modelcontextprotocol/inspector
Watch
1
0
Fork
You've already forked inspector
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2

chore(deps): address Copilot review round 12 on #2243

Browse source 
Build the open-GHSA set from the raw alert feed, not from the grouped
alerts. groupAlerts deliberately drops an alert with no
first_patched_version, so an advisory that stays OPEN but loses its
patched version vanished from both the keys and that set — and
reconciliation would have called it "fixed or dismissed".

Same wrong direction as the superseded case fixed last round, reached a
different way: a still-open advisory must never stand itself down.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013H6Cew3KB3jVmQ5x4Dq1sq
Signed-off-by: cliffhall <cliff@futurescale.com>
This commit is contained in:
cliffhall 2026-09-04 08:22:18 -04:00 • committed by GitHub
commit bc47fcbcf0
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 54 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

22
scripts/dependabot-alerts.mjs
View file

@ -1019,7 +1019,8 @@ export function main(
const securityPrsOff = checkSecurityPrsStillDisabled(repo, spawn);
const groups = groupAlerts(openAlerts(repo, spawn));
const alerts = openAlerts(repo, spawn);
const groups = groupAlerts(alerts);
// ⚠️ Loaded BEFORE the zero-group early return, and reconciled after the loop.
// `openAlerts` asks for `state=open`, so an alert that is FIXED or DISMISSED
@ -1036,8 +1037,23 @@ export function main(
const boardProblems = [];
/** Grouping keys this run actually saw in the open feed. */
const seenKeys = new Set();
/** Every GHSA still open, in ANY group — the check a vanished key needs. */
const openGhsas = new Set(groups.flatMap((g) => g.ghsas));
/**
* Every GHSA still open, taken from the RAW feed rather than from `groups`.
*
* ⚠️ `groupAlerts` deliberately drops an alert with no `first_patched_version`
* — there is nothing to bump to, so nothing to file. Building this set from
* the groups would inherit that filter, so an advisory that stays open but
* LOSES its patched version would vanish from both the keys and this set, and
* reconciliation would call it "fixed or dismissed" (Copilot). Same wrong
* direction as the superseded case, reached a different way: what a still-open
* advisory must never do is stand itself down.
*/
const openGhsas = new Set(
alerts
.filter((a) => a.state === "open")
.map((a) => a.security_advisory?.ghsa_id)
.filter(Boolean),
);
for (const rawGroup of groups) {
seenKeys.add(rawGroup.key);