fix(security): block r2-direct manifest jsonb poison path - #3206

Merged

riderx merged 32 commits into

mainfrom

cursor/fix-manifest-poison-r2-direct-6e3f

Aug 27, 2026

Commits on Aug 26, 2026

fix(security): block r2-direct manifest jsonb poison path

cursoragent
and
riderx
committed
d21b751
test: fix manifest poison and swap cleanup regressions

cursoragent
and
riderx
committed
5c4845f
fix(security): block r2-direct manifest jsonb smuggle on finalize

cursoragent
and
riderx
committed
b1fb82f
test: align manifest s3_path in audit skip regression

cursoragent
and
riderx
committed
b5ecdd4
test: use canonical r2_path in audit fat-fields regression

cursoragent
and
riderx
committed
6d6a5ae
test: fix audit fat-fields regression for r2-direct manifest lock

cursoragent
and
riderx
committed
26f2ad4
test: assert set_manifest inserts rows after jsonb block

cursoragent
and
riderx
committed
58da280
ci: retrigger test workflow

cursoragent
and
riderx
committed
640dd0d
fix(security): block r2-direct manifest jsonb on INSERT too

cursoragent
and
riderx
committed
cfbc5c5
test: fix audit fat-fields setup for r2 content lock

cursoragent
and
riderx
committed
a0b5fee
ci: retrigger test workflow

cursoragent
and
riderx
committed
57d6ddd
test: guard set_manifest cleanup when version insert fails

cursoragent
and
riderx
committed
64d5c96
ci: retrigger tests after flaky organization-api shard

cursoragent
and
riderx
committed
0700671
ci: retrigger full test suite

cursoragent
and
riderx
committed
01adafa
fix(db): re-stamp r2-direct manifest guard migration after main advance

cursoragent
and
riderx
committed
2eb2f07
ci: retrigger tests (no concurrent pushes)

cursoragent
and
riderx
committed
ec08b82
ci: retry after flaky cloudflare workers shard

cursoragent
and
riderx
committed
6cbcf99
ci: final test run

cursoragent
and
riderx
committed
57fd9d5
fix(db): document manifest helper profile and satisfy SQLFluff LT05

cursoragent
and
riderx
committed
f00a2af
fix(db): re-stamp r2-direct manifest guard after sso migration on main

cursoragent
and
riderx
committed
5fd7081
ci: sync CodeRabbit bot trigger workflow from main

cursoragent
and
riderx
committed
9cf1b2c
ci: reduce CodeRabbit trigger workflow pull-request permissions to read

cursoragent
and
riderx
committed
2a3b8ee
ci: document why CodeRabbit trigger workflow needs pull-requests write

cursoragent
and
riderx
committed
faf2d4a
merge: sync main into cursor/fix-manifest-poison-r2-direct-6e3f

cursoragent
and
riderx
committed
e8b66bd
ci: retry CodeRabbit trigger when prior attempt had no review on HEAD

cursoragent
and
riderx
committed
b8b72b9
ci: use push SHA for CodeRabbit trigger marker

cursoragent
and
riderx
committed
77a039e
merge: sync main into cursor/fix-manifest-poison-r2-direct-6e3f

cursoragent
and
riderx
committed
6b7803d
ci: allow CodeRabbit trigger retry when review is CHANGES_REQUESTED

cursoragent
and
riderx
committed
a751277
test: retry Cloudflare worker-restart 503 in fetchTestRequest

cursoragent
and
riderx
committed
fecfb60
test: restrict fetchTestRequest retries to safe methods by default

cursoragent
and
riderx
committed
a827a89
ci: retry CodeRabbit trigger until review is APPROVED

cursoragent
and
riderx
committed
a7263a9
ci: retrigger CodeRabbit review after rate limit window

cursoragent
and
riderx
committed
67dad7c

Navigation Menu

Uh oh!

Uh oh!

fix(security): block r2-direct manifest jsonb poison path - #3206

fix(security): block r2-direct manifest jsonb poison path#3206
riderx merged 32 commits into
mainfrom
cursor/fix-manifest-poison-r2-direct-6e3f

Commits on Aug 26, 2026

fix(security): block r2-direct manifest jsonb poison path

test: fix manifest poison and swap cleanup regressions

fix(security): block r2-direct manifest jsonb smuggle on finalize

test: align manifest s3_path in audit skip regression

test: use canonical r2_path in audit fat-fields regression

test: fix audit fat-fields regression for r2-direct manifest lock

test: assert set_manifest inserts rows after jsonb block

ci: retrigger test workflow

fix(security): block r2-direct manifest jsonb on INSERT too

test: fix audit fat-fields setup for r2 content lock

ci: retrigger test workflow

test: guard set_manifest cleanup when version insert fails

ci: retrigger tests after flaky organization-api shard

ci: retrigger full test suite

fix(db): re-stamp r2-direct manifest guard migration after main advance

ci: retrigger tests (no concurrent pushes)

ci: retry after flaky cloudflare workers shard

ci: final test run

fix(db): document manifest helper profile and satisfy SQLFluff LT05

fix(db): re-stamp r2-direct manifest guard after sso migration on main

ci: sync CodeRabbit bot trigger workflow from main

ci: reduce CodeRabbit trigger workflow pull-request permissions to read

ci: document why CodeRabbit trigger workflow needs pull-requests write

merge: sync main into cursor/fix-manifest-poison-r2-direct-6e3f

ci: retry CodeRabbit trigger when prior attempt had no review on HEAD

ci: use push SHA for CodeRabbit trigger marker

merge: sync main into cursor/fix-manifest-poison-r2-direct-6e3f

ci: allow CodeRabbit trigger retry when review is CHANGES_REQUESTED

test: retry Cloudflare worker-restart 503 in fetchTestRequest

test: restrict fetchTestRequest retries to safe methods by default

ci: retry CodeRabbit trigger until review is APPROVED

ci: retrigger CodeRabbit review after rate limit window