fix(security): patch fast-uri, postcss, and brace-expansion advisories (#1510)

* fix(security): patch fast-uri, postcss, and brace-expansion advisories

Resolve the two open Dependabot alerts plus a third high-severity advisory
the repo's own audit surfaces but Dependabot had not filed, all via
version-ranged pnpm overrides (they lapse once the upstream tree moves past
them):

- fast-uri 3.1.4 -> 3.1.5 (website): GHSA-7p8r-x3mc-p8w7, high. Host
  confusion via backslash authority introducer. Pulled in transitively by
  ajv@8.18.0; bounded to ^3.1.5 so it stays on the 3.x line ajv expects.
- postcss 8.5.22 -> 8.5.25 (root): GHSA-fxqj-rqcc-2cmp, moderate. Arbitrary
  .map file read via attacker-controlled sourceMappingURL. Pulled in by
  vite (dev/test tooling).
- brace-expansion 5.0.8 -> 5.0.9 (website): GHSA-rgw5-rvv9-x895, high. DoS
  via unbounded recursion. The existing override capped at >=5.0.8, and
  5.0.8 is itself vulnerable under this newer advisory; the root already
  resolved to 5.0.9.

Root and website audits are clean at --audit-level high (and any-severity
for the website). Full test suite: 3662 passing.

* harden(security): bound overrides, scope release perms, add website lockfile drift check, document archive TOCTOU intent

Hardening pass over the security fixes, from a parallel review of the
dependency, CI, archive, and adjacent-code surfaces. Each item is low-risk
and verified; resolved dependency versions are unchanged.

- deps: bound the three security overrides to their current major
  (brace-expansion ">=5.0.9 <6", postcss ">=8.5.23 <9"). A bare ">=X" pin
  would take a future major on the next lockfile regen without review; the
  website already models the caret-bounded idiom.
- ci: scope release-prepare.yml permissions per job. The top-level block
  dropped "pull-requests: write"; only the "prepare" job (which opens the
  Version Packages PR) now holds it. The "beta" job only tags/releases and
  publishes via OIDC, so it inherits the narrower default (least privilege).
- ci: add a "Website Lockfile Drift" job to security.yml. The website keeps
  its own lockfile and is never installed in CI, so a website override that
  stops resolving would go unnoticed and `pnpm audit` would scan a stale
  graph. A `pnpm install --frozen-lockfile --ignore-scripts --dir website`
  fails fast on that drift (root drift is already caught in ci.yml).
- archive: add intent comments at the 7 js/file-system-race sites in
  src/core/archive.ts. The stat->read->re-stat pattern is a deliberate
  concurrent-change detector; the comments record why, so no future refactor
  (human or scanner-driven) collapses it to fd I/O and blinds the guard.

Verified: 3662 tests pass, build clean, website build clean, root+website
audits clean at --audit-level high, and the new frozen-lockfile check passes
locally.

* chore(nix): refresh pnpmDeps hash for the lockfile change

The root pnpm-lock.yaml changed (postcss + brace-expansion overrides), which
stales the fixed-output pnpmDeps hash and fails Nix Flake Validation. Repin to
the value CI computed from the new lockfile.

Author: clay-good

.github/workflows/release-prepare.yml

@@ -5,9 +5,11 @@ on:
     branches: [main]
   workflow_dispatch: # manually cut a beta prerelease from main
 
+# Floor for both jobs. The prepare job widens this to pull-requests: write for
+# the Version Packages PR; the beta job only tags/releases + publishes via OIDC
+# and needs no PR access, so it inherits this narrower default.
 permissions:
   contents: write
-  pull-requests: write
   id-token: write # Required for npm OIDC trusted publishing
 
 concurrency:
@@ -18,6 +20,10 @@ jobs:
   prepare:
     if: github.repository == 'Fission-AI/OpenSpec' && github.event_name == 'push'
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write # changesets opens/updates the Version Packages PR
+      id-token: write # Required for npm OIDC trusted publishing
     steps:
       # Generate GitHub App token first - used for checkout and changesets
       # This allows git operations to trigger CI workflows on the version PR

.github/workflows/security.yml

@@ -88,3 +88,32 @@ jobs:
         if: ${{ !cancelled() }}
         continue-on-error: ${{ github.event_name == 'pull_request' }}
         run: pnpm audit --audit-level high --dir website
+
+  # The website keeps its own lockfile and is never installed or built elsewhere
+  # in CI, so a website/package.json change — e.g. a security override — that is
+  # not reflected in website/pnpm-lock.yaml goes unnoticed: the override you think
+  # patches an advisory may not be in the committed graph at all, and `pnpm audit`
+  # would happily audit the stale (possibly still-vulnerable) tree. A frozen-lockfile
+  # install fails fast on that drift. Root drift is already caught by the
+  # `--frozen-lockfile` installs in ci.yml; this closes the same gap for the website.
+  # `--ignore-scripts` skips sharp's native build (irrelevant to lockfile validation
+  # and the usual source of install flake).
+  website-lockfile:
+    name: Website Lockfile Drift
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6
+
+      - name: Setup Node.js
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: '20.19.0'
+
+      - name: Verify website lockfile matches package.json
+        run: pnpm install --frozen-lockfile --ignore-scripts --dir website

flake.nix

@@ -51,7 +51,7 @@
               inherit (finalAttrs) pname version src;
               pnpm = pkgs.pnpm_9;
               fetcherVersion = 3;
-              hash = "sha256-6huf6aAPGkK8Oz6YqbRXObTmFbwRv+6GH5qtNlhlfFw=";
+              hash = "sha256-w3nzoSXu6eONUDcuzgbGhA0a5ix5zU1QhNIFwwJPnXs=";
             };
 
             nativeBuildInputs = with pkgs; [

package.json

@@ -86,7 +86,8 @@
   },
   "pnpm": {
     "overrides": {
-      "brace-expansion@<=5.0.7": ">=5.0.8"
+      "brace-expansion@<=5.0.8": ">=5.0.9 <6",
+      "postcss@<8.5.23": ">=8.5.23 <9"
     }
   }
 }

pnpm-lock.yaml

@@ -574,6 +574,9 @@ async function releaseArchiveClaim(
   await claim.handle.close().catch(() => undefined);
   if (owned === undefined) return;
   try {
+    // Read between two lstats by design: the identity + content match below
+    // proves we still own this claim before unlinking it. This is a concurrent-
+    // change detector, not an fd-less race to "fix" (CodeQL js/file-system-race).
     const current = await fs.lstat(claimPath, { bigint: true });
     const contents = await fs.readFile(claimPath, 'utf8');
     const currentAfterRead = await fs.lstat(claimPath, { bigint: true });
@@ -706,6 +709,9 @@ async function fingerprintPath(filePath: string): Promise<string> {
 async function fingerprintMovablePath(filePath: string): Promise<string> {
   try {
     const entry = await fs.lstat(filePath, { bigint: true });
+    // Deliberate stat -> read -> re-stat: a concurrent change is DETECTED by the
+    // statIdentity comparison below and throws. Do not collapse to fd I/O, which
+    // would pin one inode and blind the detector (CodeQL js/file-system-race).
     const hash = createHash('sha256')
       .update(await fs.readFile(filePath))
       .digest('hex');
@@ -741,6 +747,9 @@ async function fingerprintMovablePath(filePath: string): Promise<string> {
 async function fingerprintPortableContent(filePath: string): Promise<string> {
   try {
     const entry = await fs.lstat(filePath);
+    // Point-in-time content hash by design (no re-stat): callers compare it
+    // against a prior fingerprint of the same bytes, so any concurrent change
+    // surfaces as a hash mismatch (CodeQL js/file-system-race is a false positive here).
     const hash = createHash('sha256')
       .update(await fs.readFile(filePath))
       .digest('hex');
@@ -818,6 +827,9 @@ async function captureSpecSnapshots(mutations: SpecMutation[]): Promise<SpecSnap
           let contentExisted = false;
           if (outcome === 'write') {
             try {
+              // Best-effort rollback snapshot; a concurrent edit is caught later
+              // by restoreSpecSnapshots refusing to overwrite non-matching content,
+              // not here (CodeQL js/file-system-race).
               content = await fs.readFile(update.target);
               contentExisted = true;
             } catch (error) {
@@ -839,6 +851,9 @@ async function captureSpecSnapshots(mutations: SpecMutation[]): Promise<SpecSnap
           existed: true,
           outcome,
           ...(outcome === 'write' ? { expectedContent: Buffer.from(rebuilt) } : {}),
+          // Snapshot read for rollback; restoreSpecSnapshots re-checks this
+          // content before restoring, so a mid-run change aborts instead of
+          // clobbering (CodeQL js/file-system-race).
           ...(stat.isFile() ? { content: await fs.readFile(update.target) } : {}),
           ...(stat.isFile() ? { mode: stat.mode } : {}),
         };
@@ -882,6 +897,9 @@ async function restoreSpecSnapshots(snapshots: SpecSnapshot[]): Promise<void> {
             snapshot.symlink !== undefined &&
             current.isSymbolicLink() &&
             (await fs.readlink(snapshot.target)) === snapshot.symlink;
+          // Re-read to confirm the target still holds the snapshot content; a
+          // mismatch means a concurrent edit, and rollback throws below rather
+          // than overwrite it (CodeQL js/file-system-race is intentional here).
           const unchangedFile =
             snapshot.symlink === undefined &&
             snapshot.content !== undefined &&
@@ -919,6 +937,9 @@ async function restoreSpecSnapshots(snapshots: SpecSnapshot[]): Promise<void> {
             `Archive rollback would overwrite a concurrent change at ${snapshot.target}.`
           );
         }
+        // Re-read at rollback: only restore when current content matches what
+        // archive wrote or snapshotted; otherwise abort to preserve a concurrent
+        // change (CodeQL js/file-system-race is intentional here).
         const currentContent = await fs.readFile(snapshot.target);
         const originalContent =
           snapshot.symlink !== undefined && !snapshot.contentExisted

src/core/archive.ts

@@ -37,7 +37,8 @@
     "overrides": {
       "postcss": "^8.5.22",
       "sharp": "^0.35.3",
-      "brace-expansion@<=5.0.7": ">=5.0.8"
+      "brace-expansion@<=5.0.8": ">=5.0.9 <6",
+      "fast-uri@<3.1.5": "^3.1.5"
     }
   }
 }