[Helweg]

DRAFT SECURITY FIX — v0.38.0 TAG/PUBLICATION HOLD REMAINS. This narrow four-file security fix may be considered for independent landing after exact-head CI and independent acceptance of current consumer-byte custody. That separate disposition does not clear the failed local full source suite, waive the watcher failure, or authorize merging this draft or publishing v0.38.0.

Security change and exact scope

Addresses GHSA-rxp7-6hxx-x8q5 / CVE-2026-111997: quadratic-time IPv6 zone-identifier parsing in ip-address versions through 10.7.3; the first fixed version is 10.7.4.

Exactly four files change at head ef5205ecb339d151ddef2a7dbb9adbb329e64ca5, based on 38cfa07489bea9433db3c1450702ada29fdd69c2:

• package.json: change the qualified root override from ip-address@>=10.0.0 <10.7.1 → ^10.7.1 to ip-address@>=10.0.0 <10.7.4 → ^10.7.4.
• package-lock.json: update only the existing node_modules/ip-address version, resolved tarball URL, and integrity from 10.7.1 to 10.7.4. Other dependency resolutions and lock metadata remain unchanged.
• SECURITY.md: update that override/floor and add the advisory while retaining existing advisory coverage and supported-version policy.
• CHANGELOG.md: document the security fix under dated 0.38.0; retain empty Unreleased and the existing release entries.

No SDK version, dependency-parent range, Node.js minimum, engine, watcher, Rust, or public API changes. The package version remains 0.38.0. Root overrides govern this repository's installs; they are not a promise of transitive override enforcement in consumer projects.

Exact-head CI

19/19 checks succeeded for the head above; CI run 39910648465. Linux ran full tests on Node.js 22 and 24. macOS and Windows CI coverage was limited to path/capability/benchmark checks, not the full source suite. These results do not resolve or replace the recorded local macOS full-suite failure below.

Observed consumer-only proof

A single completed consumer-only run passed four fresh cells: both open-codebase-index and compatibility identity opencode-codebase-index, each on Node.js 22.13.0 and 26.9.0. Normal scripts-enabled, engine-strict installs were used.

• TypeScript .mts/.cts checks and ESM/CJS runtime export contracts passed.
• Every declared CLI alias, actual native structural parsing/search, MCP transports, and controlled GitHub-history fixture scenarios passed. cbi/ocbi were exercised as CLI aliases, not MCP transports.
• All 35 current artifacts per identity were checked in archives and installed consumers: 34 dist files plus the native binding. Installed physical manifests confirmed ip-address 10.7.4 in every cell. Each consumer production audit reported zero vulnerabilities.
• History proof used a controlled subprocess fixture, including cancellation, revalidation, denial and deletion behavior; it was not live GitHub API proof.

Consumer receipt SHA-256: aa890c984643f69b0f93e773229791d4da5ed17d1b6f2eebb36e785b64ee7133.
Executed consumer harness SHA-256: e07e78a7aaebf3dfb9be64aa43a6bfce92960cde62edc27d19aa54c53daef06f.

This is local staged-consumer evidence, subject to independent current-byte custody acceptance before security-fix landing. It is not published-package, provenance, live-GitHub, or cross-platform-native runtime qualification; only the local Darwin ARM64 native binding was executed.

Unresolved local source failure and release hold

The actual local macOS full source suite remains 2,890 passed, 1 failed, 6 skipped. Failure: tests/include-excluded-paths-indexing.test.ts:599, “preserves the default Chokidar rejection of root build-named file changes”: the updated ordinary definition was not observed within 20 seconds. Cause UNKNOWN. There has been no suite rerun, skip, timeout change, assertion weakening, or watcher fix. This is not characterized as a flake.

The original failed-v4 native bytes were lost; only their historical SHA-256 ec1e17fd6b905cb7fc448e5ed62def661cc2a33f3846a92d7a50f076cf630db3 remains. Current consumer proof used the separately rebuilt and preserved native artifact 9fab5657ad1e7ae61f1e29531e7d478a6fe5545f0142a875052e2c8fb5e202d4, not that lost artifact. No preserved-original-native claim is made.

Disposition: the narrow security fix may land separately only after its explicit merge gate, including independent current consumer-byte custody acceptance. Successful CI and consumer proof do not clear the watcher failure. v0.38.0 tagging and publication remain on HOLD.