EPBDS-16211: a security model and policy, a weekly audit of the bundled packages, and CI that keeps every master run

[AlexSamBY]

What

The security and CI items of the 2026-10-08 audit.

What a meta can do, written down

The README gains a Security model section. Each claim in it was checked against the code, and the two strongest also in a test run:

• A meta can render raw HTML. A Text node given dangerouslySetInnerHTML: {__html: '<b id="raw">raw</b>'} puts <b id="raw"> in the page: through the published entry, in jsdom, it was found by id. No URL scheme is checked in an attribute a meta sets.
• A meta can call fetch. With mapArgs, the built-in fetch action calls the page's fetch with exactly the URL the meta names. With a stand-in fetch, the call arrived as ["https://example.test/mapped"]. With args, the click event goes first.
• A data value is text, escaped by React, unless a meta binds it to an attribute with {name: 'path'}.
• Upload checks run in the browser only. formats and maxSize filter in the browser, and uploadFile receives the files as chosen.
• Downloads come from the host's downloadFile. The renderer only saves what that function answers.

SECURITY.md says how to report a vulnerability and what is in scope: anything a data value can do, the published package and what it bundles, the stylesheet leaving .ui-render, and the build and CI. What a meta may do is out of scope.

Before this merges, private vulnerability reporting needs turning on. SECURITY.md points reporters at it, and gh api repos/eisgroup/ui-render/private-vulnerability-reporting answers {"enabled":false}. It is under Settings → Code security. The same API shows Dependabot security updates, secret scanning and push protection off too. Those are repository settings, so they are not changed here.

The bundled packages, audited every week

npm run audit:bundled (scripts/audit-bundled.js) runs npm audit and keeps only the findings on the packages dist/sbom.cdx.json lists, at the version the bundle carries. That matters because:

• dependencies is empty, so npm audit --omit=dev audits nothing;
• a full npm audit reports the development tree.

It fails on a finding at moderate or above. .github/workflows/audit-bundled.yml runs it on Mondays and on demand, not on pull requests, so a new advisory cannot turn an unrelated change red.

CI

• cancel-in-progress applies to pull requests only. On master each push cancelled the run before it: on 2026-10-09 four PRs merged within a minute, and three of those master commits never finished a run (EPBDS-16211: the published package is driven in a browser on React 16.14, 17 and 19 too #200's 24a0900, EPBDS-16211: validateMeta finds the props a 0.34 host lost, and the meta contract agrees with the renderer on more shapes #201's 0fa9296, EPBDS-16211: unset refuses prototype paths, and a select with no label has an accessible name #202's a506f0b).

• Every action is pinned to a commit, the one its major tag points to (checked again on 2026-10-12), with the release in a trailing comment:

  • checkout v7.0.1, setup-node v7.1.0, cache v6.1.0, upload-artifact v7.0.2;
  • 19 uses in ci.yml and 2 in the new workflow.

  Dependabot updates the commit and the comment together; GitHub documents this.

Measured

• npm run audit:bundled on this branch: "npm audit: 36 finding(s) in the installed tree; 19 package(s) bundled, 0 of them with a finding.", exit 0. The plan's Appendix B now records 36, which it last counted as 35 on 2026-10-06.
• scripts/__tests__/audit-bundled.contract.test.js, 4 tests, covering:
  • a finding on a bundled package at the bundled version is kept;
  • a vulnerable copy at another version, and an unbundled package, are not;
  • npm's severity order.
• The workflows parse. ci.yml has 7 jobs, and cancel-in-progress reads ${{ github.event_name == 'pull_request' }}.
• Local gates on HEAD, all exit 0. That is all 22 gates plus the manifest contract, on Node 24.14.0.

🤖 Generated with Claude Code