SUPPLY-001D4 — Patch critical websocket-driver in the root production dependency tree

[daliu]

Officer impact: None — this child patches and verifies one root transitive dependency. It does not change a member or officer screen, task, permission, collected field, payment, or live service.

Officer documentation: None — no current officer procedure, diagram, approval, incident, backup, or recovery behavior changes.

Deployment evidence: None at issue creation. Closure must distinguish source, tests, merge, website publication, Firebase deployment, outside-provider configuration, production data, and live behavior. A lockfile merge or green CI run is not deployment.

Problem

On exact released main fcb7f77cd1c26e28f785416249f7e80c5ba71757, the committed root dependency tree contains one hoisted non-development websocket-driver@0.7.4 node.

Production path:

firebase@11.10.0 -> @firebase/database@1.0.20 -> faye-websocket@0.11.4 -> websocket-driver >=0.5.1

The same node also satisfies the development path:

webpack-dev-server@4.15.2 -> sockjs@0.3.24 -> websocket-driver ^0.7.4

Both ranges admit 0.7.5. GHSA-xv26-6w52-cph6 is critical, affects versions below 0.7.5, has no workaround, and describes message corruption through protocol length-header abuse. GHSA-mp7j-qc5w-4988 is a separate moderate resource-limit bypass fixed by the same release.

The current modular application does not import Firebase Realtime Database. Searches of existing optimized builds found no Faye, websocket-driver, or draft-protocol parser signature. That lowers observed reachability but does not justify keeping a known critical node in the production-classified dependency graph or allowing a future import to expose it.

A Node 20.19.5/npm 10.8.2 lock-only simulation changes exactly one package-lock record from 0.7.4 to 0.7.5, with no parent, sibling, dependency, engine, or development-flag change. Fresh verification must confirm that result.

Current dated audit snapshot inherited from exact main before this package-only child:

• full root audit: 67 affected-package findings — 13 low, 19 moderate, 32 high, 3 critical
• production-only root audit: 7 — 1 low, 2 moderate, 3 high, 1 critical

The expected result is 66 full findings with 2 critical and 6 production findings with 0 critical, because the single node currently carries both advisories. Report actual fresh results and do not assert mutable audit totals in source tests.

Atomic outcome

• Regenerate only the root lock resolution needed to install websocket-driver@0.7.5.
• Keep root package.json unchanged; both parents already admit 0.7.5.
• Extend the existing dependency-free Node regression with exact committed/installed identity, sole-resolution, and parent-range checks.
• Add a small public-API draft-75 synthetic length-header regression with a one-byte maxLength. It must fail on 0.7.4 and close deterministically on 0.7.5 without large input or memory pressure.
• Keep the existing blocking hosted-CI command unchanged because it already runs tests/root-dependency-security.test.js.
• Add one separately named SUPPLY-001D4/RISK-014 security-ledger row without rewriting the dated headline or historical D1/D3 evidence.
• Compare clean optimized artifacts before and after because npm classifies this node as production; stop and explain any unexpected difference.

Expected exact identity, to verify rather than assume:

• version 0.7.5
• registry URL https://registry.npmjs.org/websocket-driver/-/websocket-driver-0.7.5.tgz
• integrity sha512-ZL2+3c7kMBdIRCMz6l8jQMHyGVxj+UL+xVk74Ombiciboca8rHa15L86B19E5oh1pL9Ii/uj54gtsIrZGMo6zA==
• unchanged dependencies on http-parser-js, safe-buffer, and websocket-extensions
• exactly one locked and installed websocket-driver copy

Invariants

• No npm audit fix or npm audit fix --force.
• No root package.json, workflow, artifact-contract, Functions package, or Functions lock change.
• No application runtime, Firebase Realtime Database adoption, Firestore Rules, configuration, schema, migration, provider, deployment, production-data, or live-behavior change.
• No secrets, environment values, customer/member/payment records, provider calls, or production Firebase access in the regression.
• Registry identity and integrity must be exact, public, and reviewed.
• The test must use only fixed synthetic request bytes and a tiny configured limit.
• Use the public websocket-driver API; do not depend on private draft parser internals.
• Prove a successful draft-75 handshake/open state before supplying the hostile length header.
• Do not infer website exploitability from npm production classification.
• Preserve every unrelated worktree change and active claim.

Required proof

Red

• Against the exact old 0.7.4 install, the identity test rejects the version and the synthetic public-API length-header case remains open instead of closing at the configured bound.
• Record fresh baseline full and production-only audit results.

Green

• Clean Node 20/npm install from the committed lock.
• Focused root dependency regression, including a threshold control that avoids an unconditional-close false positive.
• Exact npm ls websocket-driver --all.
• Full and --omit=dev root audits with honest remaining counts and no finding for either websocket-driver advisory.
• Frontend lint, Jest, TypeScript, diagnostic build, Functions lint/tests, Rules suite, commerce emulator, SPA/workflow/release/readback/artifact tests, and diff check.
• Fresh clean optimized-build comparison plus an explicit bundle-signature search.
• Exact lockfile review proving only the intended package record changed.
• Independent dependency/security, test-contract, and runtime/artifact/scope reviews approve the exact final diff.

Exact owned paths and hunks

1. package-lock.json — only the npm-generated node_modules/websocket-driver identity record
2. tests/root-dependency-security.test.js — additive separately named SUPPLY-001D4 constants/helpers/tests only; preserve every SUPPLY-001D3 form-data/hasown hunk
3. SECURITY.md — one separate SUPPLY-001D4 row under the RISK-014 remediation ledger

Dependencies and coordination

• CI-001A — Repair the deterministic frontend test baseline #103, SUPPLY-001C — Upgrade Firebase web SDK to the final 11.x compatibility set #202/SUPPLY-001C, SUPPLY-001D1 — Patch high-severity form-data in Functions dependency tree #212/SUPPLY-001D1, SEC-DOC-001A — Correct dated RISK-014 audit summary #215, SUPPLY-001D2 — Remove unused firebase-functions-test dependency #218/SUPPLY-001D2, SUPPLY-001D3 — Patch vulnerable form-data nodes in the root dependency tree #306/SUPPLY-001D3, and WEB-PRIVACY-001O — Make the Admin website-account role list fail closed #307 are complete and released.
• WEB-PRIVACY-001O — Make the Admin website-account role list fail closed #307 released exact main fcb7f77cd1c26e28f785416249f7e80c5ba71757; its three Admin Members paths are immutable and disjoint.
• The coordinating task returned GO before publication and will keep these three SUPPLY-001D4 paths immutable.
• No duplicate issue, open pull request, or active exact-path claim was found immediately before publication.
• Re-read live claims immediately before editing and stop on any overlap.

Explicitly out of scope

Do not upgrade Firebase, Firebase CLI, webpack/dev-server, SockJS, Faye, or any major package; import Realtime Database; alter application code; add an override/direct dependency; edit workflows or officer documentation; deploy; configure an outside provider; inspect production data; or accept/time-bound any remaining advisory.

Claim protocol

Creation is not a claim. Before any repository edit: assign the issue, confirm dependencies and active claims again, post CLAIMED by <canonical agent> at <UTC>; branch <branch>; exact base <SHA>, move status:ready to status:in-progress, and push the unique branch. Earliest valid timestamped claim wins.

[daliu]

CLAIMED by /root at 2026-07-16T21:13:57Z; branch codex/issue-310-websocket-driver; isolated worktree /Users/daveliu/Code/Run-MPRC.issue-310; exact released base fcb7f77cd1c26e28f785416249f7e80c5ba71757. Exact ownership: only the node_modules/websocket-driver identity record in package-lock.json; additive separately named SUPPLY-001D4 constants/helpers/tests in tests/root-dependency-security.test.js while preserving every #306 form-data/hasown hunk; and one separate SUPPLY-001D4/RISK-014 ledger row in SECURITY.md. package.json, workflows, artifact-contract tests, Functions/package locks/runtime/App/Rules/officer docs, Firebase/provider/deployment/data/live work, #307's three released paths, and every other hunk are excluded and immutable. Unique remote branch was pushed before this marker. Claim remains active through exact-main post-merge CI/deployment audit and explicit release.

[daliu]

RED proof — exact old lock/install

Recorded at 2026-07-16T21:15Z on exact released base fcb7f77cd1c26e28f785416249f7e80c5ba71757 after a clean Node 20.19.5/npm 10.8.2 lockfile install, with only the additive #310 test patch present. The lock and installed package remained untouched at websocket-driver@0.7.4.

Command:

node --test tests/root-dependency-security.test.js

Result: 4 pass / 2 intended fail.

• The identity regression found the old 0.7.4 registry URL/integrity instead of the reviewed 0.7.5 identity.
• The synthetic public-API hixie-75 driver successfully opened with maxLength: 1, received only three fixed bytes (80 81 81), and incorrectly remained open rather than closing when the parsed length exceeded the configured bound.
• Both existing SUPPLY-001D3 — Patch vulnerable form-data nodes in the root dependency tree #306 form-data tests and their two nested installed-copy cases passed unchanged.

Fresh audit baseline:

• full: 67 total — 13 low / 19 moderate / 32 high / 3 critical
• production-only: 7 total — 1 low / 2 moderate / 3 high / 1 critical
• both reports identify the sole node_modules/websocket-driver node as transitive and affected by GHSA-mp7j-qc5w-4988 and GHSA-xv26-6w52-cph6 below 0.7.5.

The regression uses only a synthetic request, tiny configured limit, and three fixed bytes. It made no Firebase/provider/production-data/network call and used no secret or real identity.

[daliu]

MAIN ADVANCE / PRESERVATION — 2026-07-16T21:45:20Z

Disjoint #311 / PR #312 merged first as exact main 8b204af. #310 must controlled-refresh onto this exact main before final exact-hash review/merge and preserve all four #311 paths byte-for-byte:

• .github/lint-baseline.json
• docs/officers/EVENTS_SHOP_MEMBERS.md
• src/App.test.jsx
• src/pages/admin/events/AdminEventEditor.tsx

#311 did not touch package-lock.json, tests/root-dependency-security.test.js, or SECURITY.md. Its claim remains held only through post-main CI/deployment audit, but the source merge is complete and exact-main CI run 29537183924 is queued. Please send the refreshed #310 head/diff evidence and eventual release SHA.

[daliu]

Main advanced after disjoint #313 merged/released.

• New exact main: bf69285c520614a4f8dd794e3601acff799a55db
• OAUTH-001A2C — Validate stored Strava connection metadata before secret or provider use #313 changed only functions/strava.js and functions/strava.test.js.
• Post-main CI 29538340213 passed all five jobs; deployments are empty.

Please refresh #310 from this exact main before final review/merge and preserve both Strava files. #313 has no overlap with the three #310 paths/hunks.