build(node): coordinate Node 22.22.2 floor with jsdom 30 - #896

Draft

seonghobae wants to merge 90 commits into

fix/node-22-22-2-jsdom-30-779

Commits on Aug 7, 2026

test(supply-chain): require deterministic npm lock generator
seonghobae
committed
4294ddc
fix(supply-chain): pin npm lock generator metadata
seonghobae
committed
afb20be
ci(supply-chain): prove npm version and lock reproduction
seonghobae
committed
e64c229
docs(supply-chain): record npm generator provenance
seonghobae
committed
ebbde9b
docs(changelog): record npm generator contract
seonghobae
committed
694ca83
fix(supply-chain): avoid serializing npm into runtime engines
seonghobae
committed
90dc2a0
test(supply-chain): keep npm enforcement out of runtime engines
seonghobae
committed
fecc36b
docs(supply-chain): separate npm generator from runtime engines
seonghobae
committed
9eb83c3
ci(supply-chain): publish deterministic lock reproduction evidence
seonghobae
committed
5609b88
test(supply-chain): require preserved lock reproduction evidence
seonghobae
committed
032314d
test(security): require coordinated PDF.js and Undici baseline
seonghobae
committed
0263ad4
test(security): disable PDF expression evaluation
seonghobae
committed
2cbf767
fix(security): pin the patched Undici transitive version
seonghobae
committed
475de96
fix(security): pin the patched PDF.js release
seonghobae
committed
deb74ac
fix(security): disable PDF expression evaluation
seonghobae
committed
dc90d5b
docs(security): record coordinated PDF and HTTP remediation
seonghobae
committed
b23b957
docs(changelog): record coordinated security remediation
seonghobae
committed
2e99f72
fix(security): anchor the Undici override to an exact root floor
seonghobae
committed
8f50fe4
test(security): bind exact root floor and npm package locations
seonghobae
committed
e2c0c2d
ci(pr783): import exact npm 10.9.8 lock artifact
seonghobae
committed
dd93f96
fix(score): align PDF.js boundary with 6.2.108 API
seonghobae
committed
dd8d1ac
test(score): prove the supported data-only PDF.js boundary
seonghobae
committed
988dc1d
docs(security): record the supported PDF.js 6.2.108 boundary
seonghobae
committed
a39e37f
docs(changelog): describe the supported patched PDF boundary
seonghobae
committed
6b753e6
ci(pr783): rerun lock import after supported API repair
seonghobae
committed
b773653
ci(pr783): publish the verified lock from the bounded importer
seonghobae
committed
01cb39e
ci(pr783): fetch complete lineage for verified lock publication
seonghobae
committed
ad558ac
fix(security): import verified npm 10.9.8 lock
github-actions[bot]
committed
83865dc
test(ci): preserve canonical npm provenance formatting
seonghobae
committed
e6b48ca
ci(pr783): diagnose Ruff import ordering
seonghobae
committed
3edf173
style(ci): normalize security test imports
seonghobae
committed
2345219
style(ci): normalize npm provenance test imports
seonghobae
committed
dc7e8b4
chore(ci): remove completed Ruff diagnostic
seonghobae
committed
c5ee630
ci(pr783): finalize exact Ruff formatting
seonghobae
committed
f0c9ad1
chore(ci): remove temporary branch writer
seonghobae
committed
102a89f
style(test): apply Ruff formatting to security contracts
seonghobae
committed
d4887ec
style(test): finish Ruff formatting for npm provenance
seonghobae
committed
459abdd

Commits on Aug 11, 2026

fix(security): refresh vulnerable npm transitive pins
seonghobae
committed
ace4257
fix(deps): restore manifest-lock consistency
seonghobae
committed
63d0ae6

Commits on Aug 14, 2026

ci: add one-shot canonical lock repair for PR 783
seonghobae
committed
6bba612
fix(deps): regenerate canonical npm 10.9.8 lock
github-actions[bot]
committed
ef938fa
ci: retrigger exact-head validation after canonical lock generation
seonghobae
committed
a48ff96
ci: add one-shot Ruff formatter for PR 783
seonghobae
committed
fd9389a
style(test): apply canonical Ruff formatting
github-actions[bot]
committed
afba132
ci: retrigger exact-head validation after canonical Ruff formatting
seonghobae
committed
e214e96
fix(test): verify canonical hoisted PDF.js lock record
seonghobae
committed
0cd6836
ci: add final one-shot Ruff formatter for PR 783
seonghobae
committed
f4a5a19
style(test): apply final canonical Ruff formatting
github-actions[bot]
committed
219267e
chore(ci): retrigger exact-head protected checks
seonghobae
committed
db7b1c1
fix(ci): validate npm lock without mutable resolution
seonghobae
committed
f4d8850
test(supply-chain): format npm toolchain contract
seonghobae
committed
8a143ab
test(supply-chain): satisfy ruff formatting gate
seonghobae
committed
b3ac826
test(supply-chain): format npm toolchain contract
seonghobae
committed
885c037
test(supply-chain): apply repository Ruff width
seonghobae
committed
de0cd6b
docs(security): align npm lock provenance with frozen validation
seonghobae
committed
f3cfae4
fix(ci): disable persisted checkout credentials
seonghobae
committed
de75178
docs(changelog): correct UI test coverage claim
seonghobae
committed
164e6f2

Commits on Aug 15, 2026

test(lock): reject esbuild peer metadata drift
seonghobae
committed
07c1dd2
docs(lock): record esbuild metadata sentinel
seonghobae
committed
ad4551b
docs(changelog): record lock metadata drift gate
seonghobae
committed
6f81f52
fix(security): make PDF XML boundary explicit
seonghobae
committed
6665f02
test(security): lock down PDF parser options
seonghobae
committed
bf5a3a3
docs(security): record PDF parser hardening evidence
seonghobae
committed
c65f5b1
docs(security): correct PDF.js advisory attribution
seonghobae
committed
dae5d3c

Commits on Aug 17, 2026

test(build): require coordinated Node 22.22.2 and jsdom 30 floor
seonghobae
committed
afdecc5
test(build): align Node floor contract with canonical npm generator
seonghobae
committed
1dbe037
merge: stack Node compatibility migration on dependency baseline
seonghobae
committed
66c97c2
build(node): raise supported Node 22 floor
seonghobae
committed
32cf47c
build(deps-dev): adopt jsdom 30 on coordinated Node floor
seonghobae
committed
f74beb0
docs(build): publish Node 22.22.2 minimum
seonghobae
committed
2affed5
test(build): align npm provenance with Node compatibility floor
seonghobae
committed
65d199d
test(build): require explicit minimum-Node npm bootstrap lane
seonghobae
committed
c721cee
ci(build): add exact Node 22.22.2 compatibility lane
seonghobae
committed
fcb0b27
test(build): audit canonical runtime documentation paths
seonghobae
committed
aa527bb
test(ci): prevent pre-bootstrap npm cache discovery
seonghobae
committed
5b50c59
fix(ci): bootstrap canonical npm before cache discovery
seonghobae
committed
783112b
docs(build): reconcile Node floor with npm generator provenance
seonghobae
committed
e004765
test(ci): require setup-node automatic cache opt-out
seonghobae
committed
b3a3c91
fix(ci): disable setup-node auto cache before npm bootstrap
seonghobae
committed
feb4136
test(node): require Corepack npm bootstrap and lock provenance
seonghobae
committed
a256606
fix(node): harden npm bootstrap and capture lock provenance
seonghobae
committed
9eb5c10
test(node): assert direct workspace jsdom resolution
seonghobae
committed
6f5d1e4
fix(ci): keep Node floor lane frozen-install only
seonghobae
committed
0766cdb
fix(ci): satisfy workflow supply-chain baseline
seonghobae
committed
8596bd1

Commits on Aug 18, 2026

Commits on Aug 29, 2026

Commits on Sep 4, 2026

chore(node): restack npm compatibility owner on protected develop
seonghobae
committed
fc3d1ec