modelcontextprotocol/inspector
Watch
1
0
Fork
You've already forked inspector
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2

chore(deps): address Copilot review round 12 on #2243

Browse source 
Build the open-GHSA set from the raw alert feed, not from the grouped
alerts. groupAlerts deliberately drops an alert with no
first_patched_version, so an advisory that stays OPEN but loses its
patched version vanished from both the keys and that set — and
reconciliation would have called it "fixed or dismissed".

Same wrong direction as the superseded case fixed last round, reached a
different way: a still-open advisory must never stand itself down.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013H6Cew3KB3jVmQ5x4Dq1sq
Signed-off-by: cliffhall <cliff@futurescale.com>
This commit is contained in:
cliffhall 2026-09-04 08:22:18 -04:00 • committed by GitHub
commit bc47fcbcf0
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 54 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

35
scripts/dependabot-alerts.test.mjs
View file

@ -1415,6 +1415,41 @@ test("main omits the security-PR claim when the token could not read it", () =>
);
});
test("main will not stand down an open alert that lost its patched version", () => {
// groupAlerts drops an alert with no first_patched_version, so the bump's key
// disappears — but the advisory is still OPEN. Reading the open-GHSA set from
// the groups instead of the raw feed would report it as fixed or dismissed.
const [filed] = groupAlerts([alert({ ghsa: "GHSA-a" })]);
const unpatched = alert({ ghsa: "GHSA-a" });
unpatched.security_vulnerability.first_patched_version = null;
const spawn = fakeSpawn({
alertPages: [[unpatched]],
issues: [
{
number: 41,
title: buildIssueTitle(filed),
body: buildIssueBody(filed, asInstalled()),
},
],
});
inTempRepo({ "package-lock.json": lockWith("fast-uri", "3.1.5") }, () =>
withoutProjectToken(() =>
captureLog(() => main("o/r", spawn, "2026-09-04")),
),
);
const edit = ghCall(spawn, "edit");
assert.ok(edit, "the issue is still reconciled");
const body = edit.args[edit.args.indexOf("--body") + 1];
assert.doesNotMatch(
body,
/fixed or dismissed/,
"a still-open advisory must never stand itself down",
);
assert.match(body, /superseded/);
assert.match(body, /`GHSA-a` is still open/);
});
test("main reads every page of open dependabot issues", () => {
// The second page holds the matching marker. Truncating the lookup would
// file a duplicate issue rather than recognising this one.