fix(deps): mirror ws/qs security overrides in ui via new override-parity rule

New package-override-parity lint-meta rule: an app's overrides must be
reflected in its own bun.lock and mirrored by sibling apps that resolve
the same package. Surfaced three real instances: ui missing ws@8.21.0
(GHSA-58qx-3vcg-4xpx) and qs@6.15.2 (GHSA-q8mj-m7cp-5q26) mirrors of the
docs pins, and docs' bun.lock resolving @types/react@19.2.14 despite its
19.2.15 override. Also regenerates the docs lint-meta catalog for this
rule and github-actions-timeout-required.

Audit: F002

Author: agjs

apps/api/scripts/lint-meta/RULES.md

@@ -16,6 +16,7 @@ Run `bun run lint:meta --list-rules` for the machine-readable list from the regi
 | ----------------------------------- | ------------ | ----------- | ----------------------------------------------------------------------------------------------------------------------------------------------- |
 | `package-json-exact-deps`           | supply-chain | no          | dependencies and devDependencies must use exact versions (no ranges).                                                                           |
 | `no-overlapping-libs`               | supply-chain | no          | package.json must not list forbidden overlapping library pairs.                                                                                 |
+| `package-override-parity`           | supply-chain | no          | package.json overrides must be reflected in the app's own bun.lock and mirrored by sibling apps that resolve the same package.                  |
 | `shared-tool-version-parity`        | supply-chain | no          | Shared dev tooling (ESLint, TypeScript, Prettier, knip, …) must be pinned to the same version in every app that declares it.                    |
 | `github-actions-permissions`        | ci           | no          | GitHub Actions workflows require permissions block and SHA-pinned uses: refs.                                                                   |
 | `github-actions-permissions:verify` | ci           | no          | Pinned action SHAs resolve on github.com (lint:meta:verify only).                                                                               |

apps/api/scripts/lint-meta/cli.ts

@@ -20,6 +20,7 @@ import { META_RULES } from "./registry";
 import { printRuleCatalog, runMetaRules, runMetaRulesAsync } from "./runner";
 import { checkDependencyPairs } from "./rules/supply-chain/no-overlapping-libs";
 import { checkExactDependencyVersions } from "./rules/supply-chain/package-json-exact-deps";
+import { checkPackageOverrideParity } from "./rules/supply-chain/package-override-parity";
 import { checkSharedToolVersionParity } from "./rules/supply-chain/shared-tool-version-parity";
 import { checkEslintConfigNoWarn } from "./rules/config/eslint-config-no-warn";
 import { checkEnvSchemaDrift } from "./rules/env/env-cascade-drift";
@@ -99,6 +100,7 @@ export {
   checkLogicFilesHaveTests,
   checkNoDirectProcessEnv,
   checkNoRawRoleLiterals,
+  checkPackageOverrideParity,
   checkPrePushParity,
   checkRouteFilesHaveTests,
   checkSharedToolVersionParity,

apps/api/scripts/lint-meta/registry.ts

@@ -11,6 +11,7 @@ import { forbiddenTextRule } from "./rules/source-text/forbidden-text";
 import { noRawRoleLiteralsRule } from "./rules/source-text/no-raw-role-literals";
 import { noOverlappingLibsRule } from "./rules/supply-chain/no-overlapping-libs";
 import { packageJsonExactDepsRule } from "./rules/supply-chain/package-json-exact-deps";
+import { packageOverrideParityRule } from "./rules/supply-chain/package-override-parity";
 import { sharedToolVersionParityRule } from "./rules/supply-chain/shared-tool-version-parity";
 import { logicFilesRequireTestSiblingRule } from "./rules/testing/logic-files-require-test-sibling";
 import { routesRequireTestSiblingRule } from "./rules/testing/routes-require-test-sibling";
@@ -21,6 +22,7 @@ import type { IMetaRule } from "./types";
 export const META_RULES: readonly IMetaRule[] = [
   packageJsonExactDepsRule,
   noOverlappingLibsRule,
+  packageOverrideParityRule,
   sharedToolVersionParityRule,
   githubActionsPermissionsRule,
   githubActionsTimeoutRequiredRule,

apps/api/scripts/lint-meta/rules/supply-chain/package-override-parity.ts

@@ -0,0 +1,227 @@
+import { readFileSync, readdirSync, statSync } from "node:fs";
+import { join } from "node:path";
+
+import type { IMetaRule, IViolation } from "../../types";
+
+/*
+ * Security/parity `overrides` in one app's package.json must hold across the
+ * monorepo: a sibling app that resolves the same package (per its bun.lock)
+ * either mirrors the override or has consciously pinned the same version.
+ * Two failure modes are caught:
+ *
+ *   1. Stale override — an app's own bun.lock resolves a different version
+ *      than its declared override (the override never took effect; run
+ *      `bun install`).
+ *   2. Missing mirror — a sibling resolves the package at a different
+ *      version than the override and declares no override of its own
+ *      (e.g. a GHSA patch pinned in one app but not the others).
+ */
+
+interface IAppOverrides {
+  readonly app: string;
+  readonly file: string;
+  readonly overrides: Record<string, string>;
+  readonly lockfileText: string | null;
+}
+
+function toStringRecord(value: unknown): Record<string, string> {
+  if (typeof value !== "object" || value === null) {
+    return {};
+  }
+
+  const out: Record<string, string> = {};
+
+  for (const [k, v] of Object.entries(value)) {
+    if (typeof v === "string") {
+      out[k] = v;
+    }
+  }
+
+  return out;
+}
+
+function readApps(appsDir: string): IAppOverrides[] {
+  const out: IAppOverrides[] = [];
+  let entries: string[];
+
+  try {
+    entries = readdirSync(appsDir);
+  } catch {
+    return out;
+  }
+
+  for (const entry of entries) {
+    const dir = join(appsDir, entry);
+
+    let isDir: boolean;
+
+    try {
+      isDir = statSync(dir).isDirectory();
+    } catch {
+      continue;
+    }
+
+    if (!isDir) {
+      continue;
+    }
+
+    const file = join(dir, "package.json");
+    let parsed: unknown;
+
+    try {
+      parsed = JSON.parse(readFileSync(file, "utf8"));
+    } catch {
+      continue;
+    }
+
+    if (typeof parsed !== "object" || parsed === null) {
+      continue;
+    }
+
+    let overridesValue: unknown;
+
+    for (const [k, v] of Object.entries(parsed)) {
+      if (k === "overrides") {
+        overridesValue = v;
+      }
+    }
+
+    let lockfileText: string | null;
+
+    try {
+      lockfileText = readFileSync(join(dir, "bun.lock"), "utf8");
+    } catch {
+      lockfileText = null;
+    }
+
+    out.push({
+      app: entry,
+      file,
+      overrides: toStringRecord(overridesValue),
+      lockfileText,
+    });
+  }
+
+  return out;
+}
+
+function escapeRegExp(text: string): string {
+  return text.replace(/[.*+?^${}()|[\]\\]/gu, "\\$&");
+}
+
+/** Versions the lockfile resolves for `name` (entries look like "name@1.2.3"). */
+function resolvedVersions(lockfileText: string, name: string): string[] {
+  const regex = new RegExp(`"${escapeRegExp(name)}@(\\d[^"]*)"`, "gu");
+  const versions = new Set<string>();
+  let match: RegExpExecArray | null = regex.exec(lockfileText);
+
+  while (match !== null) {
+    const version = match[1];
+
+    if (version !== undefined) {
+      versions.add(version);
+    }
+
+    match = regex.exec(lockfileText);
+  }
+
+  return [...versions];
+}
+
+type Reporter = (file: string, key: string, message: string) => void;
+
+function checkStaleOverrides(app: IAppOverrides, report: Reporter): void {
+  if (app.lockfileText === null) {
+    return;
+  }
+
+  for (const [name, version] of Object.entries(app.overrides)) {
+    const resolved = resolvedVersions(app.lockfileText, name);
+
+    if (resolved.length > 0 && resolved.join(",") !== version) {
+      report(
+        app.file,
+        `stale:${name}`,
+        `Override ${name}@${version} is not what bun.lock resolves (${resolved.join(", ")}) — run \`bun install\` to apply it.`
+      );
+    }
+  }
+}
+
+function checkSiblingMirror(
+  owner: IAppOverrides,
+  sibling: IAppOverrides,
+  name: string,
+  version: string,
+  report: Reporter
+): void {
+  if (sibling.lockfileText === null) {
+    return;
+  }
+
+  const siblingOverride = sibling.overrides[name];
+
+  if (siblingOverride !== undefined) {
+    if (siblingOverride !== version) {
+      report(
+        sibling.file,
+        `drift:${name}`,
+        `Override ${name}@${siblingOverride} drifts from ${owner.app}'s ${name}@${version} — align the pins or document why they differ.`
+      );
+    }
+
+    return;
+  }
+
+  const resolved = resolvedVersions(sibling.lockfileText, name);
+
+  if (resolved.length > 0 && resolved.join(",") !== version) {
+    report(
+      sibling.file,
+      `missing:${name}`,
+      `${owner.app} overrides ${name}@${version} but this app resolves ${resolved.join(", ")} with no override — mirror the pin (it usually exists for a security advisory).`
+    );
+  }
+}
+
+export function checkPackageOverrideParity(appsDir: string): IViolation[] {
+  const violations: IViolation[] = [];
+  const reported = new Set<string>();
+  const apps = readApps(appsDir);
+
+  const report: Reporter = (file, key, message) => {
+    if (reported.has(`${file}:${key}`)) {
+      return;
+    }
+
+    reported.add(`${file}:${key}`);
+    violations.push({ file, rule: "package-override-parity", message });
+  };
+
+  for (const app of apps) {
+    checkStaleOverrides(app, report);
+  }
+
+  for (const owner of apps) {
+    for (const [name, version] of Object.entries(owner.overrides)) {
+      for (const sibling of apps) {
+        if (sibling.app !== owner.app) {
+          checkSiblingMirror(owner, sibling, name, version, report);
+        }
+      }
+    }
+  }
+
+  return violations;
+}
+
+/** Package overrides must be applied and mirrored across sibling apps. */
+export const packageOverrideParityRule: IMetaRule = {
+  id: "package-override-parity",
+  category: "supply-chain",
+  description:
+    "package.json overrides must be reflected in the app's own bun.lock and mirrored by sibling apps that resolve the same package.",
+  run({ root }) {
+    return checkPackageOverrideParity(join(root, ".."));
+  },
+};

apps/api/tests/lint-meta/fixtures/override-parity-clean/app-a/bun.lock

@@ -0,0 +1,6 @@
+{
+  "name": "fixture-app-a",
+  "overrides": {
+    "ws": "8.21.0"
+  }
+}

apps/api/tests/lint-meta/fixtures/override-parity-clean/app-a/package.json

@@ -0,0 +1,3 @@
+{
+  "name": "fixture-app-b"
+}

apps/api/tests/lint-meta/fixtures/override-parity-clean/app-b/bun.lock

@@ -0,0 +1,6 @@
+{
+  "name": "fixture-app-a",
+  "overrides": {
+    "ws": "8.21.0"
+  }
+}