Repository files (latest commit first)

Filename	Latest commit message	Latest commit date
olaservo 0588ec098e fix(security): bump vulnerable deps; harden git_add (defense-in-depth) ... Real fixes (deps): - python (git/fetch/time): idna 3.10->3.18 (GHSA-65pc), starlette 0.49.1->1.3.1 (GHSA-86qp) - npm: vitest ^2.1.8->^4.1.8 (critical GHSA-5xrq UI server RCE). vitest 4 pulls vite 8 (rolldown, no esbuild), clearing the esbuild/vite advisories natively. Remaining root overrides: qs>=6.15.2 (GHSA-q8mj, via express), hono>=4.12.21 (via @modelcontextprotocol/sdk). - npm audit: 0 vulnerabilities; all TS (313) + Python (git/fetch/time) suites and TS builds pass. Hardening (git_add): - The repo already mitigates CVE-2026-27735 by using repo.git.add (the git CLI rejects out-of-tree paths, PR #3164's fix), not repo.index.add (which did not). Add an explicit path-boundary check in git_add as defense in depth plus regression tests asserting the security invariant (out-of-tree paths are never staged), guarding against a regression to repo.index.add. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>		2026-06-14 13:46:02 -07:00
..
test_server.py	fix(security): bump vulnerable deps; harden git_add (defense-in-depth)	2026-06-14 13:46:02 -07:00