Build request 4/8/26

[jk89]

Upgrading o1js to 3.0.0-mesa.rc2

[github-actions]

⚠️ Workflow Protection Alert

This PR attempts to modify workflow files in .github/workflows/. For security reasons, workflow changes require additional review.

Workflow modifications can introduce security vulnerabilities or bypass branch protections. Please have a repository administrator review these changes.

[github-actions]

Quality Gate Report

Generated: 8/4/2026, 12:20:37 PM

Overall Status: FAIL

Required checks failed:

• npm audit

---

Summary

• Passed: 2
• Failed: 4
• Skipped: 1

---

Detailed Results

Dependencies - PASS

Type: REQUIRED

Message: Dependencies installed successfully

Scripts Check - FAIL

Type: Optional

Message: Missing scripts: test:unit, test:integration

Details

Expected: test:unit, test:integration, test:e2e
Found: test:e2e
Missing: test:unit, test:integration

npm audit - FAIL

Type: REQUIRED

Message: Vulnerabilities found (threshold: moderate)

Hint: npm audit fix

Details

# npm audit report

@babel/core  <=7.29.0
@babel/core: Arbitrary File Read via sourceMappingURL Comment - https://github.com/advisories/GHSA-4x5r-pxfx-6jf8
fix available via `npm audit fix`
node_modules/@babel/core

@babel/plugin-transform-modules-systemjs  7.12.0 - 7.29.0
Severity: high
@babel/plugin-transform-modules-systemjs generates arbitrary code when compiling malicious input - https://github.com/advisories/GHSA-fv7c-fp4j-7gwp
fix available via `npm audit fix`
node_modules/@babel/plugin-transform-modules-systemjs

brace-expansion  <=1.1.17 || 2.0.0 - 2.1.3 || 3.0.0 - 5.0.8
Severity: high
brace-expansion: Large numeric range defeats documented `max` DoS protection - https://github.com/advisories/GHSA-jxxr-4gwj-5jf2
brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups - https://github.com/advisories/GHSA-3jxr-9vmj-r5cp
brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups - https://github.com/advisories/GHSA-3jxr-9vmj-r5cp
brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups - https://github.com/advisories/GHSA-3jxr-9vmj-r5cp
brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash - https://github.com/advisories/GHSA-mh99-v99m-4gvg
brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash - https://github.com/advisories/GHSA-mh99-v99m-4gvg
brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash - https://github.com/advisories/GHSA-mh99-v99m-4gvg
brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation - https://github.com/advisories/GHSA-rgw5-rvv9-x895
brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation - https://github.com/advisories/GHSA-rgw5-rvv9-x895
brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation - https://github.com/advisories/GHSA-rgw5-rvv9-x895
fix available via `npm audit fix`
node_modules/@typescript-eslint/typescript-estree/node_modules/brace-expansion
node_modules/brace-expansion
node_modules/glob/node_modules/brace-expansion

js-yaml  <=3.14.2 || 4.0.0 - 4.2.0
Severity: high
JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases - https://github.com/advisories/GHSA-h67p-54hq-rp68
JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases - https://github.com/advisories/GHSA-h67p-54hq-rp68
js-yaml: YAML merge-key chains can force quadratic CPU consumption - https://github.com/advisories/GHSA-52cp-r559-cp3m
js-yaml: YAML merge-key chains can force quadratic CPU consumption - https://github.com/advisories/GHSA-52cp-r559-cp3m
fix available via `npm audit fix`
node_modules/@istanbuljs/load-nyc-config/node_modules/js-yaml
node_modules/js-yaml

ws  8.0.0 - 8.20.1
Severity: high
ws: Uninitialized memory disclosure - https://github.com/advisories/GHSA-58qx-3vcg-4xpx
ws: Memory exhaustion DoS from tiny fragments and data chunks - https://github.com/advisories/GHSA-96hv-2xvq-fx4p
fix available via `npm audit fix`
node_modules/ws
  ethers  6.0.0-beta.1 - 6.16.0
  Depends on vulnerable versions of ws
  node_modules/ethers

6 vulnerabilities (1 low, 1 moderate, 4 high)

To address all issues, run:
  npm audit fix

Build - PASS

Type: REQUIRED

Message: Build completed successfully

Prettier - FAIL

Type: Optional

Message: 61 file(s) need formatting

Hint: npm run format

Linter - FAIL

Type: Optional

Message: 21 error(s), 0 warning(s)

Hint: npm run lint

Details

> @nori-zk/proof-conversion@0.8.26 lint
> eslint src/*


/home/runner/actions/_work/proof-conversion/proof-conversion/src/groth/adcd3_regression.spec.ts
  67:21  error  '_' is assigned a value but never used  @typescript-eslint/no-unused-vars
  72:18  error  '_' is assigned a value but never used  @typescript-eslint/no-unused-vars
  77:18  error  '_' is assigned a value but never used  @typescript-eslint/no-unused-vars
  90:21  error  '_' is assigned a value but never used  @typescript-eslint/no-unused-vars

/home/runner/actions/_work/proof-conversion/proof-conversion/src/groth/adcd3_vk_regression.spec.ts
  73:27  error  '_' is assigned a value but never used  @typescript-eslint/no-unused-vars
  78:22  error  '_' is assigned a value but never used  @typescript-eslint/no-unused-vars
  83:22  error  '_' is assigned a value but never used  @typescript-eslint/no-unused-vars
  88:20  error  '_' is assigned a value but never used  @typescript-eslint/no-unused-vars

/home/runner/actions/_work/proof-conversion/proof-conversion/src/plonk/recursion/witness_tracker.ts
  29:10  error  'G2Line' is defined but never used  @typescript-eslint/no-unused-vars

✖ 9 problems (9 errors, 0 warnings)

Unit Tests - SKIPPED

Type: Info

Message: test:unit script not found

---

Actionable Insights

• Add unit tests: "test:unit": "for file in $(find . -name '*.unit.spec.ts'); do npm run test -- \"$file\" || exit 1; done"
• Add integration tests: "test:integration": "for file in $(find . -name '*.integration.spec.ts'); do npm run test -- \"$file\" || exit 1; done"
• Fix Vulnerabilities: npm audit fix (or npm audit fix --force for breaking changes)
• Auto-fix formatting: npx prettier --write "**/*.{ts,js,json,md}"
• Linting Errors: Fix the linting errors shown above and run npm run lint locally to verify.

---

Configuration

Quality gate configured via environment variables.

Check	Enabled	Required
Dependencies	true	true
Build	true	true
Scripts	true	false
npm audit	true	true (level: moderate)
Prettier	true	false (dep: prettier)
Linter	true	false (dep: eslint)
Unit Tests	true	false

Note: Integration and E2E tests are checked for existence but run in CI/CD pipeline.

[noriBot-hub]

🔨 Build started for proof-conversion

Commit: 86225c6a44b4520387dcc0946f1b271187b95e10
Workflow: View run details

[noriBot-hub]

✅ Build succeeded for proof-conversion

Commit: 86225c6a44b4520387dcc0946f1b271187b95e10
Workflow: View run details

[noriBot-hub]

🔨 Dispatch build started for proof-conversion-nori

Proof Conversion Version: 0.8.27
Build ID: proof-conversion-61-30908909002-13
Workflow: View run details

[noriBot-hub]

✅ Dispatch build succeeded for proof-conversion-nori

Proof Conversion Version: 0.8.27
Build ID: proof-conversion-61-30908909002-13
Workflow: View run details