fix(security): establish canonical npm, PDF.js, Nanoid, and Undici baseline

.github/workflows/ci.yml

@@ -17,17 +17,41 @@ env:
   GIT_CONFIG_COUNT: "1"
   GIT_CONFIG_KEY_0: init.defaultBranch
   GIT_CONFIG_VALUE_0: develop
+  EXPECTED_NPM_VERSION: "10.9.8"
 
 jobs:
+  lock-validation:
+    name: gate / ci / npm-lock-validation
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version: "22.22.3"
+          cache: npm
+      - name: Verify exact npm lockfile generator
+        run: test "$(npm --version)" = "$EXPECTED_NPM_VERSION"
+      - name: Validate the frozen package lock without lifecycle execution
+        run: npm ci --ignore-scripts --no-audit --no-fund
+      - name: Reject manifest or lockfile drift
+        run: git diff --exit-code -- package.json package-lock.json
+
   verify:
     name: ci / build-and-test
+    needs: lock-validation
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          node-version: 22.22.3
+          node-version: "22.22.3"
           cache: npm
+      - name: Verify exact npm lockfile generator
+        run: test "$(npm --version)" = "$EXPECTED_NPM_VERSION"
       - uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
         with:
           version: "0.8.6"
@@ -51,13 +75,18 @@ jobs:
 
   rust-check:
     name: gate / ci / rust-check
+    needs: lock-validation
     runs-on: macos-15
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          node-version: 22.22.3
+          node-version: "22.22.3"
           cache: npm
+      - name: Verify exact npm lockfile generator
+        run: test "$(npm --version)" = "$EXPECTED_NPM_VERSION"
       - name: Install stable Rust toolchain
         run: rustup toolchain install stable --profile minimal
       - name: Install node dependencies

CHANGELOG.md

@@ -7,6 +7,14 @@
 - Display the analyzed song tempo (BPM) as a badge in the rehearsal workspace.
 - 각 합주 역할(Role)별 개인 연습 진행도를 0~100% 범위로 기록 및 시각화할 수 있는 연습 진척도(`practiceProgress`) 트래커 기능 추가. UI 컨트롤(슬라이더 및 +/- 버튼)과 한/영 다국어 지원 포함.
 
+### Changed
+
+- Pinned npm `10.9.8` as the approved lockfile generator and made primary CI consume the committed lock only through frozen `npm ci` validation, rejecting mutable npm resolution in the lock gate, requiring integrity evidence for public-registry lock entries, and rejecting generator-sensitive loss of root `@esbuild/*` peer metadata.
+
+### Fixed
+
+- Upgraded the local score PDF parser to `pdfjs-dist` 6.2.108, pinned Undici 7.29.0 across the workspace, and constrained PDF loading to copied in-memory bytes with a same-origin bundled worker and npm-generated lock provenance.
+
 ## [0.1.3] - 2026-04-29
 
 ### Fixed
@@ -65,4 +73,4 @@
 
 - `ChordsFeature` (코드 분석) 화면에서 각 파트(Role)의 `transpositionPlan`(이조/조옮김 계획)을 표시하는 기능을 추가했습니다.
 - `RangesFeature` (음역대 분석) 화면에서 겹침 경고(Overlap warning) 외에 해당 파트의 채보(Transcription) 가능 노드 수를 요약하여 보여주는 기능을 추가했습니다.
-- 신규 UI 요소에 대한 100% 테스트 커버리지를 보장하는 단위 테스트를 추가했습니다 (`apps/desktop/src/features/chords/index.test.tsx`, `apps/desktop/src/features/ranges/index.test.tsx`).
+- 신규 UI 요소에 대한 단위 테스트를 추가했습니다 (`apps/desktop/src/features/chords/index.test.tsx`, `apps/desktop/src/features/ranges/index.test.tsx`).

apps/desktop/package.json

@@ -20,7 +20,7 @@
     "class-variance-authority": "^0.7.1",
     "clsx": "^2.1.1",
     "lucide-react": "^1.24.0",
-    "pdfjs-dist": "6.1.200",
+    "pdfjs-dist": "6.2.108",
     "react": "^19.2.4",
     "react-dom": "^19.2.7",
     "sonner": "^2.0.7",

apps/desktop/src/features/score/pdfjs.test.ts

@@ -0,0 +1,52 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+import { getDocument, GlobalWorkerOptions } from "pdfjs-dist";
+import { configureScorePdfWorker, loadScorePdf } from "./pdfjs";
+
+vi.mock("pdfjs-dist", () => ({
+  getDocument: vi.fn(() => ({ promise: Promise.resolve(), destroy: vi.fn() })),
+  GlobalWorkerOptions: { workerSrc: "" }
+}));
+
+vi.mock("pdfjs-dist/build/pdf.worker.min.mjs?url", () => ({
+  default: "/assets/pdf.worker.min.mjs"
+}));
+
+describe("score PDF.js boundary", () => {
+  beforeEach(() => {
+    vi.mocked(getDocument).mockClear();
+    GlobalWorkerOptions.workerSrc = "";
+  });
+
+  it("uses the locally bundled worker asset", () => {
+    configureScorePdfWorker();
+
+    expect(GlobalWorkerOptions.workerSrc).toBe("/assets/pdf.worker.min.mjs");
+
+    configureScorePdfWorker();
+    expect(GlobalWorkerOptions.workerSrc).toBe("/assets/pdf.worker.min.mjs");
+  });
+
+  it("copies validated bytes through the hardened data-only API", () => {
+    const source = new Uint8Array([0x25, 0x50, 0x44, 0x46]);
+
+    loadScorePdf(source);
+
+    expect(getDocument).toHaveBeenCalledTimes(1);
+    const parameters = vi.mocked(getDocument).mock.calls[0]?.[0];
+    expect(parameters).toBeTypeOf("object");
+    expect(Object.keys(parameters as object)).toEqual([
+      "data",
+      "enableXfa",
+      "useWorkerFetch"
+    ]);
+    const hardenedParameters = parameters as {
+      data: Uint8Array;
+      enableXfa: boolean;
+      useWorkerFetch: boolean;
+    };
+    expect(hardenedParameters.data).toEqual(source);
+    expect(hardenedParameters.data).not.toBe(source);
+    expect(hardenedParameters.enableXfa).toBe(false);
+    expect(hardenedParameters.useWorkerFetch).toBe(false);
+  });
+});

apps/desktop/src/features/score/pdfjs.ts

@@ -19,11 +19,23 @@ export function configureScorePdfWorker(): void {
  * Start parsing validated in-memory score PDF bytes with pdf.js.
  *
  * Only caller-provided bytes are accepted (validated-resource-only rule);
- * this helper never fetches arbitrary URLs. The bytes are copied before they
- * are handed to pdf.js because pdf.js transfers the underlying buffer to its
+ * this helper never supplies a URL. The bytes are copied before they are
+ * handed to pdf.js because pdf.js transfers the underlying buffer to its
  * worker, which would otherwise detach the caller's copy and break retries.
+ *
+ * XFA rendering is explicitly disabled even though pdf.js 6.2.108 defaults it
+ * to `false`, and worker-side resource fetching is explicitly disabled. These
+ * settings make the parser boundary fail closed against XML-form activation
+ * and remote helper-resource acquisition instead of relying on upstream
+ * defaults. In the pinned pdf.js XML parser, DOCTYPE declarations are reported
+ * to a no-op hook and unknown named entities are preserved literally rather
+ * than dereferenced, so no external-entity resolver is exposed by this API.
  */
 export function loadScorePdf(data: Uint8Array): PDFDocumentLoadingTask {
   configureScorePdfWorker();
-  return getDocument({ data: new Uint8Array(data) });
+  return getDocument({
+    data: new Uint8Array(data),
+    enableXfa: false,
+    useWorkerFetch: false
+  });
 }

docs/doctoring/high-security-pdf-http-baseline.md

@@ -0,0 +1,100 @@
+# High-security PDF and HTTP dependency baseline
+
+## Decision
+
+BandScope treats the PDF parser and its transitive HTTP client as one security-release boundary:
+
+- `pdfjs-dist` is pinned exactly to `6.2.108`;
+- `undici` is pinned exactly to `7.29.0` through the root npm override; and
+- npm `10.9.8` is the approved generator for reviewed root-workspace dependency updates, while primary CI consumes the committed lock through frozen validation rather than re-resolving it.
+
+Repository dependency/security tooling reported the protected-base `pdfjs-dist@6.1.200` as requiring a newer floor. That finding is kept distinct from the older, GitHub-reviewed CVE-2024-4367 / GHSA-wgrm-67xf-hhpq: the 2024 advisory affected `pdfjs-dist <=4.1.392` and was fixed in `4.2.67`, so it is historical parser-risk context and is **not** evidence that `6.1.200` was affected by that CVE. BandScope pins the current `6.2.108` artifact selected by the repository security baseline and requires current-head audit/security evidence rather than misattributing a scanner result to an unrelated advisory.
+
+PDF.js `6.2.108` no longer exposes the legacy `isEvalSupported` member in its public `DocumentInitParameters` contract, and `getDocument` no longer reads that member. BandScope therefore does not cast or pass an unknown option that would be ignored while creating false assurance. The parser boundary is reinforced by a narrow data-only call, copied caller-owned bytes, a same-origin bundled worker, explicit `enableXfa: false`, and explicit `useWorkerFetch: false`.
+
+```mermaid
+flowchart LR
+    A[Validated local PDF bytes] --> B[Copied Uint8Array]
+    B --> D[Data-only DocumentInitParameters]
+    D --> X[XFA disabled]
+    D --> F[Worker helper fetch disabled]
+    X --> C[pdfjs-dist 6.2.108]
+    F --> C
+    C --> W[Same-origin bundled worker]
+    W --> R[Canvas render]
+    J[jsdom development path] --> U[undici 7.29.0 override]
+    N[npm 10.9.8 approved update toolchain] --> L[Reviewed package-lock artifact]
+    L --> V[npm ci frozen validation]
+    V --> C
+    V --> U
+```
+
+## Threat boundary
+
+The score viewer accepts only bytes already copied into the app-owned workspace through the native PDF intake boundary. It does not accept a URL, credentials, custom request headers, or a remote worker. It also disables XFA rendering and PDF.js worker-side fetching of helper resources at this wrapper boundary. These controls prevent the caller from selecting an attacker-controlled document origin or worker asset and make the intended no-XML-form/no-worker-fetch policy explicit rather than relying on upstream defaults.
+
+PDF bytes remain untrusted after the native magic-byte, size, and path checks. Parser vulnerabilities, malformed object graphs, embedded actions, metadata/XML parsing, and resource-exhaustion paths can still occur inside a syntactically valid PDF. The exact dependency lock, copied data-only input, explicit parser options, same-origin worker, and existing native intake limits therefore remain mandatory for locally selected files.
+
+The pinned PDF.js XML parser does not expose an external-entity resolver through this wrapper: its default `onDoctype()` hook is a no-op, and `onResolveEntity()` resolves only the built-in XML entities before returning an unknown named entity literally. This source-level observation narrows what BandScope can claim; it is not a general assertion that every future PDF.js XML path is immune to entity-processing defects. Any parser upgrade must re-check the upstream implementation and repeat adversarial PDF verification.
+
+Undici is currently a development dependency reached through jsdom, but development and CI parsers process attacker-controlled fixtures, generated HTML, and network-like request bodies. A dev-only label does not make header injection, shared-cache disclosure, retry desynchronization, or cookie-attribute injection acceptable in the trusted build boundary.
+
+## Strix finding adjudication boundary
+
+Strix run `31871388084` on predecessor head `6f81f52c193c1e327d078eba7a2ea3bdbfbc87c2` reported a possible XXE path through `loadScorePdf`. Its attached proof-of-concept returned only a four-byte `%PDF` prefix and stated that construction of an actual PDF containing the alleged XML payload remained necessary. It did not demonstrate entity expansion, local-file disclosure, a network request, or parser output containing an external entity.
+
+The finding was therefore not suppressed and was not treated as proven exploitation. Instead, the exact dependency source was inspected and the wrapper was hardened at the narrowest supported API boundary: XFA rendering and worker-side helper fetching are now explicitly disabled and regression-locked. A fresh exact-head Strix result remains mandatory; a predecessor report, whether pass or fail, is not transferable merge evidence.
+
+## Lockfile provenance
+
+The dependency manifests and complete lock artifact were generated and reconciled on this branch with the approved Node `22.22.3` / npm `10.9.8` toolchain before the current frozen-validation gate was finalized. The historical generation run and artifact are provenance evidence only; they do **not** satisfy a later head's merge gate and primary CI intentionally does not repeat mutable dependency resolution.
+
+For every current head, primary CI instead:
+
+1. verifies npm `10.9.8` before dependency consumption;
+2. runs `npm ci --ignore-scripts --no-audit --no-fund` in the dedicated lock-validation job;
+3. rejects any `package.json` or `package-lock.json` working-tree drift; and
+4. proceeds to normal repository verification only after the frozen lock is consumable by the approved toolchain.
+
+Future dependency updates must use npm `10.9.8` to generate the complete lock in a dedicated update branch, review the entire resulting manifest/lock diff, and then prove frozen consumption on the resulting exact head. No tarball URL, SRI, dependency range, `peer` classification, or workspace record may be hand-edited merely to satisfy a validator.
+
+The lock contract requires the exact public-registry tarball and SHA-512 SRI for both patched packages and requires every existing `node_modules/@esbuild/*` location to retain npm 10.9.8's `peer: true` classification. This distinguishes the intended security graph from unrelated Dependabot generator churn. The narrower provenance and validation contract is specified in `docs/doctoring/npm-lockfile-generator-provenance.md`.
+
+## Verification
+
+The merge gate includes:
+
+- exact manifest and lock artifact tests;
+- a direct PDF.js wrapper test proving copied bytes, the locally bundled worker, `enableXfa: false`, `useWorkerFetch: false`, and no URL-bearing initialization member;
+- TypeScript compilation against the installed PDF.js `DocumentInitParameters` rather than an unsafe cast;
+- valid and malformed local score-PDF component tests;
+- desktop lint, strict typecheck, complete measured tests, and production build;
+- Tauri/Rust checks and native PDF intake regressions;
+- `npm audit --workspaces --audit-level=high` with no high finding;
+- repository SAST, CodeQL, security scan, secret scan, SBOM, and dependency evidence;
+- current-head Strix evidence rather than predecessor-head scanner output;
+- current-head central coverage and automated review;
+- zero unresolved actionable threads and a qualifying independent non-author approval; and
+- normal branch protection without administrative bypass.
+
+## Failure, rollback, and incident evidence
+
+On a failed frozen-lock validation or parser regression, preserve the exact head SHA, Node/npm versions, original lock blob SHA, test output, audit report, and workflow run ID. If the incident concerns a dependency-generation change, also preserve the generated complete lock and the generation environment/configuration. Do not merge a partially updated graph.
+
+Rollback restores the previous desktop manifest, root override, complete lock, PDF loader, tests, and CHANGELOG entry together. Because the previous graph contains known high findings, rollback is an emergency availability action only and requires an explicit security exception, compensating controls, owner, expiration, and immediate replacement plan.
+
+## References
+
+GitHub. (2024). *PDF.js vulnerable to arbitrary JavaScript execution upon opening a malicious PDF* (GHSA-wgrm-67xf-hhpq) [Security advisory]. https://github.com/advisories/GHSA-wgrm-67xf-hhpq
+
+Mozilla. (2026). *Document initialization parameters in PDF.js 6.2.108* [Source code]. GitHub. https://github.com/mozilla/pdf.js/blob/v6.2.108/src/display/api.js
+
+Mozilla. (2026). *PDF.js XML parser in version 6.2.108* [Source code]. GitHub. https://github.com/mozilla/pdf.js/blob/v6.2.108/src/core/xml_parser.js
+
+Mozilla. (2026). *PDF.js 6.2.108* [Software release]. https://github.com/mozilla/pdf.js/releases/tag/v6.2.108
+
+Node.js contributors. (2026). *Undici 7.29.0* [Software release]. https://github.com/nodejs/undici/releases/tag/v7.29.0
+
+npm, Inc. (2026). *npm ci*. npm Docs. https://docs.npmjs.com/cli/v11/commands/npm-ci/
+
+npm, Inc. (2026). *package-lock.json*. npm Docs. https://docs.npmjs.com/cli/v11/configuring-npm/package-lock-json/