From db5ae3c33d0fe21b93bc4e353e8a9e94ee2d2ada Mon Sep 17 00:00:00 2001 From: Juri Date: Fri, 18 Sep 2026 17:22:09 +0200 Subject: [PATCH] docs(dependencies): clarify socket.yml is registry-side scan, not CI gate (#12664) * docs(dependencies): clarify socket.yml is registry-side scan, not CI gate * docs(dependencies): add changelog fragment for socket.yml scope note Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> --------- Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> --- SECURITY.md | 2 ++ changelog.d/maintenance/12664-socket-yml-scope-note.md | 3 +++ docs/security/SOCKET_DEV_FINDINGS.md | 2 ++ socket.yml | 6 ++++++ 4 files changed, 13 insertions(+) create mode 100644 changelog.d/maintenance/12664-socket-yml-scope-note.md diff --git a/SECURITY.md b/SECURITY.md index ed22819804..259dd6c073 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -218,6 +218,8 @@ These rules are enforced by tooling and reviewers: ## Supply-chain scanner findings (Socket.dev / Snyk / similar) +> **Scope note:** `socket.yml` at the repository root only shapes `projectIgnorePaths` for Socket.dev's registry-side post-publish scan of the published npm artifact — it is not an enforced CI/PR merge gate. No workflow in `.github/workflows`, no `package.json` script, and no `Makefile` target invokes Socket.dev. + The published `omniroute` npm artifact bundles the Next.js `output: "standalone"` build, which means every route handler — including documented privileged features (MITM, Zed import, Cloud Sync, embedded service supervisor) — ends diff --git a/changelog.d/maintenance/12664-socket-yml-scope-note.md b/changelog.d/maintenance/12664-socket-yml-scope-note.md new file mode 100644 index 0000000000..20f94ccd26 --- /dev/null +++ b/changelog.d/maintenance/12664-socket-yml-scope-note.md @@ -0,0 +1,3 @@ +- **docs(dependencies):** clarify that `socket.yml` only shapes Socket.dev's registry-side + post-publish scan of the published npm artifact — it is not an enforced CI/PR merge gate + ([#12664](https://github.com/diegosouzapw/OmniRoute/pull/12664) — thanks @toor11). diff --git a/docs/security/SOCKET_DEV_FINDINGS.md b/docs/security/SOCKET_DEV_FINDINGS.md index 54f3594770..67d8cc7bca 100644 --- a/docs/security/SOCKET_DEV_FINDINGS.md +++ b/docs/security/SOCKET_DEV_FINDINGS.md @@ -5,6 +5,8 @@ description: "Maintainer attestation for the AI-detected potential-malware findi # Socket.dev / supply-chain finding attestation +> **Scope note:** `socket.yml` configures Socket.dev's registry-side post-publish scan of the npm artifact (ignore-paths for non-shipped content such as `tests/`, `docs/`, and build reports). It does not wire a CI/PR merge gate — no workflow in `.github/workflows`, no `package.json` script, and no `Makefile` target invokes Socket.dev. + This document is the maintainer-authored attestation for the six `AI-detected potential malware` findings raised against `omniroute@3.8.5` and the mitigations applied in `omniroute@3.8.6`. It exists so: diff --git a/socket.yml b/socket.yml index c7ac12b80f..4be0741763 100644 --- a/socket.yml +++ b/socket.yml @@ -1,6 +1,12 @@ # Socket.dev / Socket GitHub app configuration. # Documentation: https://docs.socket.dev/docs/socket-yml # +# NOTE: This file does NOT enforce a CI/PR gate. No workflow in +# .github/workflows, no package.json script, and no Makefile target invokes +# Socket.dev. It only shapes `projectIgnorePaths` for Socket's registry-side +# post-publish scan of the published npm artifact (see +# docs/security/SOCKET_DEV_FINDINGS.md). +# # OmniRoute bundles privileged opt-in features (MITM proxy, Zed credential # import, embedded service supervisor, Cloud Sync) inside the Next.js # standalone build output. The v3.8.6 release applies in-tree mitigations for