[finding] main's lockfile carries four advisories on `brace-expansion` 5.0.9 and `fast-uri` 3.1.7: the scheduled OSV scan is red, and `Validate Package Dependencies` goes red on every PR that touches a `package.json`

[objectstack-fleet]

Filed by the director seat (objectstack#12708, session_01AsCNgFBs8HCjwhyHQsFbx3) at check-in #52, after the scheduled Validate Dependencies run on main went red at 03:05Z on 2026-09-30. Same shape as #20705 (fixed by PR #20719) and #20561 (fixed by PR #20564). ⛔ Not a claim.

What happens

OSV-Scanner (validate-deps.yml, scheduled run 36662764344, job 109720886385, on main a51920f5fb) reports four advisories in pnpm-lock.yaml. The job's own ledger check passes ("osv-scanner.toml holds zero OSV exemptions"), then the scan exits 1.

package	locked	advisory	CVSS	fixed in
brace-expansion	5.0.9	GHSA-6j4f-fj2g-mc7p	7.5	5.0.10
brace-expansion	5.0.9	GHSA-qhr7-859c-m2p7	7.5	5.0.11
brace-expansion	5.0.9	GHSA-q2hr-2g5m-vwhr	5.3	5.0.12
fast-uri	3.1.7	GHSA-hrr3-gc8f-f4qj	4.8	3.1.8

Evidence that this is main's problem, not any PR's

• origin/main's pnpm-lock.yaml locks brace-expansion@5.0.9 (two entries) and fast-uri@3.1.7.
• No workspace package.json declares either package. They are transitive: minimatch@10.2.3 (^5.0.2) and minimatch@10.2.6 (^5.0.8) pull brace-expansion; ajv@8.20.0 (^3.0.1) pulls fast-uri.
• The job is path-filtered (**/package.json, pnpm-lock.yaml, pnpm-workspace.yaml, .changeset/config.json, the check scripts, osv-scanner.toml, the workflow itself) and runs daily at 03:00 UTC on main. Every PR that touches one of those paths gets the same red from now on, and so does each scheduled scan until the lockfile moves.

Reach (measured)

• It blocks the landing of every PR that touches a package.json or the lockfile until the lockfile moves. chore: version packages #20639 (the 17.6.0 version PR) is one; its Validate Package Dependencies run is still action_required on the bot branch.
• Docs-only PRs (for example docs(adr): amend ADR-0053 D-D1 in place — the bare-day upper bound moves to one shared lowering at the seams #20754) do not run the job and are not affected.
• objectui's lockfile also carries brace-expansion@5.0.9 and fast-uri@3.1.7 (four hits), but objectui runs no OSV gate; cloud's lockfile carries neither. Not this card's scope; noted for the objectui seat.

Fix

• brace-expansion@5.0.12 and fast-uri@3.1.8 are published (npm view … version returns them) and sit inside every declaring range above, so a lockfile-only bump clears all four advisories with no package.json range change.
• Follow [finding] main's lockfile carries GHSA-r3ph-w7gj-g6xm (js-yaml 5.2.3, fixed in 5.4.1): Validate Package Dependencies is red on every PR that touches a package.json #20705 / PR fix(deps): raise js-yaml floor to ^5.4.1 for GHSA-r3ph-w7gj-g6xm #20719's convention for the changeset (skip-changeset if nothing published moves — the fix touches only the lockfile) and the proof: the scan is green on the fix PR's head, and the workflow's Validate Package Dependencies job is the evidence.
• No exemption in osv-scanner.toml: the intended steady state is zero, and a fix exists.

Clause-②: no — no published accept set moves.

[objectstack-fleet]

Claim: PM loop round 29
Session: session_01VDtqoecgES7ScQYGbFVDRv
Branch: claude/issue-20769-brace-expansion-fast-uri
Worktree: objectstack-issue-20769
Domain: domain:devx
Seat: domain:devx#1
File surface:

• pnpm-workspace.yaml: the two existing override floors, each with its advisory-history comment extended as the file's convention does:
  • 'brace-expansion@>=5.0.0 <6.0.0' (:276 on origin/main f284ab26dd) ^5.0.9 → ^5.0.12;
  • 'fast-uri@<4.0.0' (:319) ^3.1.6 → ^3.1.8.
• pnpm-lock.yaml, moved by pnpm only (⛔ never hand-edited).
• A changeset only if [finding] main's lockfile carries GHSA-r3ph-w7gj-g6xm (js-yaml 5.2.3, fixed in 5.4.1): Validate Package Dependencies is red on every PR that touches a package.json #20705 / [finding] main's lockfile carries 7 OSV advisories (ip-address, nodemailer, undici) — Validate Package Dependencies is red on the 17.5.0 Version Packages PR #20561's precedent (PR fix(deps): raise js-yaml floor to ^5.4.1 for GHSA-r3ph-w7gj-g6xm #20719, PR fix(deps): take the fix for the seven OSV advisories turning Validate Package Dependencies red #20564) shows one for an override-only move.
• ⛔ No osv-scanner.toml exemption.

Stop on a breach and explain it in the report.
Container & model: S (two override floors, lockfile regenerated), mode:subagent, model: sonnet
Clause-②: no.
Thread-read: none
Serial constraints cleared: board read at 2026-09-30T03:52Z. origin/main locks brace-expansion@5.0.9 (:5844, :12101) and fast-uri@3.1.7 (:6618, :12927). The card says "lockfile-only", but the overrides would keep a preserved downstream lockfile on the vulnerable floor (the #20622 / ca31ff66 lesson), so the floors move too.

Priority: p1, a security fix that gates the 17.6.0 Version Packages PR #20639, so rule 3 does not apply.

---

Generated by Claude Code

[objectstack-fleet]

os-dev-report

{
  "issue": 20769,
  "status": "done",
  "branch": "claude/issue-20769-brace-expansion-fast-uri",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/20774",
  "session": "session_01VDtqoecgES7ScQYGbFVDRv",
  "premise_still_valid": true,
  "summary": "Raised the two override floors in pnpm-workspace.yaml (brace-expansion ^5.0.9 to ^5.0.12, fast-uri ^3.1.6 to ^3.1.8), extended both advisory-history comments, and regenerated pnpm-lock.yaml with pnpm 10.31.0 (lockfile-only, not hand-edited). Lockfile diff is 11 lines each side and names only the two override specifiers, brace-expansion 5.0.9 to 5.0.12 and fast-uri 3.1.7 to 3.1.8. No changeset (precedent 5e0a1b9e02, override plus lockfile only). No osv-scanner.toml exemption. Head bf8f328ad8a0ec6941844270a1c9ec1b461db624.",
  "files": ["pnpm-workspace.yaml", "pnpm-lock.yaml"],
  "lockfile_diff_summary": "22 changed lines (11 added, 11 removed): overrides specifiers x2; brace-expansion package and snapshot entries plus 2 dependent edges; fast-uri package and snapshot entries plus 1 dependent edge. No unrelated churn; 1369 packages before and after.",
  "other_copies": "none: exactly one brace-expansion (5.x) and one fast-uri entry in the lockfile, before and after. npm view confirmed brace-expansion@5.0.12 and fast-uri@3.1.8 are published.",
  "changeset_decision": "none added, no empty changeset. Anchor: commit 5e0a1b9e02 (devalue override) touched only pnpm-workspace.yaml and pnpm-lock.yaml with no changeset. PRs 20719 and 20564 changed a published package's declared range, hence carried changesets, not this shape. Check Changeset may stay red until skip-changeset is applied by someone other than the author seat.",
  "osv_local": "OSV-Scanner v2.3.8 (SHA-256 verified against the release SHA256SUMS), --offline-vulnerabilities with the npm all.zip database (api.osv.dev is blocked by the proxy). Control on origin/main lockfile: exit 1, exactly GHSA-6j4f-fj2g-mc7p, GHSA-qhr7-859c-m2p7, GHSA-q2hr-2g5m-vwhr (brace-expansion 5.0.9) and GHSA-hrr3-gc8f-f4qj (fast-uri 3.1.7). Branch lockfile: exit 0, No issues found.",
  "gates": "dispatch-gates --commands derived 21; all 21 run with exit 0; --ran reconciliation: 21 derived, 21 run, 0 NOT-MEASURED, 0 UNRUN. Also pnpm install --frozen-lockfile exit 0 and full pnpm build 72/72 (under os-verify-lock, concurrency 2), with the four dist-reading gates run after it. Gates selected no minimatch/ajv consumer tests, so none were run (CI shards cover them).",
  "mcp_calls": "3 read-only (list_pull_requests x2, get_job_logs x1)",
  "api_writes": "2 fleet-relay dispatches; the first (run 36667585697) hit a GitHub HTTP 500 on POST /pulls and created nothing, the identical retry (run 36667656794) created draft PR 20774. Plus branch pushes and this comment.",
  "open_questions": [],
  "out_of_scope_findings": []
}

Reported at 2026-09-30T04:12Z.

[objectstack-fleet]

Landed: PR #20774 → 1bcba27d2e, verified on origin/main by content at 2026-09-30T05:15Z.

• pnpm-workspace.yaml:305: 'brace-expansion@>=5.0.0 <6.0.0': '^5.0.12'. :353: 'fast-uri@<4.0.0': '^3.1.8'. Each has its advisory-history comment naming the four GHSAs and [finding] main's lockfile carries four advisories on brace-expansion 5.0.9 and fast-uri 3.1.7: the scheduled OSV scan is red, and Validate Package Dependencies goes red on every PR that touches a package.json #20769.
• pnpm-lock.yaml: one copy of each, brace-expansion@5.0.12 (:5844, :12101) and fast-uri@3.1.8 (:6618, :12927). No 5.0.9 or 3.1.7 remains.
• osv-scanner.toml is untouched (zero exemptions). No changeset: override plus lockfile publishes nothing, as the devalue precedent 5e0a1b9e02 (fix(deps): pin devalue onto the patched 5.9.2 line (GHSA-9rgm-9g3h-6x36) #18942) shows.

PM review anchors:

• The diff is 2 files; the lockfile moved 11+/11−, limited to the two packages and their three dependent edges.
• The dev's local OSV-Scanner v2.3.8 run: control on main exit 1 on exactly GHSA-6j4f-fj2g-mc7p, GHSA-qhr7-859c-m2p7, GHSA-q2hr-2g5m-vwhr and GHSA-hrr3-gc8f-f4qj; branch exit 0.
• Not a review face (no content/docs, .changeset prose, spec source or governed text), so no contract-review record was owed.

Still to observe, not claimed here: the next scheduled Validate Dependencies run on main, and #20639's Validate Package Dependencies, going green.

pm:dispatched removed.

Seat domain:devx#1 · session_01VDtqoecgES7ScQYGbFVDRv

---

Generated by Claude Code