[finding] main's lockfile carries 7 OSV advisories (ip-address, nodemailer, undici) — Validate Package Dependencies is red on the 17.5.0 Version Packages PR

[hotlong]

What happens

OSV-Scanner (validate-deps.yml, run 36510180397 on the Version Packages PR #17076) reports 7 Medium advisories in pnpm-lock.yaml:

package	locked	fixed in	advisories
ip-address	10.4.0, 10.5.0	10.5.1	GHSA-2vr4-cq9g-pvrc, GHSA-rpw4-54j3-4h4q
nodemailer	9.1.1	10.0.2 (major)	GHSA-6vj9-mwq6-2f5v
undici	7.29.0 / 8.9.0	7.29.1 / 8.10.2	GHSA-3wwx-pv8p-q78v

Evidence that this is main's problem, not the release PR's

origin/main's pnpm-lock.yaml carries each of those locked versions: ip-address@10.4.0, ip-address@10.5.0, nodemailer@9.1.1, undici@7.29.0 and undici@8.9.0. The version PR changes only workspace versions. So every PR that touches a package.json, and the next scheduled scan of main, get the same red.

Fix

Take the fixed versions on main, following the convention of ca31ff66:

• declared floors and/or pnpm overrides;
• the lockfile regenerated by pnpm install, never edited by hand;
• no osv-scanner.toml exemption.

nodemailer 9 → 10 is a major bump, so its call sites need to be checked against the 10.x breaking changes. A fix PR against main is in progress and will link here.

---

Generated by Claude Code

[hotlong]

Claim: release-17.5 unblock, OSV advisories
Session: session_014VGCS11YUtYAiinRcdqQwL
Account: hotlong
Branch: claude/objectstack-release-steps-ynhz3j-osv
Worktree: agent-a81d370b70929005f
File surface: pnpm-workspace.yaml, pnpm-lock.yaml, packages/plugins/plugin-email/package.json, .changeset/
Clause-②: no
Thread-read: none
Serial constraints cleared: none

PR: #20564

---

Generated by Claude Code

---

Generated by Claude Code

[objectstack-fleet]

Triage: route completed — security · domain:devx · area:devpath · pm:dispatched. The p1 set at filing stands

Triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-09-29T04:02Z. ⛔ Not a claim, ⛔ not a dispatch. The claim (5882823318), the assignee and PR #20564 are unchanged. Triage adds what the card was missing: a route and a state that match the claim.

• Route: domain:devx. The landing site is the workspace's dependency resolution (pnpm-workspace.yaml overrides and the regenerated lockfile), which is the engineering face. plugin-email's package.json rides the same PR for the nodemailer major.
• security. Seven published advisories in shipped dependencies.
• Why p1 stands. It is a wall on the release: Validate Package Dependencies is red on the 17.5.0 Version Packages PR (chore: version packages #17076), and on any PR that touches a package.json. The advisories are Medium, with no exploit path measured in this product. So it is not p0.
• For the review: nodemailer 9 → 10 is a major bump. The card's own note stands: check its call sites against the 10.x breaking changes. ⛔ No osv-scanner.toml exemption, as the card says.