All issues

Search results

[security] The child_process substitution — and the allowedSpawnCommands allowlist it delivers — is not enforced on CJS require, compartment mode, or natively-loaded npm dependencies

area:securitySecurity, TLS/certs, authentication, authorizationSecurity, TLS/certs, authentication, authorization

P1Priority: P1

Status: Open.

Bug

#2284 In HarperFast/harper;

· kriszyp opened on Aug 22, 2026

·  

v5.2

options.name is neither validated nor namespaced: '../' escapes <rootPath>/pids/, and two components choosing the same name silently adopt each other's process

P2Priority: P2

Status: Open.

Bug

#2283 In HarperFast/harper;

· kriszyp opened on Aug 22, 2026

·  

v5.3

ExistingProcessWrapper: unref() and the 'exit' event are mutually exclusive, and the liveness interval is never unref'd

P2Priority: P2

Status: Open.

Bug

#2282 In HarperFast/harper;

· kriszyp opened on Aug 22, 2026

·  

v5.3

options.version is not validated: a string or float version never compares equal to the persisted value, so every spawn silently kills and respawns the sidecar

P2Priority: P2

Status: Open.

Bug

#2281 In HarperFast/harper;

· kriszyp opened on Aug 22, 2026

·  

v5.3

Version-replacement handoff is not graceful: SIGTERM then a 5ms busy-wait before respawn, so a sidecar holding an exclusive resource fails to start with no retry

P3Priority: P3

Status: Open.

Bug

#2280 In HarperFast/harper;

· kriszyp opened on Aug 22, 2026

·  

v5.3

Version replacement leaves two sidecar processes running: the outgoing child's exit handler unlinks the incoming child's PID lock

P2Priority: P2

Status: Open.

Bug

#2279 In HarperFast/harper;

· kriszyp opened on Aug 22, 2026

·  

v5.3

exec is unusable through the substituted child_process module: no argument shape satisfies both the wrapper and Node's signature

P2Priority: P2

Status: Open.

Bug

#2278 In HarperFast/harper;

· kriszyp opened on Aug 22, 2026

·  

v5.3

[Epic] Component-spawned process supervision (substituted child_process module)

P2Priority: P2

Status: Open.

#2277 In HarperFast/harper;

· kriszyp opened on Aug 22, 2026

Flaky unit test: MQTT 'subscribe to retained record with patch operations' — duplicate retained/live delivery fails as uncaught assertion (~10% under contention)

P2Priority: P2

Status: Open.

Bug

#2275 In HarperFast/harper;

· kriszyp opened on Aug 22, 2026

Flaky unit test: MQTT 'subscribe with QoS=1 and reconnect with non-clean session' silent 20s timeout (lmdb pass)

P2Priority: P2

Status: Open.

Bug

#2274 In HarperFast/harper;

· kriszyp opened on Aug 22, 2026

Windows CI: deploy_component (restart:true) hangs after npm pack — risk-query integration suite cancelled at 319s

P2Priority: P2

Status: Open.

Bug

#2273 In HarperFast/harper;

· kriszyp opened on Aug 22, 2026

set_configuration overwrites the replicated fan-out message with success, hiding per-node failures

bugSomething isn't workingSomething isn't working

P2Priority: P2

Status: Open.

Bug

#2270 In HarperFast/harper;

· kriszyp opened on Aug 22, 2026