[groupthinking]

Closes #2644
Refs #2396, #2478 (both parent image backlogs remain open).

The current-main image retains an affected Undici6.28.0 inside global npm12.2.0, even though the application lock entries are patched. Bump only the runtime Dockerfile pin to npm12.2.2 and update the existing policy regression. Two lines changed; no application manifest/lock, scan severity, exceptions or permissions change.

Security dependency evidence

• Advisory: GHSA-2m5v-pch6-74hx (published October15,2026). Affected6.x below6.29.1; fix6.29.1. The TLS issue requires a function-valued tls option; runtime exploitability is UNKNOWN, not asserted.
• Official release: https://github.com/npm/cli/releases/tag/v12.2.2 (published November4,2026), explicitly updates bundled Undici to6.29.1. Official npm lock agrees.
• Affected path / direct versus transitive: Dockerfile installs global npm12.2.0; Undici is an npm-bundled transitive dependency, not an app direct dependency. Do not add it to package.json.
• Package and versions: npm12.2.0/Undici6.28.0 → npm12.2.2/Undici6.29.1.
• Baseline: main b9a0dee7569ccee4ffafb5cf826ee65ec9386b73; scan43043843552, artifact13866682534, ZIP SHA256 22a973f8dd23b0c7a0447fa6de92db591d58ec33d25e55abce0267487aba39ec, image sha256:b8b21303fb2d867cd2ba423c687685c33ae6485ac1b445dabef8d0fa1e16c698. Independently parsed322 occurrences, including four Undici6.28.0 findings. This is not a clean-image baseline.
• Validation: public npm registry tarballs for12.2.0 and12.2.2 downloaded and SHA512 integrity matched. Actual bundled package.json reads6.28.0 versus6.29.1. Both keep Node engine ^22.22.2 || ^24.15.0 || >=26.0.0. With local Node24.22.1, both CLIs report exact versions and install a local fixture offline with scripts/audit/funding disabled (exit0).
• Regression: changed floor test failed against original Dockerfile (1failed/3passed), then all4 passed on CPython3.12.14 and3.11.18 after patch; Ruff and diff check passed. The initially missing local3.11 interpreter was provisioned in a scratch venv, then checked.
• Rollback: close this unmerged draft; after an authorized merge prepare an exact reviewed revert, which restores the affected bundle. Parents#2396/Bootstrap Trivy remediation while retaining exact scan evidence #2478 stay open.
• Remaining risks: npm patch release contains other bundled fixes; actual Node22 image build/rescan and full current-head CI are pending at PR creation. No local Docker executable was available. Existing libxml2/system/global npm/pip backlog stays separate; do not infer zero findings or production remediation.

Complete recipe

Prerequisites: Git, uv/Python3.11/3.12, Node supported by npm (local probe24.22.1); public package retrieval; hosted image build/scan. No provider key or paid API. ESTIMATE:10–20minutes excluding CI queues.

1. Checkout exact head a782ecb234250b16e9caa3d8b854be037bc45fa2 in isolation.
2. uv venv --python 3.12 .venv-npm; uv pip install --python .venv-npm/bin/python pytest PyYAML ruff.
3. .venv-npm/bin/python -m pytest tests/unit/test_merge_policy_security_scan_wording.py -q -o addopts='' --confcutdir=tests/unit; expected4passed. Repeat with3.11.
4. .venv-npm/bin/ruff check tests/unit/test_merge_policy_security_scan_wording.py; git diff --check.
5. Retrieve https://registry.npmjs.org/npm/12.2.2, verify dist.integrity SHA512 against dist.tarball bytes, inspect package/node_modules/undici/package.json for6.29.1. Compare12.2.0 for6.28.0. Run unpacked node package/bin/npm-cli.js --version and offline local-fixture install with --ignore-scripts --no-audit --no-fund. Do not globally install over the host npm.
6. Require current-head hosted build/security evidence. Download trivy-image-evidence, independently verify ZIP digest, image identity/source and absence of the affected npm-bundled copy. Full-image counts can change with the scanner database and must be reported separately, without suppressions. Inspect reviews before any exact-approved merge.
7. Rollback before merge: close the draft. After an authorized merge: prepare a reviewed revert; it restores the affected bundle, so it is not a security resolution.

Codex owns hosted follow-through and repair. Draft/unmerged; no exact approval or production deployment. Workflow opportunity: remove a verified image dependency gap without changing app dependencies. No measured savings or revenue.

Executable package verification (actually run)

Use Python3.12 and Node24.22.1 in a scratch directory. This reads public registry artifacts and installs only a local fixture; it does not change global npm or call a provider.

import base64, hashlib, io, json, pathlib, subprocess, tarfile, urllib.request
root = pathlib.Path("npm-bundle-probe").resolve()
root.mkdir(exist_ok=True)
fixture = root / "fixture"
fixture.mkdir(exist_ok=True)
(fixture / "package.json").write_text('{"name":"watch-offline-fixture","version":"1.0.0"}')
for version, expected in (("12.2.0", "6.28.0"), ("12.2.2", "6.29.1")):
    meta = json.load(urllib.request.urlopen("https://registry.npmjs.org/npm/" + version))
    data = urllib.request.urlopen(meta["dist"]["tarball"]).read()
    integrity = "sha512-" + base64.b64encode(hashlib.sha512(data).digest()).decode()
    assert integrity == meta["dist"]["integrity"]
    dest = root / version
    dest.mkdir(exist_ok=True)
    with tarfile.open(fileobj=io.BytesIO(data), mode="r:gz") as archive:
        archive.extractall(dest, filter="data")
    bundle = json.loads((dest / "package/node_modules/undici/package.json").read_text())
    assert bundle["version"] == expected
    cli = dest / "package/bin/npm-cli.js"
    subprocess.run(["node", str(cli), "--version"], check=True)
    smoke = root / ("smoke-" + version)
    smoke.mkdir(exist_ok=True)
    (smoke / "package.json").write_text('{"name":"watch-smoke","version":"1.0.0","private":true}')
    subprocess.run(["node", str(cli), "install", "--prefix", str(smoke), "--offline",
                    "--ignore-scripts", "--no-audit", "--no-fund", str(fixture)], check=True)
    print(version, expected, "integrity and offline CLI PASS")

The retrieval, archive validation and CLI operations above were executed in two tool scripts; this combines those operations into one recipe. Hosted image validation remains separate.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
v0-uvai	Ready	Preview, v0	Nov 12, 2026 8:14am UTC

[coderabbitai]

Important

• Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

Run configuration

• Source mode: Auto
• Repository: groupthinking/EventRelay
• Branch: codex/fix-runtime-npm-bundle-20261112
• File: .coderabbit.yaml
• Commit: a782ecb
• Layers: Repository YAML
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 9c0d25c9-07f8-4612-a152-7797db691f8c

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

[groupthinking]

TEST — exact-image repair and hosted checks verified, November12,2026

Target a782ecb234250b16e9caa3d8b854be037bc45fa2; base b9a0dee7569ccee4ffafb5cf826ee65ec9386b73. Draft/unmerged. Implementation and image verification passed; integration awaits exact approval. This does not close parent#2396/#2478 or establish production remediation.

Exact image comparison

Independently downloaded both ZIPs, checked provider SHA256 digests, asserted image-source-commit.txt, parsed SARIF and compared rule/package/version/path multisets:

• Baseline artifact13866682534:322 occurrences; ZIP 22a973f8dd23b0c7a0447fa6de92db591d58ec33d25e55abce0267487aba39ec; image sha256:b8b21303fb2d867cd2ba423c687685c33ae6485ac1b445dabef8d0fa1e16c698.
• Patched artifact13926671452:316 occurrences; ZIP 0594132381e071d7f5a18e3b8996b6b52b44fa9f6a3e8536c45843be69d509eb; image sha256:c2c74898f82d3e1445cc2c84de8344a3c0a8469b45dcd799d2a64cc2b22e062c.
• Six removed, zero added in this comparison: npm-bundled Undici6.28.0 CVE-2026-109383/109869/19534/87018, and npm-bundled brace-expansion5.0.9 CVE-2026-102276/102278. Paths are under usr/lib/node_modules/npm/node_modules/.
• Libxml2 CVE-2026-6653 and315 other total remaining occurrences are not accepted exceptions or a clean image. Counts are scanner observations, not proof of exploitability. Node22.23.5 installed successfully in this actual image build.

Hosted checks and limits

• CI43181131734: every job successful, including web production image build. Python3.11/3.12 each3,083 passed,9 deselected,5 XPASS,121 subtests; separate38 offline security tests/20subtests. Frontend171files/1,593 passed/1skipped. Studio runner preflight21/21 passed; production-mode runner tests are not a production deployment.
• Coverage43181131497:3,254 passed/5XPASS/141subtests;87.77% versus84.2floor. Qlty upload still reports missing oidc/token; computation/artifact persistence succeeded, optional publication did not.
• Security43181131615: completed. Report-only scanning was preserved; no ignore-list, severity or permission changes.
• Dependency43181131554: actual snapshot, comparison, record and upload ran. Independently downloaded artifact13927025660; ZIP caa3b0b46bcca6d9957f1dbe3dae9596ce54ae3ae5e7da4b2e14359c6c782331, exact base/head,0diff rows, review success. Empty diff SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945. This graph does not cover the global Docker npm bundle, so the image comparison above supplies that evidence. It does not close live multi-page action169.
• CodeQL43181131672, issue-closer, secret scan, metadata and E2E workflow checks completed successfully. Informational lint/conditional E2E scope is not broad production acceptance.
• Published two file blobs match the tested worktree: Dockerfile 3b9d3d1859a897348204aa7055aca8fb6b5c10ff; policy test c1fc023b2765e8f82d62deb1a0b43064ec8b26e9.
• No submitted PR reviews or unresolved inline threads at readback; no review approval inferred.

Remaining owner/action/trigger

Hayden: exact PR2645 or head a782ecb234250b16e9caa3d8b854be037bc45fa2 approval is the remaining merge authorization. Codex then re-fetches current head/base, applicable checks, reviews/threads and mergeability, uses expected-head protection, and records the fetched merge commit. No merge or deployment occurred.

Codex keeps parent image remediation separate: verify stable-distro fixes/applicability before altering OS packages; no unstable Debian mixing or silent exceptions. Qlty integration remains a separate optional access item. Existing PR2642 fork-event acceptance and action169 genuine multi-page gate remain open under their receipts.

Failure handling and notification

An older signed artifact URL returned403 during comparison; refreshing through the authorized download tool succeeded and both digests matched. No repository-permission diagnosis was inferred. A running build log initially returned BlobNotFound404; after terminal completion the same job log was retrieved. No code changes were needed for either retrieval failure.

Notification YES: a demonstrated affected runtime bundle now has a safe, tested, exact-image-verified repair. Workflow value is fixing the image-only gap without touching already-patched application locks. Full reproduction and rollback are in the PR body; ESTIMATE10–20minutes excluding queues. No savings/revenue measured, paid provider test, production deployment, policy relaxation or new automation.

[groupthinking]

Approved merge verified — PR2645

Hayden explicitly approved this PR in the current conversation. Fresh preflight confirmed unchanged head a782ecb234250b16e9caa3d8b854be037bc45fa2, clean mergeability, successful required issue-closer, no pending/failing applicable head checks, no submitted reviews and zero unresolved inline threads. The supported rulesets endpoint confirmed active24057160 requires the issue-closer, with no bypass and no strict up-to-date requirement. The alternative branch-rules route was connector-rejected400; no permission inference or bypass.

Merged with GitHub expected-head protection: 512a2558f73d6281b6a880548bedf140b7e30292, merged_at2026-11-13T01:17:32Z. Fetched merge parents are current main 0e4b269ebb841e8912d7adf0f785f17e842455bc and the exact approved head. Fetched Dockerfile at the merge installs npm12.2.2. Child#2644 is closed; parent#2396/#2478 remain open.

Merge VERIFIED. Post-merge tests IN_PROGRESS, not inherited from prior green results: CI43343802648, Security43343802638, Coverage43343802672, Dependency43343802606. Codex owns terminal readback and safe repairs in the current work. No production deployment or production acceptance claimed. The prior exact-image six-finding reduction remains evidence for the pre-merge head only until a merged-head image is checked.

[groupthinking]

VERIFIED — approved merge and fresh post-merge checks

Merge512a2558f73d6281b6a880548bedf140b7e30292 contains the exact approved head a782ecb, with only the two tested files changed relative to then-current main. GitHub expected-head protection was used. PR2645 merged; child2644 closed; parent2396/2478 stay open.

Fresh merged-head results:

• CI43343802648 completed success, all jobs. Python3.11/3.12 each3,088passed/9deselected/5XPASS/121subtests; frontend1,593passed/1skipped.
• Coverage43343802672:3,259passed/5XPASS/141subtests;87.77% against84.2floor. Optional Qlty delivery still reports missing oidc/token; this is not successful Qlty publication.
• Security43343802638 completed success. Independently downloaded artifact14000154856, verified ZIP SHA256 631a3072ccdc7a0a3591b53deecc58cda06773627d0458c69c97c1a866cffdfc, asserted image-source-commit.txt equals the merge, and parsed SARIF. Exact image sha256:99a1cbcdbe9294c508649c5dea491e20242937d9374e774c3ae37bb02992eaa5:316 occurrences; zero affected Undici6.28.0 findings. Libxml2 CVE-2026-6653 remains. Report-only scanner success is not a clean-image claim.
• Dependency43343802606 succeeded with snapshot submissions; push-event comparison/record/upload were skipped. No new comparison persistence or multi-page claim.
• CodeQL, secret scan, E2E workflow and WIF checks completed successfully. These checks do not establish production acceptance.

Related state correction: PR2642 was merged separately before this operation at0e4b269ebb841e8912d7adf0f785f17e842455bc, from head4432bf96788797085f0837a8dd6388fc2bc8d53f, merged_at2026-11-12T22:45:37Z. Its earlier draft checkpoint is historical and superseded, not current. This operation did not merge it or infer broader authority.

Completed scope: approved PR2645 integration plus relevant fresh merged-head verification. Codex owns separately tracked image backlog#2396/#2478 and existing fork/multi-page acceptance gates, using their canonical records and approval boundaries. No manual production deployment or production acceptance claimed. The existing Watch checkpoint is updated so it will not request this approval or re-merge this PR. Ledger action180 and raw observation362 retain the evidence.