Plugin Security — Kernel Protocol reference Provides comprehensive security scanning, vulnerability management, and dependency resolution for the ObjectStack plugin ecosystem.
Provides comprehensive security scanning, vulnerability management,
and dependency resolution for the ObjectStack plugin ecosystem.
Features:
CVE/vulnerability scanning
Dependency graph resolution
Semantic version conflict detection
Supply chain security
Plugin sandboxing policies
Trust and verification workflows
Source: packages/spec/src/kernel/plugin-security.zod.ts
import { DependencyGraphSchema, DependencyGraphNodeSchema, PackageDependencyConflictSchema, PackageDependencyResolutionResultSchema, PluginProvenanceSchema, PluginTrustScoreSchema, ResolvedPackageDependencySchema, SBOMSchema, SBOMEntrySchema, SecurityPolicySchema, SecurityScanResultSchema, SecurityVulnerabilitySchema, VulnerabilitySeverity } from '@objectstack/spec/kernel' ; import type { DependencyGraph, DependencyGraphNode, PackageDependencyConflict, PackageDependencyResolutionResult, PluginProvenance, PluginTrustScore, ResolvedPackageDependency, SBOM, SBOMEntry, SecurityPolicy, SecurityScanResult, SecurityVulnerability, VulnerabilitySeverity } from '@objectstack/spec/kernel' ; // Validate data const result = DependencyGraphSchema. parse (data); Complete dependency graph for a package and its transitive dependencies
Property Type Required Description root { id: string; version: string }✅ Root package of the dependency graph nodes { id: string; version: string; dependencies?: object[]; depth: integer; … }[]✅ All resolved package nodes in the dependency graph edges { from: string; to: string; constraint: string }[]✅ Directed edges representing dependency relationships stats { totalDependencies: integer; directDependencies: integer; maxDepth: integer }✅ Summary statistics for the dependency graph
Property Type Required Description id string✅ Identifier of the root package version string✅ Version of the root package
A node in the dependency graph representing a resolved package
Property Type Required Description id string✅ Unique identifier of the package version string✅ Resolved version of the package dependencies { name: string; versionConstraint: string; type?: Enum<'required' | 'optional' | 'peer' | 'dev'>; resolvedVersion?: string }[]optional (default: []) Dependencies required by this package depth integer✅ Depth level in the dependency tree (0 = root) isDirect boolean✅ Whether this is a direct (top-level) dependency metadata { name: string; description?: string; license?: string; homepage?: string }optional Additional metadata about the package
Property Type Required Description from string✅ Package ID to string✅ Package ID constraint string✅ Version constraint
Property Type Required Description totalDependencies integer✅ Total number of resolved dependencies directDependencies integer✅ Number of direct (top-level) dependencies maxDepth integer✅ Maximum depth of the dependency tree
A node in the dependency graph representing a resolved package
Property Type Required Description id string✅ Unique identifier of the package version string✅ Resolved version of the package dependencies { name: string; versionConstraint: string; type?: Enum<'required' | 'optional' | 'peer' | 'dev'>; resolvedVersion?: string }[]optional (default: []) Dependencies required by this package depth integer✅ Depth level in the dependency tree (0 = root) isDirect boolean✅ Whether this is a direct (top-level) dependency metadata { name: string; description?: string; license?: string; homepage?: string }optional Additional metadata about the package
A resolver-side package dependency: version constraint plus its resolution outcome
Property Type Required Description name string✅ Package name or identifier versionConstraint string✅ Semver range (e.g., ^1.0.0, >=2.0.0 <3.0.0) type Enum<'required' | 'optional' | 'peer' | 'dev'>optional (default: "required") Category of the dependency relationship resolvedVersion stringoptional Concrete version resolved during dependency resolution
Property Type Required Description name string✅ Display name of the package description stringoptional Short description of the package license stringoptional SPDX license identifier of the package homepage stringoptional Homepage URL of the package
A detected conflict between dependency version requirements
Property Type Required Description package string✅ Name of the package with conflicting version requirements conflicts { version: string; requestedBy: string[]; constraint: string }[]✅ List of conflicting version requirements resolution { strategy: Enum<'pick-highest' | 'pick-lowest' | 'manual'>; version?: string; reason?: string }optional Suggested resolution for the conflict severity Enum<'error' | 'warning' | 'info'>✅ Severity level of the dependency conflict
Property Type Required Description version string✅ Conflicting version of the package requestedBy string[]✅ Packages that require this version constraint string✅ Semver constraint that produced this version requirement
Property Type Required Description strategy Enum<'pick-highest' | 'pick-lowest' | 'manual'>✅ Strategy used to resolve the conflict version stringoptional Resolved version selected by the strategy reason stringoptional Explanation of why this resolution was chosen
Result of a dependency resolution process
Property Type Required Description status Enum<'success' | 'conflict' | 'error'>✅ Overall status of the dependency resolution graph { root: object; nodes: object[]; edges: object[]; stats: object }optional Resolved dependency graph if resolution succeeded conflicts { package: string; conflicts: object[]; resolution?: object; severity: Enum<'error' | 'warning' | 'info'> }[]optional (default: []) List of dependency conflicts detected during resolution errors { package: string; error: string }[]optional (default: []) Errors encountered during dependency resolution installOrder string[]optional (default: []) Topologically sorted list of package IDs for installation resolvedInMs integeroptional Time taken to resolve dependencies in milliseconds resolvedIn neveroptional [REMOVED] PackageDependencyResolutionResult.resolvedIn was renamed to resolvedInMs in @objectstack/spec 17 — the unit of a duration-shaped number lives in the key name, not only in the describe prose. Rename the key to resolvedInMs; the value (milliseconds) is unchanged.
Property Type Required Description root { id: string; version: string }✅ Root package of the dependency graph nodes { id: string; version: string; dependencies?: object[]; depth: integer; … }[]✅ All resolved package nodes in the dependency graph edges { from: string; to: string; constraint: string }[]✅ Directed edges representing dependency relationships stats { totalDependencies: integer; directDependencies: integer; maxDepth: integer }✅ Summary statistics for the dependency graph
A detected conflict between dependency version requirements
Property Type Required Description package string✅ Name of the package with conflicting version requirements conflicts { version: string; requestedBy: string[]; constraint: string }[]✅ List of conflicting version requirements resolution { strategy: Enum<'pick-highest' | 'pick-lowest' | 'manual'>; version?: string; reason?: string }optional Suggested resolution for the conflict severity Enum<'error' | 'warning' | 'info'>✅ Severity level of the dependency conflict
Property Type Required Description package string✅ Name of the package that caused the error error string✅ Error message describing what went wrong
Verifiable provenance and chain of custody for a plugin artifact
Property Type Required Description pluginId string✅ Unique identifier of the plugin version string✅ Version of the plugin artifact build { timestamp: string; environment?: object; source?: object; builder?: object }✅ Build provenance information artifacts { filename: string; sha256: string; size: integer }[]✅ List of build artifacts with integrity hashes signatures { algorithm: Enum<'rsa' | 'ecdsa' | 'ed25519'>; publicKey: string; signature: string; signedBy: string; … }[]optional (default: []) Cryptographic signatures for the plugin artifact attestations { type: Enum<'code-review' | 'security-scan' | 'test-results' | 'ci-build'>; status: Enum<'passed' | 'failed'>; url?: string; timestamp: string }[]optional (default: []) Verification attestations for the plugin
Property Type Required Description timestamp string✅ ISO 8601 timestamp when the build was produced environment { os: string; arch: string; nodeVersion: string }optional Environment details where the build was executed source { repository: string; commit: string; branch?: string; tag?: string }optional Source repository information for the build builder { name: string; email?: string }optional Identity of the builder who produced the artifact
Property Type Required Description filename string✅ Name of the artifact file sha256 string✅ SHA-256 hash of the artifact size integer✅ Size of the artifact in bytes
Property Type Required Description algorithm Enum<'rsa' | 'ecdsa' | 'ed25519'>✅ Cryptographic algorithm used for signing publicKey string✅ Public key used to verify the signature signature string✅ Digital signature value signedBy string✅ Identity of the signer timestamp string✅ ISO 8601 timestamp when the signature was created
Property Type Required Description type Enum<'code-review' | 'security-scan' | 'test-results' | 'ci-build'>✅ Type of attestation status Enum<'passed' | 'failed'>✅ Result status of the attestation url stringoptional URL with details about the attestation timestamp string✅ ISO 8601 timestamp when the attestation was issued
Trust score and verification status for a plugin
Property Type Required Description pluginId string✅ Unique identifier of the plugin score number✅ Overall trust score from 0 to 100 components { vendorReputation: number; securityScore: number; codeQuality: number; communityScore: number; … }✅ Individual score components contributing to the overall trust score level Enum<'verified' | 'trusted' | 'neutral' | 'untrusted' | 'blocked'>✅ Computed trust level based on the overall score badges Enum<'official' | 'verified-vendor' | 'security-scanned' | 'code-signed' | 'open-source' | 'popular'>[]optional (default: []) Verification badges earned by the plugin updatedAt string✅ ISO 8601 timestamp when the trust score was last updated
Property Type Required Description vendorReputation number✅ Vendor reputation score from 0 to 100 securityScore number✅ Security scan results score from 0 to 100 codeQuality number✅ Code quality score from 0 to 100 communityScore number✅ Community engagement score from 0 to 100 maintenanceScore number✅ Maintenance and update frequency score from 0 to 100
A resolver-side package dependency: version constraint plus its resolution outcome
Property Type Required Description name string✅ Package name or identifier versionConstraint string✅ Semver range (e.g., ^1.0.0, >=2.0.0 <3.0.0) type Enum<'required' | 'optional' | 'peer' | 'dev'>optional (default: "required") Category of the dependency relationship resolvedVersion stringoptional Concrete version resolved during dependency resolution
Software Bill of Materials for a plugin
Property Type Required Description format Enum<'spdx' | 'cyclonedx'>optional (default: "cyclonedx") SBOM standard format used version string✅ Version of the SBOM specification plugin { id: string; version: string; name: string }✅ Metadata about the plugin this SBOM describes components { name: string; version: string; purl?: string; license?: string; … }[]✅ List of software components included in the plugin generatedAt string✅ ISO 8601 timestamp when the SBOM was generated generator { name: string; version: string }optional Tool used to generate this SBOM
Property Type Required Description id string✅ Plugin identifier version string✅ Plugin version name string✅ Human-readable plugin name
A single entry in a Software Bill of Materials
Property Type Required Description name string✅ Name of the software component version string✅ Version of the software component purl stringoptional Package URL identifier license stringoptional SPDX license identifier of the component hashes { sha256?: string; sha512?: string }optional Cryptographic hashes for integrity verification supplier { name: string; url?: string }optional Supplier information for the component externalRefs { type: Enum<'website' | 'repository' | 'documentation' | 'issue-tracker'>; url: string }[]optional (default: []) External references related to the component
Property Type Required Description name string✅ Name of the SBOM generator tool version string✅ Version of the SBOM generator tool
A single entry in a Software Bill of Materials
Property Type Required Description name string✅ Name of the software component version string✅ Version of the software component purl stringoptional Package URL identifier license stringoptional SPDX license identifier of the component hashes { sha256?: string; sha512?: string }optional Cryptographic hashes for integrity verification supplier { name: string; url?: string }optional Supplier information for the component externalRefs { type: Enum<'website' | 'repository' | 'documentation' | 'issue-tracker'>; url: string }[]optional (default: []) External references related to the component
Property Type Required Description sha256 stringoptional SHA-256 hash of the component artifact sha512 stringoptional SHA-512 hash of the component artifact
Property Type Required Description name string✅ Name of the component supplier url stringoptional URL of the component supplier
Property Type Required Description type Enum<'website' | 'repository' | 'documentation' | 'issue-tracker'>✅ Type of external reference url string✅ URL of the external reference
Security policy governing plugin scanning and enforcement
Property Type Required Description id string✅ Unique identifier for the security policy name string✅ Human-readable name of the security policy autoScan { enabled?: boolean; frequency?: Enum<'on-publish' | 'daily' | 'weekly' | 'monthly'> }✅ Automatic security scanning configuration thresholds { maxCritical?: integer; maxHigh?: integer; maxMedium?: integer }✅ Vulnerability count thresholds for policy enforcement allowedLicenses string[]optional (default: ["MIT","Apache-2.0","BSD-3-Clause","BSD-2-Clause","ISC"]) List of SPDX license identifiers that are permitted prohibitedLicenses string[]optional (default: ["GPL-3.0","AGPL-3.0"]) List of SPDX license identifiers that are prohibited codeSigning { required?: boolean; allowedSigners?: string[] }optional Code signing requirements for plugin artifacts sandbox { networkAccess?: Enum<'none' | 'localhost' | 'allowlist' | 'all'>; allowedDestinations?: string[]; filesystemAccess?: Enum<'none' | 'read-only' | 'temp-only' | 'full'>; maxMemoryMB?: integer; … }optional Sandbox restrictions for plugin execution
Property Type Required Description enabled booleanoptional (default: true) Whether automatic scanning is enabled frequency Enum<'on-publish' | 'daily' | 'weekly' | 'monthly'>optional (default: "daily") How often automatic scans are performed
Property Type Required Description maxCritical integeroptional (default: 0) Maximum allowed critical vulnerabilities before blocking maxHigh integeroptional (default: 0) Maximum allowed high vulnerabilities before blocking maxMedium integeroptional (default: 5) Maximum allowed medium vulnerabilities before warning
Property Type Required Description required booleanoptional (default: false) Whether code signing is required for plugins allowedSigners string[]optional (default: []) List of trusted signer identities
Property Type Required Description networkAccess Enum<'none' | 'localhost' | 'allowlist' | 'all'>optional (default: "all") Level of network access granted to the plugin allowedDestinations string[]optional (default: []) Permitted network destinations when using allowlist mode filesystemAccess Enum<'none' | 'read-only' | 'temp-only' | 'full'>optional (default: "full") Level of file system access granted to the plugin maxMemoryMB integeroptional Maximum memory allocation in megabytes maxCPUSeconds integeroptional Maximum CPU time allowed in seconds
Result of a security scan performed on a plugin
Property Type Required Description scanId string✅ Unique identifier for this security scan plugin { id: string; version: string }✅ Plugin that was scanned scannedAt string✅ ISO 8601 timestamp when the scan was performed scanner { name: string; version: string }✅ Information about the scanner tool used status Enum<'passed' | 'failed' | 'warning'>✅ Overall result status of the security scan vulnerabilities { cve?: string; id: string; title: string; description: string; … }[]✅ List of vulnerabilities discovered during the scan summary { critical?: integer; high?: integer; medium?: integer; low?: integer; … }✅ Summary counts of vulnerabilities by severity licenseIssues { package: string; license: string; reason: string; severity: Enum<'error' | 'warning' | 'info'> }[]optional (default: []) License compliance issues found during the scan codeQuality { score?: number; issues?: object[] }optional Code quality analysis results nextScanAt stringoptional ISO 8601 timestamp for the next scheduled scan
Property Type Required Description id string✅ Plugin identifier version string✅ Plugin version that was scanned
Property Type Required Description name string✅ Scanner name (e.g., snyk, osv, trivy) version string✅ Version of the scanner tool
A known security vulnerability in a package dependency
Property Type Required Description cve stringoptional CVE identifier id string✅ Vulnerability ID title string✅ Short title summarizing the vulnerability description string✅ Detailed description of the vulnerability severity Enum<'critical' | 'high' | 'medium' | 'low' | 'info'>✅ Severity level of this vulnerability cvss numberoptional CVSS score ranging from 0 to 10 package { name: string; version: string; ecosystem?: string }✅ Affected package information vulnerableVersions string✅ Semver range of vulnerable versions patchedVersions stringoptional Semver range of patched versions references { type: Enum<'advisory' | 'article' | 'report' | 'web'>; url: string }[]optional (default: []) External references related to the vulnerability cwe string[]optional (default: []) CWE identifiers associated with this vulnerability publishedAt stringoptional ISO 8601 date when the vulnerability was published mitigation stringoptional Recommended steps to mitigate the vulnerability
Property Type Required Description critical integeroptional (default: 0) Count of critical severity vulnerabilities high integeroptional (default: 0) Count of high severity vulnerabilities medium integeroptional (default: 0) Count of medium severity vulnerabilities low integeroptional (default: 0) Count of low severity vulnerabilities info integeroptional (default: 0) Count of informational severity vulnerabilities total integeroptional (default: 0) Total count of all vulnerabilities
Property Type Required Description package string✅ Name of the package with a license issue license string✅ License identifier of the package reason string✅ Reason the license is flagged severity Enum<'error' | 'warning' | 'info'>✅ Severity of the license compliance issue
Property Type Required Description score numberoptional Overall code quality score from 0 to 100 issues { type: Enum<'security' | 'quality' | 'style'>; severity: Enum<'error' | 'warning' | 'info'>; message: string; file?: string; … }[]optional (default: []) List of individual code quality issues
A known security vulnerability in a package dependency
Property Type Required Description cve stringoptional CVE identifier id string✅ Vulnerability ID title string✅ Short title summarizing the vulnerability description string✅ Detailed description of the vulnerability severity Enum<'critical' | 'high' | 'medium' | 'low' | 'info'>✅ Severity level of this vulnerability cvss numberoptional CVSS score ranging from 0 to 10 package { name: string; version: string; ecosystem?: string }✅ Affected package information vulnerableVersions string✅ Semver range of vulnerable versions patchedVersions stringoptional Semver range of patched versions references { type: Enum<'advisory' | 'article' | 'report' | 'web'>; url: string }[]optional (default: []) External references related to the vulnerability cwe string[]optional (default: []) CWE identifiers associated with this vulnerability publishedAt stringoptional ISO 8601 date when the vulnerability was published mitigation stringoptional Recommended steps to mitigate the vulnerability
Property Type Required Description name string✅ Name of the affected package version string✅ Version of the affected package ecosystem stringoptional Package ecosystem (e.g., npm, pip, maven)
Property Type Required Description type Enum<'advisory' | 'article' | 'report' | 'web'>✅ Type of reference source url string✅ URL of the reference
Severity level of a security vulnerability
criticalhighmediumlowinfo
ObjectStack