build(node): pin npm integrity and Node 22/jsdom 30 compatibility - #896

Draft

seonghobae wants to merge 168 commits into

fix/node-22-22-2-jsdom-30-779

Commits on Aug 7, 2026

test(supply-chain): require deterministic npm lock generator
seonghobae
committed
4294ddc
fix(supply-chain): pin npm lock generator metadata
seonghobae
committed
afb20be
ci(supply-chain): prove npm version and lock reproduction
seonghobae
committed
e64c229
docs(supply-chain): record npm generator provenance
seonghobae
committed
ebbde9b
docs(changelog): record npm generator contract
seonghobae
committed
694ca83
fix(supply-chain): avoid serializing npm into runtime engines
seonghobae
committed
90dc2a0
test(supply-chain): keep npm enforcement out of runtime engines
seonghobae
committed
fecc36b
docs(supply-chain): separate npm generator from runtime engines
seonghobae
committed
9eb83c3
ci(supply-chain): publish deterministic lock reproduction evidence
seonghobae
committed
5609b88
test(supply-chain): require preserved lock reproduction evidence
seonghobae
committed
032314d
test(security): require coordinated PDF.js and Undici baseline
seonghobae
committed
0263ad4
test(security): disable PDF expression evaluation
seonghobae
committed
2cbf767
fix(security): pin the patched Undici transitive version
seonghobae
committed
475de96
fix(security): pin the patched PDF.js release
seonghobae
committed
deb74ac
fix(security): disable PDF expression evaluation
seonghobae
committed
dc90d5b
docs(security): record coordinated PDF and HTTP remediation
seonghobae
committed
b23b957
docs(changelog): record coordinated security remediation
seonghobae
committed
2e99f72
fix(security): anchor the Undici override to an exact root floor
seonghobae
committed
8f50fe4
test(security): bind exact root floor and npm package locations
seonghobae
committed
e2c0c2d
ci(pr783): import exact npm 10.9.8 lock artifact
seonghobae
committed
dd93f96
fix(score): align PDF.js boundary with 6.2.108 API
seonghobae
committed
dd8d1ac
test(score): prove the supported data-only PDF.js boundary
seonghobae
committed
988dc1d
docs(security): record the supported PDF.js 6.2.108 boundary
seonghobae
committed
a39e37f
docs(changelog): describe the supported patched PDF boundary
seonghobae
committed
6b753e6
ci(pr783): rerun lock import after supported API repair
seonghobae
committed
b773653
ci(pr783): publish the verified lock from the bounded importer
seonghobae
committed
01cb39e
ci(pr783): fetch complete lineage for verified lock publication
seonghobae
committed
ad558ac
fix(security): import verified npm 10.9.8 lock
github-actions[bot]
committed
83865dc
test(ci): preserve canonical npm provenance formatting
seonghobae
committed
e6b48ca
ci(pr783): diagnose Ruff import ordering
seonghobae
committed
3edf173
style(ci): normalize security test imports
seonghobae
committed
2345219
style(ci): normalize npm provenance test imports
seonghobae
committed
dc7e8b4
chore(ci): remove completed Ruff diagnostic
seonghobae
committed
c5ee630
ci(pr783): finalize exact Ruff formatting
seonghobae
committed
f0c9ad1
chore(ci): remove temporary branch writer
seonghobae
committed
102a89f
style(test): apply Ruff formatting to security contracts
seonghobae
committed
d4887ec
style(test): finish Ruff formatting for npm provenance
seonghobae
committed
459abdd

Commits on Aug 11, 2026

fix(security): refresh vulnerable npm transitive pins
seonghobae
committed
ace4257
fix(deps): restore manifest-lock consistency
seonghobae
committed
63d0ae6

Commits on Aug 14, 2026

ci: add one-shot canonical lock repair for PR 783
seonghobae
committed
6bba612
fix(deps): regenerate canonical npm 10.9.8 lock
github-actions[bot]
committed
ef938fa
ci: retrigger exact-head validation after canonical lock generation
seonghobae
committed
a48ff96
ci: add one-shot Ruff formatter for PR 783
seonghobae
committed
fd9389a
style(test): apply canonical Ruff formatting
github-actions[bot]
committed
afba132
ci: retrigger exact-head validation after canonical Ruff formatting
seonghobae
committed
e214e96
fix(test): verify canonical hoisted PDF.js lock record
seonghobae
committed
0cd6836
ci: add final one-shot Ruff formatter for PR 783
seonghobae
committed
f4a5a19
style(test): apply final canonical Ruff formatting
github-actions[bot]
committed
219267e
chore(ci): retrigger exact-head protected checks
seonghobae
committed
db7b1c1
fix(ci): validate npm lock without mutable resolution
seonghobae
committed
f4d8850
test(supply-chain): format npm toolchain contract
seonghobae
committed
8a143ab
test(supply-chain): satisfy ruff formatting gate
seonghobae
committed
b3ac826
test(supply-chain): format npm toolchain contract
seonghobae
committed
885c037
test(supply-chain): apply repository Ruff width
seonghobae
committed
de0cd6b
docs(security): align npm lock provenance with frozen validation
seonghobae
committed
f3cfae4
fix(ci): disable persisted checkout credentials
seonghobae
committed
de75178
docs(changelog): correct UI test coverage claim
seonghobae
committed
164e6f2

Commits on Aug 15, 2026

test(lock): reject esbuild peer metadata drift
seonghobae
committed
07c1dd2
docs(lock): record esbuild metadata sentinel
seonghobae
committed
ad4551b
docs(changelog): record lock metadata drift gate
seonghobae
committed
6f81f52
fix(security): make PDF XML boundary explicit
seonghobae
committed
6665f02
test(security): lock down PDF parser options
seonghobae
committed
bf5a3a3
docs(security): record PDF parser hardening evidence
seonghobae
committed
c65f5b1
docs(security): correct PDF.js advisory attribution
seonghobae
committed
dae5d3c

Commits on Aug 17, 2026

test(build): require coordinated Node 22.22.2 and jsdom 30 floor
seonghobae
committed
afdecc5
test(build): align Node floor contract with canonical npm generator
seonghobae
committed
1dbe037
merge: stack Node compatibility migration on dependency baseline
seonghobae
committed
66c97c2
build(node): raise supported Node 22 floor
seonghobae
committed
32cf47c
build(deps-dev): adopt jsdom 30 on coordinated Node floor
seonghobae
committed
f74beb0
docs(build): publish Node 22.22.2 minimum
seonghobae
committed
2affed5
test(build): align npm provenance with Node compatibility floor
seonghobae
committed
65d199d
test(build): require explicit minimum-Node npm bootstrap lane
seonghobae
committed
c721cee
ci(build): add exact Node 22.22.2 compatibility lane
seonghobae
committed
fcb0b27
test(build): audit canonical runtime documentation paths
seonghobae
committed
aa527bb
test(ci): prevent pre-bootstrap npm cache discovery
seonghobae
committed
5b50c59
fix(ci): bootstrap canonical npm before cache discovery
seonghobae
committed
783112b
docs(build): reconcile Node floor with npm generator provenance
seonghobae
committed
e004765
test(ci): require setup-node automatic cache opt-out
seonghobae
committed
b3a3c91
fix(ci): disable setup-node auto cache before npm bootstrap
seonghobae
committed
feb4136
test(node): require Corepack npm bootstrap and lock provenance
seonghobae
committed
a256606
fix(node): harden npm bootstrap and capture lock provenance
seonghobae
committed
9eb5c10
test(node): assert direct workspace jsdom resolution
seonghobae
committed
6f5d1e4
fix(ci): keep Node floor lane frozen-install only
seonghobae
committed
0766cdb
fix(ci): satisfy workflow supply-chain baseline
seonghobae
committed
8596bd1

Commits on Aug 18, 2026

Commits on Aug 29, 2026

Commits on Sep 2, 2026

build(deps-dev): bump eslint from 10.8.1 to 10.9.1
dependabot[bot]
authored
32bbb8b

Commits on Sep 4, 2026

chore(node): restack npm compatibility owner on protected develop
seonghobae
committed
fc3d1ec

Commits on Sep 6, 2026

⚡ Bolt: [performance improvement] Replace O(N^2) list membership checks with O(1) dictionary key deduplication in chart export
seonghobae
committed
f52dc97
repair(ci): drop superseded chart note from Ruff owner
seonghobae
committed
0725eb3
repair(ci): return chart optimization to canonical owner
seonghobae
committed
1d38e8e
repair(ci): restore protected chart bytes exactly
seonghobae
committed
a7b0030
Trigger CI retry
seonghobae
committed
340b0a3
Trigger CI retry
seonghobae
committed
8488a02

Commits on Sep 7, 2026

Commits on Sep 17, 2026

test(node): require bounded fail-closed npm activation
seonghobae
committed
d0738d7
fix(node): add bounded pinned npm runtime acquisition
seonghobae
committed
da536ed
fix(build): retry exact Corepack npm acquisition
seonghobae
committed
05dba77
test(node): align provenance contract with bounded activation helper
seonghobae
committed
b780be8
docs(node): record bounded pinned npm acquisition RCA
seonghobae
committed
0a01aeb
test(node): execute bounded npm acquisition failure paths
seonghobae
committed
fa73542
test(node): prove bounded npm acquisition success and exhaustion
seonghobae
committed
8e0b361
test(node): reject retries for npm signature failures
seonghobae
committed
4b64860
fix(node): fail fast on npm provenance errors
seonghobae
committed
02ae089
fix(node): recognize current Corepack signature failure
seonghobae
committed
61713a2

Commits on Sep 18, 2026

docs(node): classify npm acquisition trust failures
seonghobae
committed
3983dd2
test(build): fail closed on unclassified npm acquisition errors
seonghobae
committed
b8fcb79
fix(build): retry only admitted npm acquisition timeouts
seonghobae
committed
9c39c2a
test(build): classify retry fixture as ETIMEDOUT
seonghobae
committed
68f71e0
docs(traceability): fail closed on unknown Corepack failures
seonghobae
committed
f7341ee
repair(scope): release baseline and formatter ownership
seonghobae
committed
b025062
test(node): require canonical npm activation in minimum lane
seonghobae
committed
3292884
fix(ci): reuse pinned npm activation in minimum Node lane
seonghobae
committed
97042e1
docs(traceability): record single npm activation owner
seonghobae
committed
3b6ddce
test(node): align minimum-lane contract with npm activation owner
seonghobae
committed
e2420be
test(node): expose duplicate CI npm activation owners
seonghobae
committed
4830abb
fix(ci): centralize npm activation in registered CI
seonghobae
committed
99b0707
docs(node): trace registered CI activation ownership
seonghobae
committed
c010a66
merge(ci): inherit canonical supply-chain formatter prerequisite
seonghobae
committed
b5dc5bf
fix(node): align activation regressions with stacked CI owner
seonghobae
committed
78bcc37
docs(node): record lint RCA and canonical prerequisite stack
seonghobae
committed
636b477
docs(node): preserve CI visibility across prerequisite ancestry
seonghobae
committed
5c60103
ci(python): emit Ruff formatter diff on gate failure
seonghobae
committed
81d7cd9
fix(node): format npm runtime regression tests
seonghobae
committed
239bfc7
docs(node): record exact-head Ruff failure repair
seonghobae
committed
984d038
fix(node): keep activation index lint-compatible
seonghobae
committed
8507c21
docs(node): record lint-width repair
seonghobae
committed
2d9428c
test(node): align CI provenance contract with activation helper
seonghobae
committed
86b51c6

Commits on Sep 21, 2026

test(node): require integrity-bound npm packageManager locator
seonghobae
committed
fb73bc9
fix(node): integrity-pin npm 10.9.9 for Corepack
seonghobae
committed
29361c9
fix(node): require integrity-bound npm Corepack locator
seonghobae
committed
f0a0c42
test(node): exercise hashed npm locator in activation harness
seonghobae
committed
bbcdd31
test(node): keep nontransient failures on hashed npm locator
seonghobae
committed
8feed8a
test(node): bind npm toolchain contract to artifact integrity
seonghobae
committed
ae07856
docs(traceability): record npm artifact integrity pin
seonghobae
committed
347530b
test(node): discover every npm-consuming workflow
seonghobae
committed
ff14b04
test(node): tolerate reusable workflow call jobs
seonghobae
committed
ce4d526
docs(node): trace workflow npm consumer discovery
seonghobae
committed
6719ead
test(ci): reject inline npm runtime activation
seonghobae
committed
628aa96
fix(ci): route release npm activation through canonical helper
seonghobae
committed
2ddd8b1
fix(ci): route security npm activation through canonical helper
seonghobae
committed
ab04754
test(ci): cover every direct npm workflow invocation
seonghobae
committed
df20e63
docs(traceability): record canonical npm activation path
seonghobae
committed
8113cbf
style(ci): apply canonical ruff formatting
seonghobae
committed
190a052
style(ci): format npm integrity regression
seonghobae
committed
a41a2e5
style(ci): format npm toolchain regression
seonghobae
committed
6366eb6
docs(traceability): record npm gate RCA and formatter repair
seonghobae
committed
8eb47f7
test(ci): remove legacy inline npm activation fallback
seonghobae
committed
a990e7c
docs(traceability): align npm policy regressions
seonghobae
committed
a7500e3
test(ci): expose shell-wrapped npm consumer blind spots
seonghobae
committed
19ddd51
fix(ci): detect npm behind shell control flow
seonghobae
committed
dc726ef
docs(traceability): record shell npm admission boundary
seonghobae
committed
8f03e7f
test(node): reject mixed integrity timeout acquisition failure
seonghobae
committed
bc26032
fix(node): prioritize provenance failures over timeout retry
seonghobae
committed
4cee8f5
docs(node): trace mixed Corepack failure precedence
seonghobae
committed
61195d9
test(node): catch shell continuation npm command bypass
seonghobae
committed
237ff47
fix(node): normalize shell continuations before npm admission
seonghobae
committed
eee83e3
docs(node): trace shell continuation npm admission repair
seonghobae
committed
6763d91
fix(node): keep npm classifier compatible with macOS bash
seonghobae
committed
2a08003
test(node): keep package-manager integrity assertion in its owner
seonghobae
committed
e3ecc44
test(node): lock portable npm timeout classification
seonghobae
committed
4974765
docs(node): trace hosted npm classifier portability repair
seonghobae
committed
c37835f