fix(security): patch fast-uri, postcss, and brace-expansion advisories

[clay-good]

Status

Ready. Fixes every open Dependabot alert (plus one high-severity advisory Dependabot had not filed) at the root. The 10 open CodeQL alerts are triaged with a documented disposition below — they are not exploitable in OpenSpec's threat model, and none has a code fix that doesn't degrade the tests or defeat the archive engine's deliberate concurrency guard.

Dependency alerts — fixed

Advisory	Package	Sev	Where	Chain	Fix
GHSA-7p8r-x3mc-p8w7 (#95)	fast-uri 3.1.4 → 3.1.5	High	website	ajv@8.18.0	override fast-uri@<3.1.5 → ^3.1.5
GHSA-fxqj-rqcc-2cmp (#93)	postcss 8.5.22 → 8.5.25	Moderate	root	vite (test tooling)	override postcss@<8.5.23 → >=8.5.23
GHSA-rgw5-rvv9-x895	brace-expansion 5.0.8 → 5.0.9	High	website	minimatch@3	override brace-expansion@<=5.0.8 → >=5.0.9

What was wrong: three vulnerable transitive dev-dependencies. fast-uri and postcss are the two open Dependabot alerts. The brace-expansion one is not in the Dependabot list, but the repo's own website audit already fails on it on main (2 high before this change) — the previous override capped at >=5.0.8, and 5.0.8 is itself vulnerable under this newer advisory.

How it was fixed: version-ranged pnpm.overrides, matching the pattern already in the repo. Each range lapses automatically once the upstream tree moves past it. fast-uri is bounded to ^3.1.5 (stays on the 3.x line ajv expects) rather than the unbounded >=3.1.5, which resolved to a 4.x major.

Proof:

• pnpm audit --prod --audit-level high (root) → clean
• pnpm audit --audit-level high (root, all deps) → clean
• pnpm audit --audit-level high --dir website → clean (and clean at any severity)
• Full test suite: 3662 passing (122 files)
• website production build (static export) → clean
• Lockfile diffs are surgical — only the three target packages changed, no incidental bumps.

Code-scanning alerts — triaged, documented risk-acceptance

All 10 open alerts are js/file-system-race (CWE-367, TOCTOU). None is exploitable here and none has a non-degrading code fix:

• CWE-367 requires a privilege boundary — a privileged process an attacker races in a shared writable directory. openspec archive is an unprivileged CLI operating on the user's own files with the user's own permissions. No boundary is crossed.
• 7 alerts in src/core/archive.ts sit inside the rollback / concurrent-change-detection engine (fingerprintPath, releaseArchiveClaim, restoreSpecSnapshots, …). That code intentionally does stat → read → re-stat by name and then throws "Path changed while archive was reading …" / "rollback would overwrite a concurrent change". The flagged pattern is a deliberate race detector. Rewriting it to a pinned file descriptor would blind exactly the detection it exists to perform — strictly worse.
• 3 alerts in test files are assertions inside the tests' own mkdtemp temp dirs (asserting inode preservation / file mode / content). There is no attacker and no untrusted path; a file-descriptor rewrite would only make the assertions less readable.

CodeQL runs via GitHub default setup (no workflow file in-repo), so a committed paths-ignore to descope test code isn't available. Disposition: dismiss the 10 as won't fix — not exploitable in this threat model; concurrent-change already guarded (7 archive) and used in tests (3 test), with this write-up as the justification.

Notes

• The brace-expansion bump also forces minimatch@3's copy to 5.0.9 (the previous override already forced it to 5.0.8, i.e. the 5.x line). Verified harmless: minimatch@3 reaches the website only via serve-handler (dev preview, no brace-pattern globs), and the production build passes.
• Scope note: the brace-expansion fix is beyond the literal Dependabot list but is a real high-severity advisory the CI audit catches; leaving it would keep main's Security workflow red.

---

Hardening pass (commit harden(security): …)

A parallel review of four surfaces (dependency, CI, archive engine, adjacent code) produced these low-risk additions. Resolved dependency versions are unchanged.

Item	Why
Bound the 3 overrides to current major (brace-expansion ">=5.0.9 <6", postcss ">=8.5.23 <9")	a bare >=X pin would take a future major on the next lockfile regen without review; the website already used the caret-bounded idiom
Per-job permissions in release-prepare.yml	dropped pull-requests: write from the top-level block; only the prepare job (opens the Version Packages PR) keeps it. The beta job only tags/releases + publishes via OIDC — least privilege
New Website Lockfile Drift CI job	the website keeps its own lockfile and is never installed in CI, so a website override that stops resolving would go unnoticed and pnpm audit would scan a stale graph. pnpm install --frozen-lockfile --ignore-scripts --dir website fails fast on drift (root drift is already caught in ci.yml)
7 intent comments at the js/file-system-race sites in src/core/archive.ts	records that the stat→read→re-stat pattern is a deliberate concurrent-change detector, so no future refactor (human or scanner-driven) collapses it to fd I/O and blinds the guard

The review also confirmed as already-solid (nothing added): Dependabot covers all three surfaces, npm provenance is live, the files allowlist ships no source/secrets, postinstall is inert, every Action is SHA-pinned, no script-injection, and the injection/traversal/prototype-pollution surface is guarded. An independent trace of the archive rollback path found no constructible data-loss or symlink-escape exploit.

Nix: the root lockfile change staled flake.nix's pnpmDeps hash; repinned to the value CI computed. All checks green.

[coderabbitai]

📝 Walkthrough

Walkthrough

Dependency overrides, CI permissions, website lockfile validation, and the Nix dependency hash were updated. Archive comments now document race detection and rollback safeguards. No executable archive behavior or public declarations changed.

Changes

Dependency and CI maintenance

Layer / File(s)	Summary
Package manifest overrides package.json, website/package.json	Updated brace-expansion constraints. Added minimum-version overrides for postcss and fast-uri.
Workflow permissions and lockfile validation .github/workflows/release-prepare.yml, .github/workflows/security.yml	Scoped pull-request write permission to the release prepare job. Added frozen website lockfile validation with Node.js 20.19.0 and scripts disabled.
Nix dependency hash flake.nix	Replaced the pnpm dependency hash with a new fixed hash.

Archive race-safety documentation

Layer / File(s)	Summary
Archive race-safety comments src/core/archive.ts	Documented identity checks, point-in-time hashing, snapshot validation, and rollback checks that preserve concurrent changes.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• Fission-AI/OpenSpec#1461: Both PRs update brace-expansion overrides and the Nix dependency hash.
• Fission-AI/OpenSpec#1499: Both PRs modify src/core/archive.ts safety logic.
• Fission-AI/OpenSpec#1432: Both PRs update website dependency overrides and security workflow checks.

Suggested reviewers: tabishb, alfred-openspec

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely summarizes the primary security change: patching fast-uri, postcss, and brace-expansion advisories.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch claude/fix-security-alerts-a1cd51

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[cloudflare-workers-and-pages]

Deploying openspec-docs with    Cloudflare Pages

Latest commit:	9b26cc8
Status:	✅  Deploy successful!
Preview URL:	https://a3a21f83.openspec-docs.pages.dev
Branch Preview URL:	https://claude-fix-security-alerts-a.openspec-docs.pages.dev

View logs

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@flake.nix`:
- Line 54: Update the pnpm dependency hash in flake.nix by running
./scripts/update-flake.sh, then replace lib.fakeHash in the pnpmDeps
configuration with the returned sha256-... value and commit the resulting
flake.nix change.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 29a7a7bd-1db0-4c9c-818b-49833b47c14e

📥 Commits

Reviewing files that changed from the base of the PR and between 60d09bd and 9b26cc8.

⛔ Files ignored due to path filters (2)

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml
• website/pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (6)

• .github/workflows/release-prepare.yml
• .github/workflows/security.yml
• flake.nix
• package.json
• src/core/archive.ts
• website/package.json

🚧 Files skipped from review as they are similar to previous changes (2)

• website/package.json
• package.json

[coderabbitai]

Note

GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer.

[alfred-openspec]

Exact-head dependency and workflow review is clean. The installed trees resolve brace-expansion 5.0.9, postcss 8.5.25, and fast-uri 3.1.5 with no vulnerable copies; fresh root and website frozen installs, all audits, the root build, 208 archive tests, and the website production build pass. Release permissions are correctly scoped, the website drift check is pinned and read-only, and the full hosted matrix including Nix is green.