meta: harden dependency supply chain by ovflowd · Pull Request #1178 · nodejs/doc-kit

ovflowd · 2026-10-25T15:46:58Z

Description

This PR hardens doc-kit's dependency supply chain, following an audit of every lockfile entry (release age, security policies, OpenSSF Scorecard, trusted publishing and advisories):

pnpm workspace:
- minimumReleaseAge: 4320 (3 days), below Dependabot's 7-day cooldown, so its version bumps always clear it. @node-core/* is excluded, since the Node.js website team publishes those and maintains doc-kit too.
- trustPolicy: no-downgrade refuses a release whose publishing evidence is weaker than an earlier release of the same package (trusted publishing → token, provenance → none). No lockfile entry has that today, so it costs nothing.
- ignoredOptionalDependencies skips @napi-rs/nice, piscina's optional thread-priority binding (one native binary per platform). doc-kit never sets niceIncrement, so it's never loaded.
- Drops the stale unrs-resolver build entry.
Advisories: bumps wrangler to 4.151.1 (pulls sharp 0.35.5) and refreshes zod and brace-expansion. pnpm update --depth Infinity won't move brace-expansion off 5.0.9, so its lock entry was reset instead.
Fewer runtime deps: cosmiconfig v10 drops 12 packages (it needs Node.js ^22.18 || >=24, which matches .nvmrc), dedent moves to @doc-kit/core's devDependencies since only a test uses it, and reading-time is replaced by Intl.Segmenter. @node-core/ui-components 1.8.1 also stops installing @vcarl/remark-headings (nodejs/nodejs.org#9235), which takes it and the old mdast/unist utilities it pulled in (@types/mdast@3, mdast-util-to-string@3, unist-util-is@5, unist-util-visit@4, unist-util-visit-parents@5) out of the tree.
piscina: recordTiming: false, since nothing reads the pool's histograms. The other fast paths (sync atomics, one task per worker) are already piscina's defaults, see the benchmark below.
Dependency Review: harden-runner was blocking api.securityscorecards.dev, so every Scorecard score printed as undefined (this run logs domain not allowed).
Shared setup action: bumps nodejs/web-team/actions/setup-environment to its current main in every workflow. We were pinned to a version that persisted the checkout token, which matters most in the publish job (it holds id-token: write). Letting the publish job skip the Actions cache is up in nodejs/web-team#192.

Overall the lockfile goes from 673 to 637 entries (376 → 339 reachable at runtime). Together with #1175, #1176 and #1177, pnpm audit goes from 17 to 3 advisories, all in undici 7, which miniflare pins exactly and has no fix yet.

Validation

pnpm install --frozen-lockfile passes pnpm's supply-chain verification (also merged with current main), and node --run test (747/747), node --run lint and node --run format:check are clean.
Reading time: an html build of path.md with showReadingTime shows the same "8 min read" as main, and on the Node.js API docs the word count stays within ~3% of reading-time. CJK characters still count as one word each.
piscina: medians of 6 interleaved runs per variant over nodejs/node's doc/api (70 files, 4 threads):

Variant	`json`	`legacy-html`	`web`	Peak RSS (`web`)
`main`	2.59s	4.32s	7.09s	2420 MB
`recordTiming: false`	±0%	+0.2%	+0.7%	−0.4%
`FixedQueue`	−1.2%	+0.1%	+1.3%	−0.3%
`idleTimeout: 2000`	−1.9%	+1.4%	−0.2%	+20.3%

Everything is within noise: each task is a chunk that runs for seconds, so per-task overhead doesn't show. A longer idleTimeout only costs memory, so the 250ms one stays.

Note

Dependabot security updates skip its cooldown, so with the 3-day gate a brand-new fix keeps failing the frozen install until it's 3 days old.

Related Issues

Follow-ups outside this PR: making Dependency Review a required check, and a nodejs/admin request for the Socket GitHub App.

Check List

I have read the Contributing Guidelines and made commit messages that follow the guideline.
I have run node --run test and all tests passed.
I have check code formatting with node --run format:check & node --run lint.
I've covered new added functionality with unit tests if necessary.

Enforce a 7-day minimum release age (matching Dependabot's cooldown), refuse releases whose publishing evidence drops below an earlier release's (`trustPolicy: no-downgrade`), and skip piscina's optional `@napi-rs/nice` binaries, which doc-kit never loads. Also drops the stale `unrs-resolver` build entry, bumps wrangler to 4.151.1 (pulls sharp 0.35.5), and refreshes zod and brace-expansion past their advisories. Assisted-by: Claude Opus 5.5 <noreply@anthropic.com>

Update cosmiconfig to v10, which drops parse-json, import-fresh, the typescript peer and the @babel/code-frame chain (12 packages). v10 needs Node.js ^22.18 || >=24, matching `.nvmrc`. Move `dedent` to `@doc-kit/core`'s devDependencies, since only a test uses it there, and replace `reading-time` with `Intl.Segmenter`. CJK characters still count as one word each, and rendered pages show the same estimates. Assisted-by: Claude Opus 5.5 <noreply@anthropic.com>

Nothing reads the pool's run/wait histograms. The other fast paths are already piscina's defaults (sync atomics, one task per worker, no per-worker histograms). Benchmarked against `json`, `legacy-html` and `web` with FixedQueue and a longer idleTimeout too: everything is within noise, and idleTimeout 2000 costs +20% peak RSS on `web`, so the 250ms timeout stays. Assisted-by: Claude Opus 5.5 <noreply@anthropic.com>

harden-runner blocked api.securityscorecards.dev, so the action logged "domain not allowed" and printed every OpenSSF Scorecard score as undefined. Also gives api.deps.dev its port like the other entries. Assisted-by: Claude Opus 5.5 <noreply@anthropic.com>

Inline the setup steps instead of using the shared setup-environment action, which persists the checkout token and restores the pnpm store from the Actions cache in a job that holds `id-token: write`. changesets/action pushes commits and tags through the GitHub API, so the job doesn't need the checkout token. Assisted-by: Claude Opus 5.5 <noreply@anthropic.com>

vercel · 2026-10-25T15:47:04Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
api-docs-tooling	Ready	Preview	Oct 26, 2026 1:55am UTC

cloudflare-workers-and-pages · 2026-10-25T15:47:52Z

🚀 Deploying Preview to Cloudflare 🚀

Preview Deployments by commit

Status	Deployment URL	Commit	Updated (UTC)	See this deployment's details
Build: Success ✅ View logs ↗	No Preview URL. Enable ↗	`b109674`	2026-10-26T01:55:32.723Z	View logs ↗
Build: Success ✅ View logs ↗	No Preview URL. Enable ↗	`7808e92`	2026-10-26T01:26:49.720Z	View logs ↗
Build: Success ✅ View logs ↗	No Preview URL. Enable ↗	`d578663`	2026-10-25T21:59:40.886Z	View logs ↗
Build: Success ✅ View logs ↗	No Preview URL. Enable ↗	`a273f0e`	2026-10-25T17:10:40.704Z	View logs ↗
Build: Success ✅ View logs ↗	No Preview URL. Enable ↗	`de85063`	2026-10-25T17:08:25.767Z	View logs ↗
Build: Success ✅ View logs ↗	No Preview URL. Enable ↗	`c7209db`	2026-10-25T17:00:11.919Z	View logs ↗
Build: Success ✅ View logs ↗	No Preview URL. Enable ↗	`fb2594b`	2026-10-25T16:48:43.380Z	View logs ↗
Build: Success ✅ View logs ↗	No Preview URL. Enable ↗	`62f77e2`	2026-10-25T16:41:26.527Z	View logs ↗
Build: Success ✅ View logs ↗	No Preview URL. Enable ↗	`a1648ee`	2026-10-25T15:47:37.140Z	View logs ↗

codecov · 2026-10-25T15:48:04Z

Codecov Report

❌ Patch coverage is 58.33333% with 10 lines in your changes missing coverage. Please review.
✅ Project coverage is 93.41%. Comparing base (6cde79d) to head (b109674).
⚠️ Report is 3 commits behind head on main.

Files with missing lines	Patch %	Lines
packages/react/src/jsx-ast/utils/buildContent.mjs	41.17%	10 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1178      +/-   ##
==========================================
- Coverage   93.44%   93.41%   -0.03%     
==========================================
  Files         278      278              
  Lines       27820    27840      +20     
  Branches     2790     2790              
==========================================
+ Hits        25997    26008      +11     
- Misses       1801     1810       +9     
  Partials       22       22

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

github-actions · 2026-10-25T15:48:35Z