[finding] main's lockfile carries two new OSV advisories (`next` 16.3.3 GHSA-vcvr-r3jv-pc5j, critical; `dompurify` 3.4.13): the scheduled scan is red, and `Validate Package Dependencies` goes red on every PR touching a `package.json`

[objectstack-fleet]

What. The scheduled OSV scan on main (Validate Dependencies, schedule run on 2f2fa11d75, job 110199937081, 2026-10-01T03:09Z) exits 1 on pnpm-lock.yaml:

Advisory	CVSS	Package	Locked	Fixed in
GHSA-p98j-92pf-mc4p	2.3	dompurify	3.4.13	3.4.16
GHSA-vcvr-r3jv-pc5j	9.5	next	16.3.3	16.3.6

osv-scanner.toml holds zero exemptions, so nothing is waived.

Reach, measured:

• main's own scheduled scan is red.
• Every PR whose diff touches a package.json runs the same job on pull_request and inherits the red. Example: PR build(typecheck): graduate cloud-connection, observability and hono from the DEBT ledger (#20800) #21038 (type-check coverage: graduate the last three DEBT packages (cloud-connection, hono, observability) — the remainder of #4311 #20800, a test-layer type-check graduation that adds a typecheck script to three manifests and touches no lockfile) is red on job 110199998672 with the same two rows.
• The job does not run on merge_group. Queue eligibility still requires every check green or an expected skip, so such PRs wait.

Where the two packages come from (for triage):

• next is a direct dependency of apps/docs (apps/docs/package.json:21, pinned 16.3.3).
• dompurify is transitive: no workspace manifest names it, and the root pnpm.overrides has no floor for it.
• Dependabot's grouped PR chore(deps)(deps): bump the production-dependencies group with 27 updates #21029 (27 production updates) carries next 16.3.3 → 16.3.6, but not dompurify.

Likely remedy shape (the precedents #20774, #20719 and #20561): raise the two floors, the apps/docs pin for next and a pnpm.overrides floor for dompurify, and regenerate the lockfile, with no exemption.

Filed by the domain:cli seat (session_01VvcEokUG1tvVxkceYfR5XB), which found it on its own PR. It is unlabelled, for triage. The precedent cards were domain:devx, tooling, security.

Dedupe words: OSV dompurify next lockfile · Validate Package Dependencies red main schedule · GHSA-vcvr-r3jv-pc5j · GHSA-p98j-92pf-mc4p

[objectstack-fleet]

Triage: first grade — bug · security · priority:p1 · domain:devx · area:devpath · pm:queue. Direction: raise the two floors per precedent (#20774, #20719, #20561), with no exemption

Triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-01T04:00Z. ⛔ Not a claim, ⛔ not a dispatch.

Why p1.

• next 16.3.3 carries a critical (CVSS 9.5) advisory in apps/docs.
• main's scheduled scan is red, and Validate Package Dependencies goes red on every PR that touches a package.json. Queue eligibility needs it green, so such PRs wait.
• It blocks merges, which falls under the release-priority rule.

Direction:

• apps/docs/package.json pins next to ≥ 16.3.6.
• The root pnpm.overrides gets a dompurify floor of ≥ 3.4.16, since it is transitive.
• Regenerate pnpm-lock.yaml.
• ⛔ No osv-scanner.toml exemption.
• Dependabot's grouped PR chore(deps)(deps): bump the production-dependencies group with 27 updates #21029 carries the next bump but not dompurify. The claim may land this as its own minimal PR rather than wait on the 27-package group.
• Pin: the OSV job is green on main's lockfile.

---

Generated by Claude Code

[objectstack-fleet]

Claim: PM loop round 2 (maintainer queue jump)
Session: session_01JAhu8u8QfBvRjVZDox7CP9
Account: os-bill (the seat's linked user as GET /user answers it; the card's assignee from this act)
Branch: claude/issue-21055-osv-next-dompurify
Worktree: objectstack-issue-21055
Domain: domain:devx
Seat: domain:devx#2 (seat post #20163)
Provenance:

• Who: the maintainer.
• Verbatim: 「21055 插队」.
• Where: this seat's session chat, 2026-10-01T04:30Z.
• This is a maintainer-directed queue jump, which heads the take order. It is dispatched now even though the batch's three slots are full.
  File surface:
• apps/docs/package.json: the next pin, raised to >=16.3.6.
• pnpm-workspace.yaml: the existing dompurify override (from Validate Package Dependencies 在所有 PR 上红:dompurify@3.4.12 新公告 GHSA-55q2-fjhq-7xh7(已有 fix 3.4.13,经 mermaid 传递引入) #6407; currently ^3.4.13), raised to a floor of 3.4.16 with a dated OSV comment like its neighbours.
• pnpm-lock.yaml: regenerated by the repo's tooling, never by hand.
• ⛔ No osv-scanner.toml exemption.
• Stop on breach and explain in the report.
  Container & model: S, mode:subagent, default tier (dispatch-gates --tier at 4f83db5a73: no path-derived mandate)
  Clause-②: no
  Thread-read: 5924465236
  Serial constraints cleared:
• At origin/main 4f83db5a73, seven open PRs touch pnpm-lock.yaml (chore(deps)(deps-dev): bump the development-dependencies group across 1 directory with 16 updates #21024, chore(deps)(deps): bump the production-dependencies group with 27 updates #21029–chore(deps)(deps-dev): bump @oclif/plugin-plugins from 5.4.87 to 7.0.3 #21035; the Dependabot set). chore(deps)(deps): bump the production-dependencies group with 27 updates #21029 and chore(deps)(deps-dev): bump the development-dependencies group across 1 directory with 16 updates #21024 also touch apps/docs/package.json and the root package.json.
• None of these paths is in SINGLE_CLAIM_PATHS, so this is ordinary concurrency: the dev merges main before opening the PR, and the later lander regenerates the lockfile.
• Per triage 5924465236, this lands as its own minimal PR rather than waiting on the grouped chore(deps)(deps): bump the production-dependencies group with 27 updates #21029.

---

Generated by Claude Code

[objectstack-fleet]

os-dev-report

{
  "issue": 21055,
  "status": "done",
  "branch": "claude/issue-21055-osv-next-dompurify",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/21083",
  "session": "session_01JAhu8u8QfBvRjVZDox7CP9 (mode:subagent; shares the PM session id, identity bit is the branch)",
  "premise_still_valid": true,
  "summary": "Took the fix for both OSV rows with no exemption. apps/docs/package.json pins next 16.3.3 -> 16.3.6 (the advisory's fixed version and the same target as Dependabot's grouped PR 21029). In pnpm-workspace.yaml the EXISTING dompurify override (added for 6407) has its target lifted from ^3.4.13 to ^3.4.16; the selector stays bounded at the 4.0.0 major, and its OSV comment is extended in place. pnpm-lock.yaml was regenerated with pnpm 10.31.0 --lockfile-only. PM hypothesis 1 measured true: the issue body's 'root pnpm.overrides has no floor' is wrong, because the override lives in pnpm-workspace.yaml and already existed. The new advisory's range starts at exactly 3.4.13, the old floor. Hypothesis 2 also measured true: no @next/* or eslint-config-next is declared anywhere. The nine @next/* packages are next's own dependencies and moved with it. Reach: apps/docs/app/og/docs/[...slug]/route.tsx imports ImageResponse from next/og, the very surface GHSA-vcvr names. OSV-Scanner v2.3.8, run offline: main 5dbeb7d7b7 exits 1 with exactly the two rows; head 68c26aa189 exits 0 with 'No issues found' (1369 packages).",
  "tests": "All runs on final head 68c26aa189 (fix 3714ec8cef + merge of main 0c5a71b094); build + docs checks were also green on 3714ec8cef before the merge. (1) OSV-Scanner v2.3.8, binary SHA-256 bc98e15319ed0d515e3f9235287ba53cdc5535d576d24fd573978ecfe9ab92dc matched the release osv-scanner_SHA256SUMS. The online scan is refused (api.osv.dev Forbidden via egress proxy), so it ran `scan --offline-vulnerabilities --download-offline-databases --lockfile=pnpm-lock.yaml`. BEFORE (5dbeb7d7b7): exit 1, 'Total 2 packages affected by 2 known vulnerabilities (1 Critical, 0 High, 0 Medium, 1 Low)', rows GHSA-p98j-92pf-mc4p dompurify 3.4.13 fixed 3.4.16 and GHSA-vcvr-r3jv-pc5j next 16.3.3 fixed 16.3.6. AFTER (68c26aa189): exit 0, 'No issues found', 1369 packages. Advisory ranges were read from the downloaded DB: dompurify introduced 3.4.13 fixed 3.4.16; next introduced 16.2.0 fixed 16.3.6. (2) Lockfile diff: 69/69 lines (138). Locked package set: 11 removed and 11 added (next, @next/env, 8x @next/swc-*, dompurify), count 1369 -> 1369. The other lines are peer-suffixed snapshot keys (better-auth + 3 @better-auth/*, fumadocs-core/mdx/ui) that embed the next version; none of those changes version. `pnpm install --frozen-lockfile` exit 0. (3) `pnpm build --concurrency=2` under os-verify-lock: VERDICT command-exit 0, 72/72 (at 3714ec8cef 0 cached, 9m01s held; at 68c26aa189 30 cached, 3m30s held; shared-box seconds). (4) `pnpm --filter @objectstack/docs typecheck`: VERDICT command-exit 0 ('Types generated successfully'). (5) Docs production build command from apps/docs/vercel.json, `pnpm turbo run build --filter=@objectstack/docs --concurrency=2`: VERDICT command-exit 0, '@objectstack/docs:build: cache miss', 'Next.js 16.3.6 (Turbopack)', apps/docs/.next/BUILD_ID present (r2Eo1tm8Fr3aAg41ffCWC). Declared narrowing: this ran without CI's TURBO_FORCE, which would only re-execute the spec dependency build; the docs task itself missed the cache and executed. (6) dispatch-gates --commands: 41 commands, each run on 68c26aa189 with the documented ':: exit' capture, all 41 exit 0; `--ran`: '41 derived, 41 run, 0 NOT-MEASURED, 0 UNRUN' (RAN_EXIT 0). No package test suite is owed: no package source changed, and apps/docs has no test script. NOT MEASURED locally, left to CI: the Test Core shards, Dogfood, Temporal conformance and the workspace type-check lanes.",
  "mcp_calls": "0 (no MCP GitHub tools used; reads went through `gh api` single-card/PR REST reads)",
  "api_writes": "REST writes via the fleet-write relay only (each one = POST /repos/objectstack-ai/objectstack/dispatches executed as objectstack-fleet[bot]): (1) pr_create -> POST /repos/objectstack-ai/objectstack/pulls (draft PR 21083, relay run 36818031552, 5992 bytes sent = stored); (2) label-write -> POST /repos/objectstack-ai/objectstack/issues/21083/labels (skip-changeset) + POST /repos/objectstack-ai/objectstack/issues/21083/assignees (os-bill), relay run 36818068469, read-back MATCHES; (3) this os-dev-report comment -> POST /repos/objectstack-ai/objectstack/issues/21055/comments via post-stamped.mjs. Plus git pushes of the branch (empty probe, 3714ec8cef, 68c26aa189), which are not REST writes.",
  "gates": {
    "osv-scanner v2.3.8 offline, main 5dbeb7d7b7": 1,
    "osv-scanner v2.3.8 offline, head 68c26aa189": 0,
    "pnpm install --frozen-lockfile": 0,
    "pnpm build --concurrency=2 (os-verify-lock)": 0,
    "pnpm --filter @objectstack/docs typecheck": 0,
    "pnpm turbo run build --filter=@objectstack/docs --concurrency=2": 0,
    "dispatch-gates --commands (41 derived), each command": "0 x41",
    "dispatch-gates --ran": 0,
    "CI on PR 21083 at report time": "in_progress (Validate Package Dependencies, Lint & Repo Gates, Type Check lanes, Test Core 1-6, Dogfood 1-3, Temporal Conformance, Build Core, Build Docs); Check Changeset success; card-claim check success"
  },
  "line_budget": "n/a: no skills/** or governed surface touched. Diff = 3 files, +80/-71 (151 lines), under the 5000 human-merge threshold.",
  "deviations": [
    "next went to 16.3.6, not the newest 16.3.8: it is the advisory's fixed version and Dependabot group 21029's target; the later patches are left to that group.",
    "The docs build ran without CI's TURBO_FORCE (declared above).",
    "The merge of main 0c5a71b094 was done before the PR opened. main has since moved 4 commits (to 2821e9f15b); none touches pnpm-lock.yaml, pnpm-workspace.yaml, apps/docs/package.json or the root package.json (measured), so the branch was not merged again."
  ],
  "files_changed": [
    "apps/docs/package.json",
    "pnpm-workspace.yaml",
    "pnpm-lock.yaml"
  ],
  "open_questions": [],
  "out_of_scope_findings": [
    "carrier: 承接者:无 · noted, not filed. pnpm-workspace.yaml's 6407 dompurify comment says check-override-consistency.mjs 'will list this as an override it cannot cross-check'. The nanoid, @xmldom/xmldom/qs and devalue notes repeat that claim. Measured on 68c26aa189: the gate prints no such listing. Its only reports are the 'Consumer census' and 'Self-expiring selectors'; dompurify appears in neither, and the later ip-address note already says the gate 'says nothing about this entry'. This is stale comment prose, not a defect. The PR body was written once, so if the seat wants it in Acceptance notes, the edit is one bullet appended there. Dedupe words: override-consistency cannot cross-check comment stale · pnpm-workspace overrides comment drift"
  ]
}

---

Generated by Claude Code

[objectstack-fleet]

ACCEPT — PR #21083 @ 68c26aa189 · domain:devx seat 2, R2 · 2026-10-01T05:08Z

Reviewer of record: session_01JAhu8u8QfBvRjVZDox7CP9. Checked against the diff and GitHub, not against the report's prose (os-dev-report 5925128805).

• Shape:
  • The PR is a draft against main. Its body opens Fixes #21055, followed by Clause-②: no; that first line is the only closing keyword.
  • Labels are skip-changeset, which is right: apps/docs is private, a workspace override ships in no published manifest, and the lockfile ships nowhere. The assignee is os-bill.
  • 3 files (+80 −71): apps/docs/package.json, pnpm-workspace.yaml, pnpm-lock.yaml. All are inside the claim's surface. No osv-scanner.toml exemption.
• The fix, read in the diff:
  • next 16.3.3 → 16.3.6, the advisory's fixed version and chore(deps)(deps): bump the production-dependencies group with 27 updates #21029's target.
  • The EXISTING dompurify override (from Validate Package Dependencies 在所有 PR 上红:dompurify@3.4.12 新公告 GHSA-55q2-fjhq-7xh7(已有 fix 3.4.13,经 mermaid 传递引入) #6407) in pnpm-workspace.yaml is lifted from ^3.4.13 to ^3.4.16. Its selector stays bounded at the 4.0.0 major, and the dated OSV comment is extended in place.
  • This corrects the issue body, which placed the floor in root package.json and called it missing. The PR body records the correction.
• Lockfile: regenerated with pnpm 10.31.0. In this seat's read of the diff, every moved line other than next, the @next/* packages and dompurify is a peer-suffixed snapshot key that embeds the next version. The report counts 11 packages out and 11 in, with 1369 → 1369 locked.
• The pin, on GitHub: Validate Package Dependencies is success on 68c26aa189. The report adds an offline OSV-Scanner v2.3.8 run: main exits 1 with exactly the two rows, and head exits 0 with "No issues found".
• Also from the report: pnpm build 72/72, the docs typecheck, and the docs production build ("Next.js 16.3.6") all exit 0. dispatch-gates --ran: 41 derived, 41 run, 0 NOT-MEASURED.
• Review face: the diff touches apps/docs/**, a contract-review face. An at-tier ## Contract review is owed on the landing head, and needs:contract-review is added to the PR in the same pass.
• Out of scope: one stale comment claim in pnpm-workspace.yaml, that check-override-consistency.mjs "will list this as an override it cannot cross-check". The gate prints no such listing. It is noted with no carrier.
• Landing: P1 and a maintainer queue jump. It lands through the queue as soon as the contract review PASSes and every check on 68c26aa189 is green.

---

Generated by Claude Code

[objectstack-fleet]

Landed: PR #21083 merged as b10f6e46d4; card closed completed

domain:devx seat 2 · session_01JAhu8u8QfBvRjVZDox7CP9 · 2026-10-01T06:27Z

• Merged through the merge queue at 2026-10-01T06:27:16Z. This was a maintainer queue jump (「21055 插队」). The PR's Fixes #21055 closed this card. This seat removes pm:dispatched in the same pass.
• Checked by content: all 3 paths the PR touched are blob-identical on origin/main to the landing head 68c26aa189: apps/docs/package.json 6d65d752d6, pnpm-workspace.yaml 0df0641da2 and pnpm-lock.yaml aa469a128c (3/3, 0 mismatched).
  • main now pins next 16.3.6 and the override 'dompurify@<4.0.0': '^3.4.16'.
  • The lockfile resolves next@16.3.6 and dompurify@3.4.16.
• What ships:
  • The docs site moves from next 16.3.3 to 16.3.6 (GHSA-vcvr-r3jv-pc5j, critical).
  • The workspace's existing dompurify floor is lifted to ^3.4.16 (GHSA-p98j-92pf-mc4p).
  • No osv-scanner.toml exemption, and nothing published moves.
  • Validate Package Dependencies was green on the landing head, so the scheduled scan on main and every PR touching a package.json stop inheriting this red from here.
• Records: ACCEPT 5925147796; at-tier contract review PASS 5925257531 on the landing head.

---

Generated by Claude Code