RomanNum3ral
/
paperclip
mirror of https://github.com/paperclipai/paperclip.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Patch isolated reporting URI dependency and enforce Node policy 

Co-Authored-By: Paperclip <noreply@paperclip.ing>
This commit is contained in:
Dotta 2026-09-12 22:46:36 -05:00
parent 2116570603
commit 86bbabfecd
4 changed files with 33 additions and 17 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
tests/runner-e2e/reporting-runtime/README.md
View File

@ -23,3 +23,8 @@ Review every changed package version/integrity, then run the workflow boundary
tests and the report/publisher smoke with local evidence and a fake AWS CLI.
Never run that update command in the reporting workflow. Do not edit the
CI-owned root pnpm lock for this package.
The exact `fast-uri` override uses the patched 3.1.6 line for the URI parsing
advisories, including [GHSA-f65p-4m7j-42xc](https://github.com/fastify/fast-uri/security/advisories/GHSA-f65p-4m7j-42xc).
Do not inherit an older vulnerable version solely because it appears in the
workspace lock. The standalone runtime follows the repository Node engine policy.

35
tests/runner-e2e/reporting-runtime/package-lock.json generated
View File

@ -12,6 +12,9 @@
"ajv": "8.20.0",
"tsx": "4.23.12",
"zod": "4.4.3"
},
"engines": {
"node": ">=24.11.0"
}
},
"node_modules/@esbuild/aix-ppc64": {
@ -461,22 +464,6 @@
"url": "https://github.com/sponsors/epoberezkin"
}
},
"node_modules/ajv/node_modules/fast-uri": {
"version": "3.1.2",
"resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.2.tgz",
"integrity": "sha512-rVjf7ArG3LTk+FS6Yw81V1DLuZl1bRbNrev6Tmd/9RaroeeRRJhAt7jg/6YFxbvAQXUCavSoZhPPj6oOx+5KjQ==",
"funding": [
{
"type": "github",
"url": "https://github.com/sponsors/fastify"
},
{
"type": "opencollective",
"url": "https://opencollective.com/fastify"
}
],
"license": "BSD-3-Clause"
},
"node_modules/esbuild": {
"version": "0.28.2",
"resolved": "https://registry.npmjs.org/esbuild/-/esbuild-0.28.2.tgz",
@ -524,6 +511,22 @@
"integrity": "sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q==",
"license": "MIT"
},
"node_modules/fast-uri": {
"version": "3.1.6",
"resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.6.tgz",
"integrity": "sha512-7Ical1vFEMr0onbVzEDIreM22I4khW+fzyQPwvAFWBp1iwdshSZRsL4jjRvPG9JP1uiqMHRto+YU6R2/CzDz5Q==",
"funding": [
{
"type": "github",
"url": "https://github.com/sponsors/fastify"
},
{
"type": "opencollective",
"url": "https://opencollective.com/fastify"
}
],
"license": "BSD-3-Clause"
},
"node_modules/fsevents": {
"version": "2.3.2",
"resolved": "https://registry.npmjs.org/fsevents/-/fsevents-2.3.2.tgz",

5
tests/runner-e2e/reporting-runtime/package.json
View File

@ -11,6 +11,9 @@
"zod": "4.4.3"
},
"overrides": {
"fast-uri": "3.1.2"
"fast-uri": "3.1.6"
},
"engines": {
"node": ">=24.11.0"
}
}

5
tests/runner-e2e/workflow-trusted-lock.test.ts
View File

@ -13,6 +13,11 @@ it("locks every reporting registry artifact with integrity and exact direct vers
const manifest = JSON.parse(readFileSync(path.join(root, runtime, "package.json"), "utf8"));
const lock = JSON.parse(readFileSync(path.join(root, runtime, "package-lock.json"), "utf8"));
expect(manifest.private).toBe(true);
expect(manifest.engines).toEqual({ node: ">=24.11.0" });
expect(lock.packages[""].engines).toEqual(manifest.engines);
// 3.1.6 fixes the six URI parsing advisories affecting the inherited 3.1.2 lock.
expect(manifest.overrides["fast-uri"]).toBe("3.1.6");
expect(lock.packages["node_modules/fast-uri"].version).toBe("3.1.6");
expect(manifest.scripts).toBeUndefined();
expect(lock.lockfileVersion).toBe(3);
expect(lock.packages[""].dependencies).toEqual(manifest.dependencies);