fix(security): eliminate extract-zip from the Lighthouse dependency graph

CHANGELOG.md

@@ -7,6 +7,16 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Fixed
+
+- **`extract-zip` eliminated from the dependency graph (Dependabot #86, GHSA-7pqw-9j4j-h8q3 /
+  GHSA-jmr9-qjv8-65gv):** the vulnerable package was reachable only via `@lhci/cli`'s hard-pinned
+  `lighthouse@12.6.1` → `puppeteer-core` → `@puppeteer/browsers@2.x` chain. A
+  `pnpm-workspace.yaml` override exact-pins `lighthouse` to `13.4.1`, whose modern
+  `@puppeteer/browsers@3.x` dependency replaced `extract-zip` with `modern-tar` entirely — the
+  package now has zero occurrences in the resolved graph. Lighthouse 13.4.1 requires Node
+  `>=22.19`, so the repository's own `engines.node` floor is raised to match. PR #682.
+
 ### Documentation
 
 - **Post-release v1.28.6 truth sync:** removed the now-stale release-candidate markers from

CONTRIBUTING.md

@@ -26,13 +26,13 @@ This project follows the [Contributor Covenant Code of Conduct](.github/CODE_OF_
 
 ### Prerequisites
 
-- **Node.js** ≥ 22 (see [`.nvmrc`](.nvmrc); matches `engines` in [`package.json`](package.json))
+- **Node.js** ≥ 22.19 (see [`.nvmrc`](.nvmrc); matches `engines` in [`package.json`](package.json))
 - **pnpm** ≥ 11 (see `packageManager` in `package.json`; recommended via **Corepack**, ships with Node)
 - A **Gemini API Key** from [Google AI Studio](https://aistudio.google.com/app/apikey) (optional if using **Ollama** in the desktop app only)
 
 ### Windows: Node, Corepack, and pnpm
 
-1. Install **Node.js 22+** LTS from [nodejs.org](https://nodejs.org/) (includes Corepack) or use **nvm-windows** and install `22` from [`.nvmrc`](.nvmrc).
+1. Install **Node.js ≥22.19** LTS from [nodejs.org](https://nodejs.org/) (includes Corepack; matches `engines` in [`package.json`](package.json)) or use **nvm-windows** and install `22` from [`.nvmrc`](.nvmrc) — pick the latest available 22.x patch, not the first one nvm-windows offers.
 2. Open **PowerShell or CMD as Administrator** once and run: `corepack enable`
 3. In the repo folder: `corepack prepare pnpm@11.22.0 --activate` (version matches `packageManager` in [`package.json`](package.json); adjust if that field changes).
 4. Confirm: `pnpm -v` — then `node scripts/dependency-state.mjs reconcile` (never a bare `pnpm install` — see [Installation](#installation)) and use `pnpm run …` for all scripts (hooks expect `pnpm` on `PATH`).

README.md

@@ -63,7 +63,7 @@ Two always-on hosted builds — open whichever you prefer (identical app, both a
 
 > Everything is saved locally in IndexedDB and works offline (PWA). Nothing leaves your device unless you choose a cloud provider.
 
-**Running it yourself?** `node scripts/dependency-state.mjs reconcile && pnpm run dev` (Node ≥ 22, pnpm 11; frozen-lockfile install — never a bare `pnpm install`) → <http://localhost:3000>. Full setup, deployment, and AI-provider options — including the new **OpenRouter** free-tier gateway — are in [Getting Started](#getting-started).
+**Running it yourself?** `node scripts/dependency-state.mjs reconcile && pnpm run dev` (Node ≥ 22.19, pnpm 11; frozen-lockfile install — never a bare `pnpm install`) → <http://localhost:3000>. Full setup, deployment, and AI-provider options — including the new **OpenRouter** free-tier gateway — are in [Getting Started](#getting-started).
 
 ---
 
@@ -567,7 +567,7 @@ WorldScript-Studio/
 
 A modern browser (Chrome 90+, Firefox 88+, Safari 14+, Edge 90+) is all you need for the web app — no installation required.
 
-For local development: **Node ≥ 22**, **pnpm 11** (`npm install -g pnpm`). For the desktop app: **Rust + Tauri CLI** (`cargo install tauri-cli`).
+For local development: **Node ≥ 22.19**, **pnpm 11** (`npm install -g pnpm`). For the desktop app: **Rust + Tauri CLI** (`cargo install tauri-cli`).
 
 ### 🔐 Setting Up AI
 
@@ -631,7 +631,7 @@ Vercel is a **first-class** hosting option alongside Pages: connect the repo, us
 git clone https://github.com/qnbs/WorldScript-Studio.git
 cd WorldScript-Studio
 
-# Install dependencies (Node ≥ 22, pnpm 11) — frozen-lockfile install, never a bare `pnpm install`
+# Install dependencies (Node ≥ 22.19, pnpm 11) — frozen-lockfile install, never a bare `pnpm install`
 node scripts/dependency-state.mjs reconcile
 
 # Start the development server (http://localhost:3000)

TODO.md

@@ -10,7 +10,7 @@ Status: 🔄 in progress | ⬜ open | ✅ done
 
 ## Current Sprint — v1.28.6 corrected release cut: Tauri desktop release-build recovery (2026-09-09)
 
-> **Status: 🔄 in progress.** The authoritative native sequence remains
+> **Status: ✅ done.** The authoritative native sequence remains
 > [`docs/native/ROADMAP-QT-GPUI-DESKTOP.md`](docs/native/ROADMAP-QT-GPUI-DESKTOP.md), with the
 > next Rust-Core capability choice recorded in [`docs/native/CORE-MIGRATION-LEDGER.md`](docs/native/CORE-MIGRATION-LEDGER.md).
 > R-15 implementation stays blocked behind the still-open Wave 2 prerequisite (ledger row 9). No

docs/DEPENDABOT-TRIAGE.md

@@ -99,6 +99,14 @@ with no patched release and no production-runtime footprint; it must still be
 rechecked before expiry and removed as soon as an upstream fix or dependency-path change makes that
 possible. Review each cluster against current upstream status before changing any deadline.
 
+**2026-09-10 update: both `extract-zip` ignores retired.** A `pnpm-workspace.yaml`
+`overrides.lighthouse: ">=13.4.1"` entry forces `@lhci/cli`'s Lighthouse/Puppeteer chain onto a
+version whose `@puppeteer/browsers` dependency replaced `extract-zip` with `modern-tar` —
+eliminating the package from the resolved graph entirely (`pnpm why extract-zip` now returns
+nothing). `GHSA-jmr9-qjv8-65gv` and `GHSA-7pqw-9j4j-h8q3` are removed from
+`src-tauri/osv-scanner.toml`; the cluster total drops from 21 to 19. See AUDIT.md's 2026-09-10
+entry for the full verification trail.
+
 ## Special-attention dependencies
 
 These need more than a changelog skim because of documented quirks elsewhere in this repo:

docs/DEPLOYMENT.md

@@ -42,7 +42,7 @@ gh run view <run-id> --log-failed
    - **Install:** `node scripts/dependency-state.mjs reconcile`
    - **Build:** `pnpm run build:edge`
    - **Output:** `dist`
-3. **Node.js** ≥ 22 (Project Settings → General).
+3. **Node.js** ≥ 22.19 (Project Settings → General; matches `engines` in `package.json`).
 4. **Environment variables (optional):** `DEPLOY_TARGET=edge` — redundant if using `build:edge`; do **not** add AI API keys for end users.
 5. SPA routing: `rewrites` in `vercel.json` → `index.html`.
 6. **Preview deployments:** enabled per branch/PR by default.

infra/low-end-ci/INSTALL.md

@@ -226,7 +226,7 @@ restore-ci.sh ~/worldscript-ci/backups/<timestamp>
 | act: exec format error | Wrong arch — check release `amd64` vs `arm64` |
 | OOM during act | Swap ≥6G, `ci-eco-stop.sh`, `--sequential` only, single-axis matrix |
 | Forgejo won't start | `docker logs worldscript-forgejo`; data directory permissions `chown 1000:1000` |
-| Node too old | `fnm use 22` — project requires Node ≥22 |
+| Node too old | `fnm install 22 --latest && fnm use 22` — project requires Node ≥22.19 |
 
 ---
 

package.json

@@ -15,7 +15,7 @@
   "type": "module",
   "packageManager": "pnpm@11.22.0",
   "engines": {
-    "node": ">=22.0.0",
+    "node": ">=22.19.0",
     "pnpm": "11.22.0"
   },
   "scripts": {