[alvaroloes]

Summary

Refresh the security floors in published container images. Includes an explicitly accepted, single-advisory temporary pnpm exception tracked in #450; no required checks or image scanners are disabled.

• Invalidate cached Debian upgrade layers in the API, web and runner images, and raise the runner Chromium minimum to 154.0.8037.57-1~deb13u1.
• Upgrade the runner's global npm dependency overlays: brace-expansion to 5.0.12, ip-address to 10.7.1, and undici to 6.28.1.
• Update the repository's pinned pnpm from 11.20.0 to 11.28.2 (same major) and align setup documentation. The old Corepack-cached pnpm distribution also bundled vulnerable undici; updating only npm's global overlay does not fix it.
• Add a build-time guard for npm's resolved dependencies and every cached pnpm undici copy, with deterministic unit and filesystem/CLI regression tests.
• Pin the documentation HTTP client's transitive http-cache-semantics to official 4.3.0, with a narrowly scoped lockfile update and consumer-level cache tests.

Evidence and scope

The image publication scan on main at 446d1ee8f4b61932ec19984a3b0aa05b35021a30 failed: CI run. The root dependency lockfile does not govern npm's global dependencies or the package manager bundled inside the runner.

Base image digests, agent CLI versions, scan thresholds, IAM and deployment configuration are unchanged. The only new audit exception is GHSA-vfj7-8cjw-p6xm, described below. This PR changes no lifecycle or authorization behavior. It affects future image builds after review/merge; it does not mutate running workspaces.

Validation

• Frozen-lockfile installation with pnpm 11.28.2: passed, including the follow-up cache dependency update.
• Targeted image/security/toolchain tests: 28 passed, no skips.
• Lint, repository guards and git diff --check: passed.
• Full local pnpm verify: lint, typecheck and clean builds passed, but the critical test stage stopped at a 5-second timeout in workspace-vercel-bootstrap.integration.test.ts (starts the real authenticated gateway through the SDK user switch without exposing a bare app; 16 other tests in that file passed). This run is not green; the timeout is not suppressed or claimed to be a proven pre-existing failure. The remaining verification stages did not run in that invocation.
• Representative local arm64 distro/npm/Corepack layer built successfully, including the executable guard and npm/pnpm smoke checks. Grype 0.110.0 with --only-fixed --fail-on high reported zero matching fixable vulnerabilities.
• This local image is not the complete production amd64 runner. Complete image builds/scans remain CI/release gates; no claim of rollout or production acceptance is made.

Follow-up validation and remaining audit blocker

• Initial PR CI passed builds, functional tests, minimum-node and workspace E2E. The local bootstrap timeout did not reproduce; CI stopped only at the dependency audit.
• The official http-cache-semantics@4.3.0 update removes GHSA-ch52-4w7c-c8xp from the current audit result. Three added tests check the actual transitive resolution, the documented storable() gate for private/no-store responses, and real HTTP-client behavior against a local server (private isolation and public-cache compatibility). These and the three existing dependency-security tests pass, as do the docs build, lint and diff checks.
• Important qualification: this is an official dependency update, not a claim that 4.3.0 changes the behavior described by that disputed advisory. The maintainer rejected the report (upstream explanation); advisory review request #10139 remains open. Shared consumers must honor storable() before storing responses; revalidation alone is not that gate.
• After the cache update, the remaining finding on October 5 was GHSA-vfj7-8cjw-p6xm, braces@3.0.3. Latest official npm remains 3.0.3. The maintainer disputes the report in upstream #70, and proposed fixes #72 and #75 are closed without merge. An advisory clarification PR is pending, not an accepted fix or withdrawal.

October 6: explicitly approved temporary exception

Added only GHSA-vfj7-8cjw-p6xm to pnpm's existing auditConfig.ignoreGhsas, with an English comment linking tracking issue #450. Owner: @alvaroloes. Human review date: 2026-10-13. This is temporary risk acceptance, not a braces fix. There is no automatic expiry, additional workflow or change to required checks. Existing exceptions are unchanged; no image-scanner exception is added.

The first October 6 audit after that exception returned 11 other non-ignored findings (3 critical, 4 high, 3 moderate, 1 low). The follow-up below addresses them after explicit authorization; they were not added to the ignore list.

Authorized follow-up: remove the 11 additional audit findings

• Critical: proxy-addr 2.0.8 and tinypool 2.1.2 (two advisories). Tinypool 2 drops Node 18; the repository's supported Node 22/24 contract is unchanged. Tests exercise actual HTTP trust behavior and real workers with inherited execArgv, env and per-task filename values in disposable processes, alongside normal worker operation.
• Other official updates: source-map-js 1.2.2, compression 1.8.2, postcss-selector-parser 7.1.6, prosemirror-view 1.42.3, coordinated Vue 3.5.42 packages, KaTeX 0.18.2 and Joi 17.13.8. The selector-parser major and KaTeX pre-1.0 minor changes are included in the compatibility/build verification, not characterized as patch-only changes.
• Remove unpatched sprintf-js instead of ignoring it: scope official argparse 2.0.1 to js-yaml@3. Its legacy API compatibility preserves data conversion, but the old constructor version option prints nothing. A small checked-in js-yaml@3.15.2 CLI-only compatibility patch switches that flag to an explicit version action. The YAML parser is not modified. Unit/CLI integration tests cover actual resolution, lockfile removal of sprintf-js, YAML parsing, conversion, help, version output and rejection of invalid options. This local compatibility patch is not presented as an upstream js-yaml release.
• pnpm audit --audit-level low now passes, with only previously accepted advisory exceptions. No new ignores beyond the separately approved braces exception; no thresholds, required checks, image scans or deployment controls are changed.
• Frozen install, eight new critical/CLI regression cases and final docs build pass. An intermediate full pnpm verify passed lint/typecheck/clean build and the critical DB/CLI/API suites, then hit the existing image-size ICNS subprocess's 1.5-second timeout in the parallel script stage. A separate serialized script run verifies that case without changing its timeout or CI concurrency. Final full remote CI remains the merge gate; no merge/deployment performed.