fix(packs): cover all five bundled advisories in the publishing pack's security note - #131

What and why

The publishing pack's shipped adoptNotes security note (dated 2026-10-01) named only undici, ip-address and brace-expansion. Since then two more advisories opened against packages bundled inside the pinned npm (see #129), so the note shipped to every pack user was incomplete, and its "bump as soon as a release bundling..." criterion would not have caught them. This rewrites it to cover all five, dated 2026-10-08, and ships as a patch changeset (it is shipped output).

• Two packages added: postcss-selector-parser 7.1.4 is called only by npm query and npm sbom (neither runs in the release flow), and http-cache-semantics 4.2.0 sits behind make-fetch-happen's private (shared: false) cache. Both statements were verified against the unpacked npm 12.2.0 and 11.20.0 tarballs, including every new CacheSemantics call site.
• Criterion: now includes postcss-selector-parser >= 7.1.6 and names the open upstream fixes deps: resolve production audit vulnerabilities npm/cli#10088 (12.x) and #10089 (11.x backport), both open and unmerged as of 2026-10-08.
• http-cache-semantics has no fixed release: 4.3.0 is outside the advisory's range, but upstream closed the report as not planned (Security Advisory: max-stale request directive overrides shared-cache reuse prohibitions (Set-Cookie, proxy-revalidate) kornelski/http-cache-semantics#56) and the advisory is disputed in GHSA-ch52-4w7c-c8xp (CVE-2026-93748) claim of bogus report by repo owner github/advisory-database#10139, so a bump past 4.2.0 only clears the alert. The note says so.
• docs/security-review.md records the same, adds the upstream PRs to the "upstream fix in progress" row, adds the re-check signal (a new npm release after #10088 or #10089 merges), and notes that the open release PR chore: release 12.2.1 npm/cli#10060 (12.2.1) carries only the #9941 bug fix and none of the five bumps.

No files/, budget, wiring, setupSteps or modes change. The adoptNotes-vs-setupSteps drift guard still holds (the four setup commands are untouched).

Review

baseline-impact-reviewer found nothing must-fix (structural contracts, no test asserts on the note text, no length limit on adoptNotes); one nit, naming 4.3.0 in the note, is applied. A code-reviewer fact-checked every claim in the shipped text against primary sources and found all verified. I re-checked the two upstream PRs and #10060 myself.

Verified locally: pnpm typecheck, lint, test, format:check and the docs-site and license-header checks pass via the pre-push hook. e2e runs in CI.

Checklist

• pnpm verify passes (the pre-push hook ran build, typecheck, format, test and lint)
• pnpm test:e2e passes (not run locally: no packages/cli/src/ or templates/core/ change, one adoptNotes string in a pack; CI runs it)
• Every commit is signed off (DCO, git commit -s) and GPG-signed
• New functionality has tests (n/a: wording of a shipped note; the existing drift guard covers it)
• A changeset is included (patch)
• Baseline caps still hold (n/a)
• A new file under templates/core/ is claimed by domain-map.ts (n/a)
• A new tracked file outside templates/** carries an SPDX header (n/a)

🤖 Generated with Claude Code