fix(security): raise transitive dependency floors

CHANGELOG.md

@@ -6,6 +6,10 @@ Historical release entries from **0.1.0 through 0.5.27** are preserved verbatim
 
 ## [Unreleased]
 
+### Security
+- Raised workspace-wide transitive development-tool overrides for `fast-uri`, `nanoid`, and `postcss` to patched minimums, keeping the lockfile audit clean without changing runtime package authority.
+- Normalized isolated package-verifier temporary roots before containment checks on macOS.
+
 ## [0.6.0] — 2026-08-10
 
 ### Release

pnpm-workspace.yaml

@@ -6,22 +6,35 @@ onlyBuiltDependencies:
 allowBuilds:
   esbuild: true
 
+# Keep install-time supply-chain policy explicit instead of relying on pnpm's
+# mutable defaults. Transitive exotic sources stay blocked, newly published
+# versions wait seven days, and trust downgrades fail for packages released in
+# the last 30 days. The bounded legacy window keeps the frozen TipTap v2 line
+# (published months before trusted-publishing adoption) installable without
+# exempting current package names or disabling lockfile verification.
+blockExoticSubdeps: true
+minimumReleaseAge: 10080
+trustPolicy: no-downgrade
+trustPolicyIgnoreAfter: 43200
+
 # Force patched transitive dependencies across the whole tree. pnpm 10+ reads
 # `overrides` from pnpm-workspace.yaml, NOT the deprecated package.json `pnpm`
 # field, so every security override must live here to actually take effect.
 #   - vite<6.4.3:   GHSA-fx2h-pf6j-xcff / GHSA-4w7w-66w2-5vf9 / GHSA-v6wh-96g9-6wx3
 #     (vitest's @vitest/mocker still resolves a transitive vite@5)
 #   - esbuild<0.25: GHSA-67mh-4wv8-2f99 (dragged in by the transitive vite@5)
-#   - fast-uri<3.1.4: GHSA-v2hh-gcrm-f6hx / CVE-2026-16221 (via ajv in vite-plugin-dts)
-#   - postcss<=8.5.17: GHSA-r28c-9q8g-f849 (source-map path traversal via vite)
+#   - fast-uri<3.1.5: GHSA-v2hh-gcrm-f6hx / GHSA-7p8r-x3mc-p8w7 (via ajv in vite-plugin-dts)
+#   - nanoid<3.3.18: GHSA-2v37-7h3g-55p8 (via postcss)
+#   - postcss<=8.5.22: GHSA-r28c-9q8g-f849 / GHSA-fxqj-rqcc-2cmp (source-map path traversal via vite)
 #   - brace-expansion<=5.0.7: GHSA-mh99-v99m-4gvg (unbounded-expansion DoS). The
 #     only patched line is >=5.0.8; minimatch@9 consumes brace-expansion@2.x and
 #     cannot take 5.x, so lift minimatch to ^10 (glob@10 / test-exclude@7 resolve
 #     cleanly) and pin brace-expansion to the patched 5.x line.
 overrides:
   vite: ^6.4.3
   esbuild: ^0.25.0
-  fast-uri: ^3.1.4
-  postcss: ^8.5.18
+  fast-uri: ^3.1.5
+  nanoid: ^3.3.18
+  postcss: ^8.5.23
   brace-expansion: ^5.0.8
   minimatch: ^10.0.0

scripts/revision-evidence-consumer-config.test.mjs

@@ -3,6 +3,7 @@ import {
   existsSync,
   mkdirSync,
   mkdtempSync,
+  readFileSync,
   realpathSync,
   rmSync,
   symlinkSync,
@@ -88,7 +89,10 @@ test('copies the locked pnpm dependency tree into the independent consumer', ()
       true,
     );
     const stagedPackage = realpathSync(join(targetNodeModules, 'example'));
-    assert.equal(relative(targetNodeModules, stagedPackage).startsWith('..'), false);
+    assert.equal(
+      relative(realpathSync(targetNodeModules), stagedPackage).startsWith('..'),
+      false,
+    );
   } finally {
     rmSync(root, { recursive: true, force: true });
   }
@@ -198,3 +202,62 @@ test('exposes only declared direct dependencies from the staged lockfile tree',
     rmSync(root, { recursive: true, force: true });
   }
 });
+
+test('canonical containment detects a symlinked dependency that escapes the consumer tree', () => {
+  const root = realpathSync(
+    mkdtempSync(join(tmpdir(), 'inkspan-symlink-containment-')),
+  );
+  try {
+    const consumer = join(root, 'consumer');
+    const outside = join(root, 'outside');
+    const linkedPackage = join(consumer, 'node_modules', 'example');
+    mkdirSync(join(consumer, 'node_modules'), { recursive: true });
+    mkdirSync(outside, { recursive: true });
+    writeFileSync(join(outside, 'package.json'), '{}\n', 'utf8');
+    symlinkSync(outside, linkedPackage, 'dir');
+
+    assert.equal(relative(consumer, linkedPackage).startsWith('..'), false);
+    assert.equal(
+      relative(realpathSync(consumer), realpathSync(linkedPackage)).startsWith(
+        '..',
+      ),
+      true,
+    );
+  } finally {
+    rmSync(root, { recursive: true, force: true });
+  }
+});
+
+test('generated ESM and CommonJS package checks canonicalize runtime resolution paths', () => {
+  const verifierSource = readFileSync(
+    new URL('./verify-revision-evidence-package.mjs', import.meta.url),
+    'utf8',
+  );
+
+  assert.equal(
+    verifierSource.includes("import { realpathSync } from 'node:fs';"),
+    true,
+  );
+  assert.equal(
+    verifierSource.includes('const consumerDirectory = realpathSync('),
+    true,
+  );
+  assert.equal(
+    verifierSource.includes(
+      "const resolvedEntry = realpathSync(fileURLToPath(import.meta.resolve('",
+    ),
+    true,
+  );
+  assert.equal(
+    verifierSource.includes(
+      "const { realpathSync } = require('node:fs');",
+    ),
+    true,
+  );
+  assert.equal(
+    verifierSource.includes(
+      "const resolvedEntry = realpathSync(require.resolve('",
+    ),
+    true,
+  );
+});

scripts/verify-framework-free-revision-evidence-package.mjs

@@ -19,8 +19,8 @@ const repositoryRoot = resolve(dirname(fileURLToPath(import.meta.url)), '..');
 const packageJson = JSON.parse(
   readFileSync(join(repositoryRoot, 'package.json'), 'utf8'),
 );
-const verificationRoot = mkdtempSync(
-  join(tmpdir(), 'inkspan-framework-free-evidence-'),
+const verificationRoot = realpathSync(
+  mkdtempSync(join(tmpdir(), 'inkspan-framework-free-evidence-')),
 );
 const extractionDirectory = join(verificationRoot, 'extracted');
 const consumerDirectory = join(verificationRoot, 'consumer');

scripts/verify-revision-evidence-package.mjs

@@ -24,8 +24,8 @@ const repositoryRoot = resolve(dirname(fileURLToPath(import.meta.url)), '..');
 const packageJson = JSON.parse(
   readFileSync(join(repositoryRoot, 'package.json'), 'utf8'),
 );
-const verificationDirectory = mkdtempSync(
-  join(tmpdir(), 'inkspan-revision-evidence-'),
+const verificationDirectory = realpathSync(
+  mkdtempSync(join(tmpdir(), 'inkspan-revision-evidence-')),
 );
 const externalDependencyNames = Object.freeze([
   ...new Set([

src/pnpmSupplyChainPolicy.test.ts

@@ -0,0 +1,39 @@
+import { readFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { describe, expect, it } from 'vitest';
+
+const repositoryRoot = join(dirname(fileURLToPath(import.meta.url)), '..');
+const workspacePolicy = readFileSync(
+  join(repositoryRoot, 'pnpm-workspace.yaml'),
+  'utf8',
+);
+const workspacePolicyLines = workspacePolicy.split(/\r?\n/u);
+
+function readScalar(
+  name: string,
+  lines: readonly string[] = workspacePolicyLines,
+): string | undefined {
+  const prefix = `${name}:`;
+  const matches = lines.filter((candidate) => candidate.startsWith(prefix));
+  if (matches.length !== 1) return undefined;
+  return matches[0]?.slice(prefix.length).split('#', 1)[0]?.trim();
+}
+
+describe('pnpm supply-chain policy', () => {
+  it('pins security-sensitive install policy instead of relying on mutable defaults', () => {
+    expect(readScalar('blockExoticSubdeps')).toBe('true');
+    expect(readScalar('minimumReleaseAge')).toBe('10080');
+    expect(readScalar('trustPolicy')).toBe('no-downgrade');
+    expect(readScalar('trustPolicyIgnoreAfter')).toBe('43200');
+  });
+
+  it('rejects duplicate root policy scalars instead of accepting the first declaration', () => {
+    expect(
+      readScalar('trustPolicy', [
+        'trustPolicy: no-downgrade',
+        'trustPolicy: always',
+      ]),
+    ).toBeUndefined();
+  });
+});

tests/package/verify-framework-free-autosave-package.mjs

@@ -23,8 +23,8 @@ const repositoryRoot = resolve(
 const packageJson = JSON.parse(
   readFileSync(join(repositoryRoot, 'package.json'), 'utf8'),
 );
-const verificationRoot = mkdtempSync(
-  join(tmpdir(), 'inkspan-framework-free-autosave-'),
+const verificationRoot = realpathSync(
+  mkdtempSync(join(tmpdir(), 'inkspan-framework-free-autosave-')),
 );
 const extractionDirectory = join(verificationRoot, 'extracted');
 const consumerDirectory = join(verificationRoot, 'consumer');