exit 0. git merge-tree --write-tree origin/main HEAD (origin/main 06900c9c23): exit 0, clean. pnpm-lock.yaml is not routed to the os-regen driver, and main's 1 new commit touches none of the dependency files. CI, read once at PR open (~03:43Z): 43 check-runs. Success: Check Changeset, Check PR Size, Check Documentation Links, 'Part-of PR must not also close its card', 'The card this PR closes must claim this branch', the two 'No other open PR may claim' guards, filter. Skipped: the opt-in, dogfood-shard and main-only lanes. In progress: Validate Package Dependencies, Build Core, Build Docs, Test Core 1-6, every Lint and Type Check lane, Governed Surface Queue Guard, Dogfood Regression Gate. Verdict: in_progress, not awaited, per the role file.",
  "mcp_calls": "7, all read tools: mcp__github__issue_read x3 (#25163 get, #25163 get_comments, #25041 get_comments for the precedent report shape); mcp__github__get_job_logs x1 (job 119614140669); mcp__github__pull_request_read x3 (#25047 get, #25164 get for the read-back, #25164 get_check_runs). No MCP write tool.",
  "api_writes": "2 relay strokes (POST /repos/objectstack-ai/objectstack/dispatches, each executed as objectstack-fleet[bot]). (1) pr_create, run 39718259909, success: POST /repos/objectstack-ai/objectstack/pulls (draft), POST /issues/25164/assignees, POST /issues/25164/labels. The relay's read-back said the body was byte-identical (14663 bytes) and the assignee os-warren. Its line did not name the label; the PR read lists skip-changeset. (2) This os-dev-report comment: POST /repos/objectstack-ai/objectstack/issues/25163/comments. Plus 2 git pushes, which are not REST: the empty-branch probe that rule 1 requires, then the commit 9ada86315f. Read-only REST also attempted and refused: GET /advisories/{id} (403, session-bound), GET repos/objectstack-ai/objectstack/dependabot/alerts (403).",
  "deviations": [
    "pnpm-workspace.yaml was edited TRANSIENTLY, as the re-lock mechanism, not as a committed override. Two exact entries were inserted into its overrides block under an EXIT/INT/TERM trap. The file was restored to its HEAD blob before the second install: git hash-object equals d9b99fcddf13011318845269277987410889b7c0, and git diff HEAD is empty. The committed diff is pnpm-lock.yaml only.",
    "Ruling 2's named method (a targeted pnpm update) was measured and not taken, because its other clause, 'the narrowest lockfile change', is better served by the re-lock recipe. Both readings are in the PR body.",
    "Two git pushes instead of the one budgeted: the role file's empty-branch probe before any edit, then the commit.",
    "osv-scanner 2.5.0 ignored OSV_SCANNER_LOCAL_DB_CACHE_DIRECTORY and cached its database under /root/.cache/osv-scalibr, outside the scratch directory. It was deleted at cleanup."
  ],
  "open_questions": [],
  "out_of_scope_findings": [
    "class: a · reach: named producer: create-objectstack's shipped scaffold. tsup.config.ts copies src/templates to dist/templates, and files ships dist. The scaffold's devDependencies.vitest '~4.0.0', held by npm overrides.vitest '~4.0.0', resolves today to vitest 4.0.18 and its exact @vitest/mocker 4.0.18 (npm view). That version is inside GHSA-qxg6-89mg-rqv8's affected range (introduced 2.1.0-beta.7, fixed 4.1.12, and no 4.0.x fix exists), so every newly scaffolded project starts with a Medium advisory. Plus exception: security (the advisory serves attacker JS on the dev-server origin) · evidence: the OSV record's ranges; d795719926 (2026-10-16) set the pin deliberately, against npm 10's edgesOut crash on vitest 4.1.12's self-contradictory optional peer @vitest/browser-webdriverio ^4.1.11. The advisory was published 2026-10-21, after the pin, so the pin's trade-off never weighed it. Lifting it needs a decision (npm 10 crash vs advisory) outside this card's file surface · dedupe words: create-objectstack blank template vitest ~4.0.0 advisory, scaffold @vitest/mocker 4.0.18 GHSA-qxg6-89mg-rqv8, template vitest override npm 10 edgesOut",
    "class: none (unexercised drift; behaviour unchanged) · carrier: 承接者:无 · noted in PR #25164 Acceptance notes, not filed · Many comments and pins record behaviour 'measured on vitest 4.1.11' (packages/spec/vitest.config.ts, packages/cli/vitest.config.ts, the @vitest/runner@4.1.11 withTimeout notes in packages/client tests). The tarball diff shows runner and the CLI byte-identical apart from the version string, so the recorded behaviour holds on 4.1.12 · dedupe words: vitest 4.1.11 measured comment, version-stamped vitest note",
    "class: none (pnpm tooling behaviour, not a defect of this repo) · carrier: 承接者:无 · noted in PR #25164 Acceptance notes, not filed · A targeted pnpm update --no-save re-resolves a fixed set of unrelated packages in this workspace, as #25047 measured; the temporary-override re-lock stays the narrow route · dedupe words: pnpm update churn, lockfile re-lock, temporary override",
    "class: none (observation; not readable from this session) · carrier: 承接者:无 · noted in PR #25164 Acceptance notes, not filed · git push printed GitHub's notice of '3 vulnerabilities on the default branch (1 critical, 2 moderate)'. The OSV scan of main matches only this card's two (plus the exempted sprintf-js), and GET dependabot/alerts answers 403 here, so the critical one is unidentified. A seat with Dependabot read access can name it · dedupe words: dependabot critical default branch, dependabot alert unidentified"
  ]
}

Generated by Claude Code

Landed · domain:devx seat 1 · session_01FM29ZqLTrnPNXxijioZwMp · 2026-10-22T04:55Z

reading	result
merge queue	none left: the entry has drained
PR object	PR #25164 merged at 2026-10-22T04:52Z as `b93c750c7b` (ACCEPT `6332575843`; not governed; `Fixes #25163`)
`origin/main`, by content	`pnpm-lock.yaml` (`67cc9c6cab`) is byte-identical to the head `9ada86315f`

State change: PR #25164 closed this card through Fixes #25163 (completed). pm:dispatched comes off in this act.

On main, vitest and the eight @vitest/* members resolve to 4.1.12, and @vitest/mocker 4.1.11 is gone from the lockfile.

Still owed: the next scheduled Validate Dependencies run on main (2026-10-23 ≈03:00 UTC) must conclude success at its OSV step. If it does not, this card reopens with that run's reading.

The scaffolds' vitest ~4.0.0 pin is #25165 (domain:cli). It ships to new projects and is outside this lockfile.

Generated by Claude Code

Owed reading, handed over · domain:devx seat 1 · session_01FM29ZqLTrnPNXxijioZwMp · 2026-10-22T10:00Z

This seat clocks out before the reading its landing record 6333056917 owed falls due. The obligation passes to the next domain:devx seat:

Restart-when: the first scheduled Validate Dependencies run on main after b93c750c7b completes (the daily 03:00 UTC schedule; the first is 2026-10-23). Read its Audit dependencies for known vulnerabilities (OSV-Scanner) step. If it is success, record that here. If it is not, reopen this card with the run id and its findings table.

A failure on a package this card did not move (vitest / @vitest/*) is a new card in the shape of #25163 itself, and this card stays closed.

Generated by Claude Code

Navigation Menu

Repository navigation

[finding] main's lockfile matches two new OSV advisories on @vitest/mocker 4.1.11 (GHSA-qxg6-89mg-rqv8, GHSA-xp26-3454-mjgp; fixed in 4.1.12): the scheduled OSV scan is red again #25163

What is red

Where it enters (read from `main`'s lockfile, to confirm)

Why p2

Done when

Dedupe

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

[finding] main's lockfile matches two new OSV advisories on @vitest/mocker 4.1.11 (GHSA-qxg6-89mg-rqv8, GHSA-xp26-3454-mjgp; fixed in 4.1.12): the scheduled OSV scan is red again #25163

Description

What is red

Where it enters (read from main's lockfile, to confirm)

Why p2

Done when

Dedupe

Activity

objectstack-fleet commented on Oct 22, 2026

objectstack-fleet commented on Oct 22, 2026

objectstack-fleet commented on Oct 22, 2026

objectstack-fleet commented on Oct 22, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Where it enters (read from `main`'s lockfile, to confirm)