Dependency security boundaries
Service Lasso validates two dependency boundaries from the exact lockfile:
npm run audit:productionrejects every known production vulnerability.npm run audit:toolingrejects critical and high vulnerabilities in the full contributor, documentation, and build graph.
The Docusaurus 3.10.2 development server resolves sockjs to patched uuid 11.1.1 through a narrow package override. The reviewed CommonJS uuid.v4() path used by sockjs remains compatible, and the lockfile test prevents the patched boundary from silently regressing. Both production-only and complete dependency audits must report zero known vulnerabilities.
Fail-closed image metadata boundary
Docusaurus depends on image-size, whose upstream 2.0.2 release has unpatched infinite-loop advisories in ICNS, JXL, and HEIF parsers. The current documentation tree has no image assets and does not require build-time dimension parsing. The lockfile therefore resolves image-size to the versioned packages/image-size-safe workspace replacement. It exposes the compatible module surface but rejects every parse request, so an untrusted image cannot enter a vulnerable parser or block the documentation build process.
Do not add documentation image assets while this replacement is active. Remove it only after upstream publishes a patched release, then restore image coverage and keep npm run audit:tooling green.
serialize-javascript is forced to patched version 7.1.0 for Docusaurus' copy and CSS minimizer plugins. The lockfile test prevents any of these security boundaries from silently regressing.
Production @modelcontextprotocol/sdk still declares Express 4 and body-parser ranges that resolve qs to 6.15.3. Issue #1219 forces qs to patched 6.16.0 so npm audit --omit=dev and the critical/high tooling gate stay fail-closed. Express and body-parser keep calling qs.parse without comma: true; the override does not change that call surface. Dependabot already landed fast-uri 3.1.7 in #1220. A source lockfile fix is not remediation of already-published Core npm 2026.9.1-1f4ec40; republish belongs to #1151.
Production ZIP handling uses pinned fflate 0.8.3 through src/runtime/files/safe-zip.ts, which enforces path containment and refuses destination-symlink writes during extraction. @modelcontextprotocol/sdk transitively resolves hono below 4.13.5; the lockfile forces hono 4.13.7 so MCP HTTP transport stays on the patched release without changing the SDK pin.
Local docs-tool patches (#1612)
The 2 October 2026 advisory updates block the docs tooling gate for
braces <=3.0.3 and
http-cache-semantics <=4.2.0.
Neither has an upstream patched release. The locked workspace copies are local
patch versions, not upstream releases: braces 3.0.4 and http-cache-semantics 4.2.1.
They retain upstream licenses and original file hashes in UPSTREAM.json.
Braces rejects patterns over 10,000 characters and structural nesting over 64 before parsing, conservatively counting quoted/escaped delimiters. Public AST walkers reject depth over 64, more than 10,000 nodes and repeated/cyclic nodes before recursive traversal. Ordinary documentation globs retain upstream behavior. HTTP cache policy requires revalidation whenever maxAge is zero, including security-zeroed cookie/private/no-cache entries; client max-stale cannot revive them. Explicitly cacheable positive-TTL responses retain upstream behavior. These are tooling-only patches; audit thresholds remain unchanged. Direct regressions live in tests/docs-tooling-security.test.js (SPEC-002 AC-4AJ.6). Remove the local copies only after upstream remediation and fresh compatibility, regression, audit and docs-build evidence.
The vendored cache policy also splits Vary and Connection headers on literal commas and trims each token, avoiding upstream polynomial whitespace backtracking. Semantic header checks and an externally bounded long-whitespace probe cover this CodeQL review finding.