fix(security): merge per-range registry advisories and patch brace-expansion and undici

[aviggiano]

Problem

CI on main (a46a496) and on every open PR fails Build gates and Package, dependency, and policy gates at pnpm -w security:dependency-advisories:

dependency advisory policy: approved registry advisory brace-expansion[2] duplicates GHSA-6j4f-fj2g-mc7p

Nothing in the repo changed. The npm registry published new brace-expansion and undici advisories on 2026-09-28/29.

Root cause

Two separate problems:

1. The parser rejects valid registry responses. The bulk endpoint returns one entry per affected version range, so one GHSA shows up several times for one package, each with its own registry id and vulnerable_versions. For our request (brace-expansion 2.1.4 and 5.0.9), GHSA-6j4f-fj2g-mc7p comes back as ids 1240109 (>=2.0.0 <2.1.5) and 1240111 (>=4.0.0 <5.0.10). strictProductionAuditFromBulkResponse keyed on (GHSA, package) and threw on the second entry.
2. Real High advisories are in the production closure. With the parser fixed, the gate reports:
   • GHSA-6j4f-fj2g-mc7p and GHSA-qhr7-859c-m2p7 (High) in brace-expansion 2.1.4 and 5.0.9. These come from @oclif/core through minimatch 5.1.9 / 10.2.5, and 5.0.9 is also bundled inside the operator npm.
   • GHSA-rfgv-xxqx-mfg5 (High) in undici 6.28.0, bundled inside the operator npm only.

Change

fix(ci): merge per-range registry entries in the advisory gate

• Entries that share a GHSA for one package merge into one audited advisory at the highest severity among their ranges. An exception therefore still has to match the worst installed range.
• A repeated registry id is rejected anywhere in the response: same GHSA, different GHSA, or another package. All other malformed-input checks are unchanged.
• Tests in scripts/ci/dependency-advisories.test.ts cover per-range merging in both orders, no merging across packages, policy evaluation of a merged advisory with and without an exception, and three repeated-id cases. Both new tests fail on main.

fix(security): move brace-expansion and undici past the September advisories

• pnpm-installed copies: pnpm update brace-expansion -r moves 2.1.4 to 2.1.7 and 5.0.9 to 5.0.12, within the dependents' existing ranges (^2.0.1, ^5.0.5). The lockfile diff is just those two bumps plus the patch hash.
  • I did not add a pnpm override: workspace-engine-overrides.test.ts requires the overrides block to equal the Effect pin set exactly.
• Copies bundled inside the operator npm: overrides can't reach inside the npm tarball, and no npm release bundles a fix yet (11.19.1, 11.20.0, 12.1.0 and the open 11.20.1 release PR all ship brace-expansion 5.0.9 and undici 6.28.0). So I extended the existing lockfile-bound npm@11.19.0 patch, which is how the repo already handles this, to carry brace-expansion 5.0.12 and undici 6.28.1:
  • The new files come from the registry tarballs (sha512 checked against registry metadata), filtered by npm/cli's own node_modules/.gitignore. Applied to 5.0.9 / 6.28.0, that filter reproduces npm's current bundle byte for byte.
  • The patch was regenerated with pnpm patch-commit and normalized the way the committed patch already was (blank context lines without a trailing space; see cf2926c in fix(security): close final AppSec review gaps #644). The ip-address, tar and npm package.json hunks are byte-identical to main, so reviewing with git diff -w hides nothing.
  • The pinned operator npm closure digest is now 4852a49e… (12,230,966 bytes; still 460 dirs / 1,943 files). operator-npm.test.ts pins the new bundled versions and checks that the comma-part input that overflows 5.0.9's stack now expands.
• docs/security.md and CHANGELOG (Unreleased > Other changes) are updated.
• No advisory exception was needed.

Verification

• bun test scripts/ci/dependency-advisories.test.ts: 21 pass. Swapping in main's script makes exactly the two new tests fail.
• pnpm -w security:dependency-advisories: exit 0, 0 High/Critical production advisories; 0 active exceptions. Also exit 0 from a fresh worktree after pnpm install --frozen-lockfile.
• pnpm install --frozen-lockfile passes, both in place and in a fresh worktree.
• git apply of the committed patch onto the pristine npm-11.19.0.tgz gives the same tree and digest. The installed brace-expansion/undici dirs match the filtered registry tarballs file for file.
• Passing: pnpm -w build, pnpm -w lint, strict lint on the changed files, pnpm -w knip, pnpm -w format:check, pnpm -w docs:check, and pnpm -w test:ci-scripts (84 pass).
• @ultrafuzz/runtime operator-npm.test.ts: 3 pass.
• The patched operator npm runs npm pack --dry-run with brace globs in files and includes and excludes the right files.
• The built CLI's --help and command help load under brace-expansion 5.0.12.

Known risks / follow-ups

• Still in the production closure, below the High/Critical threshold, so the policy doesn't block them: Moderate fast-uri 3.1.7 (GHSA-hrr3-gc8f-f4qj) and four Moderate ip-address 10.5.0 advisories inside the npm bundle.
• The npm patch now goes beyond what upstream npm ships. Drop the brace-expansion/undici hunks once an npm release bundles brace-expansion >= 5.0.12 and undici >= 6.28.1.

🤖 Generated with Claude Code

Confidence Score: 4/5

The PR appears safe to merge, with a non-blocking gap in regression coverage for bundled undici.

Findings

1.  Undici behavior lacks regression coverage ▶

Fix with agent prompt

### Issue 1
packages/runtime/test/operator-npm.test.ts:34
The test checks that bundled undici is version 6.28.1, but it does not exercise undici’s changed behavior. The patch changes HTTP socket validation and retries, among other behavior, so the version check and closure digest would still pass if one of those paths regressed. A focused test of the advisory fix would help catch that before release.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Summary

The PR merges per-range registry advisories by GHSA and package at their highest severity, updates installed brace-expansion versions, and extends the pinned operator-npm patch with newer bundled brace-expansion and undici versions.

• The advisory gate retains strict duplicate registry-ID rejection.
• The operator-npm closure digest and version assertions are updated; the bundled undici behavior lacks a focused regression test.

_{Reviews (1) · Last reviewed commit: "fix(security): move brace-expansion and ..."}

[greptile-apps]

Undici behavior lacks regression coverage The test checks that bundled undici is version 6.28.1, but it does not exercise undici’s changed behavior. The patch changes HTTP socket validation and retries, among other behavior, so the version check and closure digest would still pass if one of those paths regressed. A focused test of the advisory fix would help catch that before release.

Prompt To Fix With AI

This is a comment left during a code review.
Path: packages/runtime/test/operator-npm.test.ts
Line: 34

Comment:
**Undici behavior lacks regression coverage** The test checks that bundled undici is version 6.28.1, but it does not exercise undici’s changed behavior. The patch changes HTTP socket validation and retries, among other behavior, so the version check and closure digest would still pass if one of those paths regressed. A focused test of the advisory fix would help catch that before release.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

[aviggiano]

Keeping this as a version check. Two reasons:

• A regression can't pass silently. bundledOperatorNpmClosureForValidation hashes the path and bytes of every file in npm's tree except node_modules/.bin, and the first test in this file pins that digest (4852a49e…). Any change to a bundled undici file changes the digest and fails that test, not only a version bump. The bundled files are also byte-identical to the registry tarball of undici 6.28.1 (sha512 matches registry metadata) after npm's own bundle filter.
• The fixed code isn't reachable from the operator npm. Inside npm, only node-gyp/lib/download.js requires undici, for Agent, EnvHttpProxyAgent, RetryAgent and fetch. The High advisory (GHSA-rfgv-xxqx-mfg5) and GHSA-3wwx-pv8p-q78v are in undici's WebSocket client, which npm never opens. A behavioral test would exercise upstream code this package never runs.

brace-expansion got a behavioral check because minimatch reaches it on every glob npm expands, and a stack-exhausting input makes a cheap check.

[greptile-apps]

That’s a fair justification. Given the closure digest covers every bundled file’s path and contents, a bundled-undici change cannot pass silently just because the version assertion remains unchanged. Since npm’s bundled code does not exercise the advisory’s affected WebSocket path, a behavioral test here would not add meaningful coverage; the existing version, byte-level closure, and registry-integrity checks are appropriate. I’m withdrawing this finding—no additional test is needed.