gongxue-base/docs/refactor/taro-supply-chain-baseline-20260712.md

Taro supply-chain baseline - 2026-07-12

Decision

Taro remains pinned to 4.2.0. The root package now overrides the two vulnerable dependencies that are compiled into the H5 output:

• swiper@12.1.2
• lodash-es@4.18.1

Taro 4.2.0 declares exact older versions for these packages. npm therefore installs the secured overrides but reports ELSPROBLEMS. This is an upstream dependency-contract mismatch, not permission to ignore arbitrary dependency-tree errors.

Taro also remains on stable 4.2.0 because the available 4.2.1-beta.2 still contains the reproduced H5 Input watcher defect and introduces a wider beta regression surface. The Taro workspace postinstall applies two reviewed, fail-closed H5 runtime patches to the exact @tarojs/components@4.2.0 package:

• Input watcher: guards inputRef before synchronizing value.
• Button loading: keeps the loading <i> node stable and changes only its display, avoiding Stencil child insertion/removal while React changes adjacent buttons.

The patcher validates the package version, lock integrity, pristine or patched source hashes, and all targets before writing either file. H5 build/dev commands run --check first. Student WeApp uses native mini-program components and does not depend on these H5-only patches.

npm run audit:taro:supply-chain fails unless all of the following remain true:

• package.json, package-lock.json, and the installed tree use the exact secured versions and expected integrity hashes.
• The only npm ls invalid packages are swiper@12.1.2 and lodash-es@4.18.1.
• The only invalid edges are the four reviewed Taro 4.2.0 exact declarations.
• A full apps/taro workspace audit, including development dependencies, no longer reports swiper or lodash-es.
• Every remaining high or critical package is already present in the explicit reviewed build-toolchain allowlist. A new high or critical package fails closed.
• The installed Input target SHA-256 is 260bb8a07d66eaf3398904acb94a7c2cacabe4411b70a01fb0d03931fe95c499.
• The installed Button target SHA-256 is 428db74e51382c68bc10211ff7815d494b086de465fdef97ca09f5b7ab8368ea.

Do not replace this check with npm audit --omit=dev. Taro declares much of the frontend stack as development dependencies even though swiper and lodash-es are compiled into the shipped H5 JavaScript.

Reproducibility evidence

Using npm 11.12.1 and Node.js 24.15.0, a repository-external clean snapshot completed npm ci --workspaces --include-workspace-root --include=dev in 9.77s. The Taro workspace postinstall automatically produced both reviewed patched hashes; the patch contract and independent supply-chain audit then passed. Deployment must not use --ignore-scripts, and must include development dependencies because Taro is a static build workspace.

Generate a machine-readable launch artifact with npm --silent run audit:taro:supply-chain -- --json. The --silent flag is required when redirecting stdout because the normal npm script banner is not JSON.

The secured versions and runtime patches have passed Taro TypeScript, three production H5 builds, static smoke 25/25, full Chrome interaction smoke 33/33, and the student WeApp preview build/guard. The browser runtime probe sets the Input value before and after mount, and toggles Button loading 200 times while asserting that the same loading node and child count remain stable. Release checks must continue to run after any Taro upgrade, override, patch hash, or lock-file change.

Remaining risk boundary

The full workspace audit currently reports 38 findings: 3 critical, 10 high, and 25 moderate. The removed bundle findings account for the reduction from 40 findings and eliminate the known swiper prototype-pollution and lodash-es advisories from the resolved frontend dependency tree.

The remaining high and critical findings are in the Taro CLI and build chain, including repository/template download helpers, archive extraction, glob processing, minification, serialization, and webpack runner paths. They are not declared resolved and the raw npm run audit:taro:toolchain command intentionally remains non-zero.

Until Taro publishes a compatible upgrade, apply these controls:

• Build only on an isolated trusted runner with least-privilege credentials and no production database access.
• Do not expose the Taro development server to public networks.
• Do not feed untrusted templates, repositories, archives, configuration, or CLI arguments to the build process.
• Publish only reviewed static files under apps/taro/dist; never publish node_modules, source files, or build caches.
• Do not run npm audit fix --force; its current proposal crosses the Taro major-version contract and can regress the multi-end build.
• Re-run the supply-chain gate, TypeScript checks, H5/WeApp builds, and smoke tests whenever the lock file or any Taro package changes.

This is a controlled risk acceptance for the isolated build toolchain. It is not a claim that the Taro toolchain has zero vulnerabilities.