fix(security): establish canonical npm, PDF.js, Nanoid, and Undici baseline

.github/workflows/build-baseline.yml

@@ -39,7 +39,7 @@ jobs:
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: 22.22.3
-          cache: npm
+          package-manager-cache: false
       - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: "3.12"
@@ -90,6 +90,10 @@ jobs:
           }
 
           Write-AntivirusEvidence "Antivirus check: no explicit antivirus telemetry was available on this hosted runner."
+      - name: Activate and verify pinned npm runtime
+        run: |
+          corepack enable npm
+          npm run check:npm-runtime
       - name: Install node dependencies
         run: npm ci
       - name: Sync Python dependencies
@@ -134,7 +138,7 @@ jobs:
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: 22.22.3
-          cache: npm
+          package-manager-cache: false
       - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: "3.12"
@@ -185,6 +189,10 @@ jobs:
           }
 
           Write-AntivirusEvidence "Antivirus check: no explicit antivirus telemetry was available on this hosted runner."
+      - name: Activate and verify pinned npm runtime
+        run: |
+          corepack enable npm
+          npm run check:npm-runtime
       - name: Install node dependencies
         run: npm ci
       - name: Sync Python dependencies
@@ -240,7 +248,7 @@ jobs:
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: 22.22.3
-          cache: npm
+          package-manager-cache: false
       - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: "3.12"
@@ -254,6 +262,10 @@ jobs:
         run: rustup target add "$BANDSCOPE_TARGET_TRIPLE" --toolchain stable
       - name: Install create-dmg
         run: brew install create-dmg
+      - name: Activate and verify pinned npm runtime
+        run: |
+          corepack enable npm
+          npm run check:npm-runtime
       - name: Install node dependencies
         run: npm ci
       - name: Sync Python dependencies
@@ -298,7 +310,7 @@ jobs:
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: 22.22.3
-          cache: npm
+          package-manager-cache: false
       - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: "3.12"
@@ -312,6 +324,10 @@ jobs:
         run: rustup target add "$BANDSCOPE_TARGET_TRIPLE" --toolchain stable
       - name: Install create-dmg
         run: brew install create-dmg
+      - name: Activate and verify pinned npm runtime
+        run: |
+          corepack enable npm
+          npm run check:npm-runtime
       - name: Install node dependencies
         run: npm ci
       - name: Sync Python dependencies

.github/workflows/ci.yml

@@ -17,17 +17,49 @@ env:
   GIT_CONFIG_COUNT: "1"
   GIT_CONFIG_KEY_0: init.defaultBranch
   GIT_CONFIG_VALUE_0: develop
+  EXPECTED_NPM_VERSION: "10.9.9"
 
 jobs:
+  lock-validation:
+    name: gate / ci / npm-lock-validation
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version: "22.22.3"
+          package-manager-cache: false
+      - name: Activate pinned npm runtime
+        run: corepack enable npm
+      - name: Verify exact npm lockfile generator and bundled tar
+        run: |
+          test "$(npm --version)" = "$EXPECTED_NPM_VERSION"
+          npm run check:npm-runtime
+      - name: Validate the frozen package lock without lifecycle execution
+        run: npm ci --ignore-scripts --no-audit --no-fund
+      - name: Reject manifest or lockfile drift
+        run: git diff --exit-code -- package.json package-lock.json
+
   verify:
     name: ci / build-and-test
+    needs: lock-validation
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          node-version: 22.22.3
-          cache: npm
+          node-version: "22.22.3"
+          package-manager-cache: false
+      - name: Activate pinned npm runtime
+        run: corepack enable npm
+      - name: Verify exact npm lockfile generator and bundled tar
+        run: |
+          test "$(npm --version)" = "$EXPECTED_NPM_VERSION"
+          npm run check:npm-runtime
       - uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
         with:
           version: "0.8.6"
@@ -51,13 +83,22 @@ jobs:
 
   rust-check:
     name: gate / ci / rust-check
+    needs: lock-validation
     runs-on: macos-15
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          node-version: 22.22.3
-          cache: npm
+          node-version: "22.22.3"
+          package-manager-cache: false
+      - name: Activate pinned npm runtime
+        run: corepack enable npm
+      - name: Verify exact npm lockfile generator and bundled tar
+        run: |
+          test "$(npm --version)" = "$EXPECTED_NPM_VERSION"
+          npm run check:npm-runtime
       - name: Install stable Rust toolchain
         run: rustup toolchain install stable --profile minimal
       - name: Install node dependencies

.github/workflows/release.yml

@@ -29,10 +29,12 @@ jobs:
       contents: read
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: 22.22.3
-          cache: npm
+          package-manager-cache: false
       - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: "3.12"
@@ -42,6 +44,10 @@ jobs:
           enable-cache: false
       - name: Install Rust stable
         run: rustup toolchain install stable --profile minimal
+      - name: Activate and verify pinned npm runtime
+        run: |
+          corepack enable npm
+          npm run check:npm-runtime
       - name: Install node dependencies
         run: npm ci
       - name: Sync Python dependencies

.github/workflows/security-audit.yml

@@ -24,17 +24,23 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: 22.22.3
-          cache: npm
+          package-manager-cache: false
       - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: "3.12"
       - uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
         with:
           version: "0.8.6"
           enable-cache: false
+      - name: Activate and verify pinned npm runtime
+        run: |
+          corepack enable npm
+          npm run check:npm-runtime
       - name: Install node dependencies
         run: npm ci
       - name: Audit npm dependencies

CHANGELOG.md

@@ -7,6 +7,14 @@
 - Display the analyzed song tempo (BPM) as a badge in the rehearsal workspace.
 - 각 합주 역할(Role)별 개인 연습 진행도를 0~100% 범위로 기록 및 시각화할 수 있는 연습 진척도(`practiceProgress`) 트래커 기능 추가. UI 컨트롤(슬라이더 및 +/- 버튼)과 한/영 다국어 지원 포함.
 
+### Changed
+
+- Pinned npm `10.9.9` as the approved lockfile generator, activated it through Node-bundled Corepack before dependency consumption, and fail closed unless its bundled `tar` is at least `7.5.19`; primary CI still consumes the committed lock only through frozen `npm ci` validation, rejects mutable npm resolution in the lock gate, requires integrity evidence for public-registry lock entries, and preserves generator-sensitive root `@esbuild/*` peer metadata.
+
+### Fixed
+
+- Upgraded the local score PDF parser to `pdfjs-dist` 6.2.108, pinned Undici 7.29.0 across the workspace, and constrained PDF loading to copied in-memory bytes with a same-origin bundled worker and npm-generated lock provenance.
+
 ## [0.1.3] - 2026-04-29
 
 ### Fixed
@@ -65,4 +73,4 @@
 
 - `ChordsFeature` (코드 분석) 화면에서 각 파트(Role)의 `transpositionPlan`(이조/조옮김 계획)을 표시하는 기능을 추가했습니다.
 - `RangesFeature` (음역대 분석) 화면에서 겹침 경고(Overlap warning) 외에 해당 파트의 채보(Transcription) 가능 노드 수를 요약하여 보여주는 기능을 추가했습니다.
-- 신규 UI 요소에 대한 100% 테스트 커버리지를 보장하는 단위 테스트를 추가했습니다 (`apps/desktop/src/features/chords/index.test.tsx`, `apps/desktop/src/features/ranges/index.test.tsx`).
+- 신규 UI 요소에 대한 단위 테스트를 추가했습니다 (`apps/desktop/src/features/chords/index.test.tsx`, `apps/desktop/src/features/ranges/index.test.tsx`).

apps/desktop/package.json

@@ -20,7 +20,7 @@
     "class-variance-authority": "^0.7.1",
     "clsx": "^2.1.1",
     "lucide-react": "^1.24.0",
-    "pdfjs-dist": "6.1.200",
+    "pdfjs-dist": "6.2.108",
     "react": "^19.2.4",
     "react-dom": "^19.2.7",
     "sonner": "^2.0.7",

apps/desktop/src/features/score/pdfjs.test.ts

@@ -0,0 +1,54 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+import { getDocument, GlobalWorkerOptions } from "pdfjs-dist";
+import { configureScorePdfWorker, loadScorePdf } from "./pdfjs";
+
+vi.mock("pdfjs-dist", () => ({
+  getDocument: vi.fn(() => ({ promise: Promise.resolve(), destroy: vi.fn() })),
+  GlobalWorkerOptions: { workerSrc: "" }
+}));
+
+vi.mock("pdfjs-dist/build/pdf.worker.min.mjs?url", () => ({
+  default: "/assets/pdf.worker.min.mjs"
+}));
+
+describe("score PDF.js boundary", () => {
+  beforeEach(() => {
+    vi.mocked(getDocument).mockClear();
+    GlobalWorkerOptions.workerSrc = "";
+  });
+
+  it("uses the locally bundled worker asset", () => {
+    configureScorePdfWorker();
+
+    expect(GlobalWorkerOptions.workerSrc).toBe("/assets/pdf.worker.min.mjs");
+
+    configureScorePdfWorker();
+    expect(GlobalWorkerOptions.workerSrc).toBe("/assets/pdf.worker.min.mjs");
+  });
+
+  it("copies validated bytes through the hardened data-only API", () => {
+    const source = new Uint8Array([0x25, 0x50, 0x44, 0x46]);
+
+    loadScorePdf(source);
+
+    expect(getDocument).toHaveBeenCalledTimes(1);
+    const parameters = vi.mocked(getDocument).mock.calls[0]?.[0];
+    expect(parameters).toBeTypeOf("object");
+    expect(Object.keys(parameters as object)).toEqual([
+      "data",
+      "enableXfa",
+      "useWorkerFetch"
+    ]);
+    const hardenedParameters = parameters as {
+      data: Uint8Array;
+      enableXfa: boolean;
+      useWorkerFetch: boolean;
+    };
+    expect(hardenedParameters.data).toEqual(source);
+    expect(hardenedParameters.data).not.toBe(source);
+    source[0] = 0x00;
+    expect(hardenedParameters.data[0]).toBe(0x25);
+    expect(hardenedParameters.enableXfa).toBe(false);
+    expect(hardenedParameters.useWorkerFetch).toBe(false);
+  });
+});

apps/desktop/src/features/score/pdfjs.ts

@@ -19,11 +19,23 @@ export function configureScorePdfWorker(): void {
  * Start parsing validated in-memory score PDF bytes with pdf.js.
  *
  * Only caller-provided bytes are accepted (validated-resource-only rule);
- * this helper never fetches arbitrary URLs. The bytes are copied before they
- * are handed to pdf.js because pdf.js transfers the underlying buffer to its
+ * this helper never supplies a URL. The bytes are copied before they are
+ * handed to pdf.js because pdf.js transfers the underlying buffer to its
  * worker, which would otherwise detach the caller's copy and break retries.
+ *
+ * XFA rendering is explicitly disabled even though pdf.js 6.2.108 defaults it
+ * to `false`, and worker-side resource fetching is explicitly disabled. These
+ * settings make the parser boundary fail closed against XML-form activation
+ * and remote helper-resource acquisition instead of relying on upstream
+ * defaults. In the pinned pdf.js XML parser, DOCTYPE declarations are reported
+ * to a no-op hook and unknown named entities are preserved literally rather
+ * than dereferenced, so no external-entity resolver is exposed by this API.
  */
 export function loadScorePdf(data: Uint8Array): PDFDocumentLoadingTask {
   configureScorePdfWorker();
-  return getDocument({ data: new Uint8Array(data) });
+  return getDocument({
+    data: new Uint8Array(data),
+    enableXfa: false,
+    useWorkerFetch: false
+  });
 }