Track GHSA-ch52 in Astro dependency tree

[sarthakagrawal927]

Finding

Reader's exact-head CI run for PR #72 failed at pnpm quality → quality:dependencies on high advisory GHSA-ch52-4w7c-c8xp. The upstream advisory lists http-cache-semantics versions <=4.2.0 as affected and currently reports no patched version (<0.0.0).

The audited lockfile path is landing-astro → astro@7.2.8 → http-cache-semantics@4.2.0 (pnpm-lock.yaml, Astro dependency entry and package snapshot). CI run 37236899001 evaluated head 7cf1a38249d5f24cce5c9a1553c5d60d641cbb21; it reported one unexpected high advisory and no critical advisories. The repository's current accepted-advisory list does not include this ID.

Follow-up

Keep the security gate failing. Track upstream patched-release availability, then verify the actual Reader build/runtime reachability and affected call sites before proposing a scoped dependency repair or any qualification. Do not add a waiver, alter the accepted-advisory list, or claim static build output alone proves safety.

Private evidence: .fleet-local/precise-footer-release/security-ghsa-ch52-evidence.json.

[sarthakagrawal927]

Bounded follow-up against the actual Reader-installed http-cache-semantics@4.2.0: the controlled 27-case fixture reproduces 12 failures on blocked shared-cache/revalidation cases (15 cases already pass). Applying the existing Pace PR201 guard only in memory makes all 27 cases pass, including serialization, legitimate public/private-cache cases, and normal max-stale age/URL bounds.

This is mitigation research, not an installed patch, release qualification, or changed audit gate. No dependency, lockfile, configuration or production code changed. The original runner assumed TAP summaries while Node used its spec reporter; the wrapper consequently exited1 despite the patched suite exiting0. The raw logs and corrected parse are retained separately, without claiming the original wrapper passed or repeating tests.

Private owning evidence is retained in .fleet-local/precise-footer-release/security-candidate-probe-20261005/. The upstream advisory still lists no patched version. A next implementation must qualify the actual installed patched graph and its maintenance/removal condition; keep the current gate and release blocked until that work is approved and verified.

[sarthakagrawal927]

This finding has been remediated by merged PR #74, independently of the footer candidate.

The exact merged source 963e0ead536752831574ce44795dc847f6731edb pins Astro's existing http-cache-semantics dependency to 4.3.0 and applies the reviewed local behavioral patch. Published 4.3.0 alone is not a security fix; no upstream patched release is claimed. The installed Astro-resolved package passes all 27 cache-security/compatibility cases, and the earlier unpatched negative control reproduced 12 protected failures. Frozen install verifies the lockfile/patch metadata. No advisory waiver was added; the dependency gate remains active and reports zero unexpected high/critical advisories.

Exact-main CI 37241365669 passed pnpm quality, including dependency checks. The patch maintenance instructions in patches/README.md require retaining it until upstream source passes the same behavior tests. Reader's guarded release 37241970149 serves Worker version 2f582008-9406-432a-a110-ccd9cbe1a433 at 100% with the exact merge tag; authenticated library verification passed.

Closing the known advisory repair as complete. Footer PR #72 is owned separately and still needs to incorporate current main before its own exact-head security gate can be qualified. This closure does not approve or qualify that older footer head.