cliffhall
5c65bd2bfa
chore(deps): address Copilot review round 3 on #2243 ...
Derive the remediation from WHICH copies are vulnerable, not from
whether the package is declared. A manifest can declare a safe `pkg@4`
while a dependency drags a vulnerable `pkg@3` into a nested folder; the
old boolean called that "direct" and asked for a range bump that would
have changed nothing, omitting the override the nested copy needs.
- `lockfileEntries` keeps each copy's tree path and whether it is the
hoisted one; `lockfileVersions` is now derived from it.
- `remediation(affected, declared)` returns both flags, so the issue can
ask for a range bump, an overrides pin, or explicitly both. The body
lists the vulnerable copies and their paths.
- An undeclared hoisted copy counts as transitive: it got there the same
way any other transitive copy did, and no declared range reaches it.
(Found by a test written for this change.)
The `vulnerability-alerts: read` finding is declined — verified against
a real runner, which reports `VulnerabilityAlerts: read` and reads the
alerts successfully. See the PR comment for the log.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013H6Cew3KB3jVmQ5x4Dq1sq
Signed-off-by: cliffhall <cliff@futurescale.com>
2026-09-04 09:06:32 -04:00
docs: address Copilot review round 9 on #2203
2026-09-01 13:02:14 -04:00
chore(deps): address Copilot review round 3 on #2243
2026-09-04 09:06:32 -04:00
chore(deps): address Copilot review round 3 on #2243
2026-09-04 09:06:32 -04:00
chore(deps): address Copilot review round 1 on #2243
2026-09-04 09:06:32 -04:00
chore(deps): paginate the release list so the highest version is actual
2026-09-04 09:06:31 -04:00
feat: port CLI, TUI, and launcher from v1.5 into v2 ( #1452 )
2026-06-14 20:27:49 -04:00
fix(smoke): reject an empty SMOKE_BROWSER; test the installer's argument logic
2026-08-25 22:52:02 -04:00
fix(smoke): reject an empty SMOKE_BROWSER; test the installer's argument logic
2026-08-25 22:52:02 -04:00
ci: drop the Firefox smoke job; keep the engines as an on-demand tool
2026-08-25 23:55:19 -04:00
fix(smoke): route the Chromium tier through ENGINE_SMOKES too
2026-08-26 08:55:51 -04:00
Merge remote-tracking branch 'origin/v2/main' into v2/chore/2146-rename-local-gate
2026-08-27 00:16:14 -04:00
docs: accept several skill names in skills:eval and re-aim overlapping cases
2026-09-01 00:18:43 -04:00
docs: address Copilot review round 2 on #2203
2026-09-01 10:32:41 -04:00
chore(scripts): build test-servers unconditionally from one shared helper
2026-08-25 00:57:48 -04:00
refactor: self-validating clients, fast validate + separate coverage/smoke ( #1504 ) ( #1505 )
2026-06-21 11:41:33 -04:00
fix(scripts): make the test stubs drain, and the raw-mode guard testable ( #2147 )
2026-08-26 22:13:35 -04:00
chore(scripts): rename the local pre-push gate off ci, and guard it out of CI ( #2146 )
2026-08-26 23:56:34 -04:00
chore(scripts): rename the local pre-push gate off ci, and guard it out of CI ( #2146 )
2026-08-26 23:56:34 -04:00
Merge remote-tracking branch 'origin/v2/main' into v2/chore/2146-rename-local-gate
2026-08-27 00:16:14 -04:00
Merge remote-tracking branch 'origin/v2/main' into v2/chore/2146-rename-local-gate
2026-08-27 00:16:14 -04:00
fix(smoke): await the server's exit before removing its catalog, and test it
2026-08-11 14:32:20 -04:00
chore(scripts): rename the local pre-push gate off ci, and guard it out of CI ( #2146 )
2026-08-26 23:56:34 -04:00
test(proxy): isolate proxy env per file; word the guard failure by candidate source
2026-08-23 23:00:28 -04:00
test(proxy): isolate proxy env per file; word the guard failure by candidate source
2026-08-23 23:00:28 -04:00
Merge origin/v2/main: move the #1939 npx fix into the shared tsc-program lib
2026-08-16 17:07:50 -07:00
chore(scripts): compare only the copies a program actually met
2026-08-16 12:35:38 -04:00
chore(scripts): compare only the copies a program actually met
2026-08-16 12:35:38 -04:00
chore: address Copilot review round 20
2026-08-29 05:32:12 -04:00
chore: address Copilot review round 9
2026-08-29 03:04:03 -04:00
chore: address Copilot review round 17
2026-08-29 04:54:04 -04:00
chore: address Copilot review round 16
2026-08-29 04:40:48 -04:00
docs: address Copilot review round 4 on #2203
2026-09-01 11:14:06 -04:00
chore: address Copilot review round 20
2026-08-29 05:32:12 -04:00
Merge origin/v2/main: move the #1939 npx fix into the shared tsc-program lib
2026-08-16 17:07:50 -07:00
Merge origin/v2/main: move the #1939 npx fix into the shared tsc-program lib
2026-08-16 17:07:50 -07:00
chore(scripts): derive dep-lockstep candidates from what enters each tsc program
2026-08-16 12:17:15 -04:00
5c65bd2bfa