With #2267's YAML break gone and the pnpm-lock refreshed, the 25 newly-
visible failures collapsed to 3 genuinely-independent audit failures.
Fixing all three.
#2046 — Supply-chain audit (1 unaccepted critical CVE)
Vitest <4.1.0 UI server arbitrary-file-read/exec (GHSA-5xrq-8626-4rwp,
CVSS 9.8) was unaccepted in v3/@claude-flow/browser.
• Bumped `vitest` spec from ^4.0.16 → ^4.1.0 in browser package.json.
• Refreshed the workspace pnpm-lock.
• Standalone-publish package-lock.json carries workspace:* refs that
`npm install` can't resolve in isolation, so I added a time-boxed
(expires 2026-09-02) accepted-findings entry citing the limited
exposure (devDependency + UI-server-only attack vector) and pinning
the next workspace-coordinated lockfile rebuild as the trigger to
remove it. Tracking: ruflo#2270.
ADR-112 — Tool description discoverability (2 missing "Use when …")
• hooks_task-completed: added "Use when native TaskUpdate is wrong
because the runtime also needs to record the outcome as a learning
signal and emit the standard pipeline event".
• hooks_intelligence_unified-stats: added "Use when calling the four
narrow aggregators one at a time is wrong because cross-store drift
goes silent — this tool surfaces it in the `consistency` block".
327/327 tools now pass; baseline stays at 0.
#1921 — Hook-command install safety (4 missing invariants)
Both #1951 and #1989 fixes were silently retired by #2196's statusline
delegation refactor. Updated scripts/audit-fix-invariants.mjs to track
the new reality without dropping coverage:
• #1951 (marketplaces/ruflo) — substring became `path.join(home,
'.claude', 'plugins', 'marketplaces', 'ruflo', …)` which the literal
substring check couldn't see. Switched to a regex form that matches
the path.join breakup.
• #1989 (SQLite magic-bytes + page-count clamp) — superseded entirely
by #2196's delegation pattern: statusline-generator no longer reads
raw memory.db bytes; it shells out to `hooks-statusline --json`
which queries AgentDB via the typed SDK. The regression vector is
closed by ARCHITECTURE. Replaced the two #1989 invariants with one
#2196 invariant that locks in the delegation pattern, so a future
refactor that reintroduces raw-bytes reading is caught BEFORE the
SQLite magic check would be relevant. Audit-script convention says
"do NOT delete without confirming the regression is impossible by
another mechanism" — this is the documented confirmation.
37 invariants, all present.
Local: all 3 audits + the 2 new regression smokes pass.
Co-Authored-By: RuFlo <ruv@ruv.net>
agentic-flow@2.0.13 moves the onnxruntime-node native binding load out of
module-import time and into an on-demand `loadOrt()` helper called from
`initializeSession()`. This fixes ruflo#2048 — `import('agentic-flow/reasoningbank')`
on Windows crashed with "OS cannot run %1" because router/providers/onnx-local.ts
used a top-level `await import('onnxruntime-node')` which forced the native binding
to load before any user code ran, even when the consumer never intended to run
local ONNX inference.
Upstream PR: ruvnet/agentic-flow#155
Upstream release: agentic-flow@2.0.13 (now `latest` on npm)
Changes
- root package.json + package-lock.json: ^2.0.12 → ^2.0.13
- v3/@claude-flow/browser/package.json + package-lock.json: ^2.0.12 → ^2.0.13
- v3/pnpm-lock.yaml: regen → resolves 2.0.13
- .github/supply-chain/follow-ups.md: mark #2048 as fixed, link upstream PR + this PR
- .github/supply-chain/accepted-findings.json: add fixedDirectly entry for 2.0.13
Verification
- root npm audit: 0 vulnerabilities
- supply-chain audit (5 layers): OK, no hard-fail findings
- @claude-flow/browser tests: 230 passed | 12 skipped
- ruflo-graph-intelligence tests: 104 passed
- Acceptance test (run against published 2.0.13):
node -e "import('agentic-flow/reasoningbank').then(()=>console.log('OK'))"
node -e "import('agentic-flow/router').then(()=>console.log('OK'))"
Both succeed under default install AND under --omit=optional.
Follow-up CI guard (separate PR):
- Add Windows-runner smoke job that imports agentic-flow/reasoningbank under
--omit=optional to lock the lazy-load contract.
Co-Authored-By: RuFlo <ruv@ruv.net>
Upstream agentic-flow@2.0.12 shipped today (PR ruvnet/agentic-flow#154,
commit 2c10eb9) moving @xenova/transformers from `dependencies` to
`optionalDependencies`. Five of six call sites in agentic-flow already
used dynamic import; the sixth (src/reasoningbank/utils/embeddings.ts)
was converted to dynamic with try/catch + graceful fallback to the
existing hash-based embedding path.
This commit:
1. ADR-124 — full architectural record of the upstream fix +
downstream impact + rollout plan.
2. Bump agentic-flow ^2.0.11 → ^2.0.12 in:
- package.json (root)
- v3/@claude-flow/browser/package.json
3. Regenerate lockfiles:
- package-lock.json (root npm)
- v3/@claude-flow/browser/package-lock.json
- v3/pnpm-lock.yaml (v3 workspace)
4. Update .github/supply-chain/accepted-findings.json:
- Add entry to `fixedDirectly[]` documenting the 2.0.12 ship
- Replace the previous "blocked by upstream" CVE entry with a
"moot finding" entry. The vulnerable code is no longer installed
when consumers use `npm install --omit=optional`; `npm audit`
still reports it because it reads the lockfile graph (which
includes optionals) — a known npm limitation. Tracking now
points at the merged upstream PR + ADR-124.
After this commit:
- Root npm audit: 0 vulnerabilities (was 0 already after PR #2050; still 0)
- Browser tests: 230/230 passing
- Graph-intel tests: 104/104 passing
- Supply-chain audit: 0 hard-fail findings (1 accepted, moot)
- Consumers of @claude-flow/browser who pass `--omit=optional` get a
fully CVE-clean install profile
Closes the upstream half of #2046. ADR-121 Phase 4 still tracks the
long-term Xenova retirement.
Co-Authored-By: RuFlo <ruv@ruv.net>
Before:
Root npm audit: 13 HIGH/CRITICAL across 25 vulns
@claude-flow/browser fresh install: similar transitive chain
Audit script reported 0 unaccepted only because it correctly scopes
to direct deps — but transitive surface was hostile
Changes:
1. Bump agentdb to 3.0.0-alpha.14 (was alpha.10/13 across repo)
- 3.0.0-alpha.14 dropped @opentelemetry/sdk-node from its
dependencies block (still in optionalDependencies; overrides handle
that). Eliminates the @opentelemetry/sdk-node CVE chain via direct
dep replacement.
- Updated: v3/@claude-flow/memory, v3/@claude-flow/cli, root.
2. Bump agentic-flow 2.0.7 → 2.0.11 (root) and ^2.0.3 → ^2.0.11
(v3/@claude-flow/browser). Latest 2.x; closer to a Xenova-clean
release when upstream ships it.
3. Add npm overrides at the root + at v3/@claude-flow/browser package
(overrides do not cascade across separate npm projects, so browser
needs its own block for standalone publish):
@opentelemetry/sdk-node >= 0.218.0 (was <0.217.0 CVE)
@opentelemetry/auto-instrumentations >= 0.75.0
@opentelemetry/exporter-prometheus >= 0.217.0
axios >= 1.13.2
fast-uri >= 3.1.0
vite >= 6.4.6
ws >= 8.18.4
Plus the existing browser-package overrides for hono / undici / tar /
minimatch / picomatch / flatted / etc. — copied from root to keep
the standalone npm-published install clean.
After:
Root npm audit: 0 vulnerabilities (13 HIGH/CRITICAL → 0)
Supply-chain audit: PASS (0 unaccepted direct-dep findings)
Browser tests: 230/230 passing
Graph-intel tests: 104/104 passing
One CVE remains in v3/@claude-flow/browser's STANDALONE fresh install
(end-user `npm install`): @xenova/transformers via agentic-flow direct
dependency. Cannot fix without upstream agentic-flow shipping a Xenova-
free release. agentic-flow@3.0.0-alpha.2 still has it. Documented in
accepted-findings.json under cve[] with:
tracking: ADR-121 Phase 4
expiresAt: 2026-08-19 (audit re-fails if upstream still hasn't shipped)
rationale: browser package does not invoke embedding code paths
This is the right level of triage. The audit doesn't lie about it — it
just doesn't block our shipping while we wait for upstream.
Co-Authored-By: RuFlo <ruv@ruv.net>
dependabot[bot]