Repository navigation
v1.91.122.0 fix(deps): clear the 2026-11-30 OSV suppressions, replace #3228, exempt dependabot from Version Gate rule 1 - #3239
Merged
Conversation
Delete the hono, @anthropic-ai/sdk (#2754) and sprintf-js ignores, which the lockfiles no longer match. Override image-size to 2.0.4 (#2753) and chokidar to 4.0.3 in lib/diagram-render (drops braces), and delete those ignores. Re-date katex to 2027-01-31: its fix is outside mermaid 11's range (mermaid-js/mermaid#8388). html-to-docx 1.8.0 bundles its own image-size 1.x, which the override cannot reach and whose ICNS parser loops forever. make-pdf --to docx now hands it only PNG, JPEG, GIF, WebP or SVG bytes. A golden docx test proves the Word output is unchanged. Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
…c SDKs to patches Replaces dependabot #3228 without its agent-sdk 0.3 and sdk 0.133 bumps, which break typecheck:test and overlay-sdk-cancel-eof. Their 0.x breaking releases are semver-minor to dependabot, so the ignore covers minor and major. @types/bun 1.4.3 retires 18 test type diagnostics; the baseline locks that in. Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
…rule 1 Dependabot never edits VERSION, so hard rule 1 failed every package.json PR it opened. The workflow now passes the PR author and changed-file list; the gate skips rule 1 only for dependabot[bot] when every file is a package.json, bun.lock(b) or .github/dependabot.yml. A failed file lookup keeps the rule. Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
|
😎 This pull request was merged. |
Contributor
E2E Evals: ❌ FAIL121 executed, 0 reused rule/judge records | 0 manual accepted (unscored; no score-cache credit) | $94.66 rule/judge cost | reconcile exit: 1 Profile: pr / mode Full gate restored by:
Derived dependents (scripts/pr-dependencies.ts):
Rule and judge shards
Fail-closed reconciliationSliced lane: planner → duration-packed executors → fail-closed report. Behavior cases run a pre-registered 3-trial panel (PASS at 2/3 with no contract violation); a PASS 2/3 is shown with its failed trial, never as a clean pass. Reused results retain their original provenance and expiry. Failures and split verdicts |
…rmats Review found three spellings that got past the regex guard and still hung --to docx: a data-src decoy, a percent-encoded separator, and an unquoted encoded colon. html-to-docx sizes images on three paths, and buildImage URI-decodes the whole src first. The guard now mirrors all three, drops ICNS (the only input its bundled image-size routes to the looping parser) instead of allowlisting formats, so BMP and TIFF embed as before, and re-parses the result with html-to-docx's own html-to-vdom to fail closed on anything the regex misreads. The golden test tolerates CRLF checkouts on Windows. Version Gate treats a failed file lookup as an empty list, so a partial paginated result cannot decide the exemption. Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
capy-ai
Bot
changed the title
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
capy-ai
Bot
changed the title
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> # Conflicts: # CHANGELOG.md # VERSION # agents-digest/gstack-AGENTS.md # package.json
Contributor
|
Merged by GStack Minder as 9dea818 (v1.91.122.0) under a named exception from Garry ("Accept all recommendations", 2026-10-17). The exception covered the single paid-gate red outside this diff: tpa-absent-linux in run 39011101113, 131/132. The three earlier runs each failed a different unrelated case: ship-exploratory-plan-checks (39002269281), plan-mode-no-op (39004466422) and qa-functional-webhook-report (39006896632). Every other check passed at 599d3f0. These single-trial reds are W3's subject in fix wave 3. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Main CI goes red on 2026-11-16: all seven
.osv-scanner.tomlsuppressions sayignoreUntil = 2026-11-30, andtest/osv-ignore-expiry.test.tsfails 14 days early. This clears six of them and re-dates the seventh, replaces dependabot #3228 by hand, and stops Version Gate from failing every dependabot package.json PR. Unstamped; the version slot comes from the queue.OSV suppressions
Verified with osv-scanner 2.7.0 on both lockfiles. Before: 4 findings with no config, and three ignores reported as unused. After: one finding (katex, ignored), no unused ignores,
No issues found.overrides: image-size 2.0.4; both ignores deleted.lib/diagram-renderoverrides chokidar to 4.0.3 (sass's only use of it, never bundled), which removes braces. A rebuild of the bundle with and without the override gives the same sha256, sodist/is untouched. Ignore deleted.^0.16.47. Mermaid 12 accepts it, but@excalidraw/mermaid-to-excalidraw2.2.2 needs mermaid ^11, and katex 0.18 renames its CSS classes. Upstream: mermaid-js/mermaid#8388.html-to-docx ships its own image-size
html-to-docx 1.8.0 bundles its own image-size 1.x copy into
dist/, so the override fixes the lockfile but not the code that runs. That copy hangs forever on the GHSA-w3rx ICNS input (reproduced: 24-byte crafted buffer,HTMLtoDOCXnever returns; image-size 2.0.4 throwsInvalid ICNS). Its detector sends a buffer to the ICNS parser exactly when the first four bytes areicns, and no other parser in that copy has a known advisory.The new
make-pdf/src/docx-images.tsruns before conversion:srcand URI-decode the payload.buildImageURI-decodes the wholesrcfirst.<img>that would hand ICNS bytes to the sizer, with a warning. Every other format embeds exactly as before.<img>would still size ICNS bytes, it throws, so a tag the regex misreads fails closed instead of hanging.make-pdf/test/docx-image-size.test.tscovers this:word/document.xmlwas captured before the override from a PNG, a JPEG and a GIF. The test checks it, plus the EMU extents and the media bytes. It passes before and after.data-srcdecoy, a percent-encoded payload,%3Band%3A. PNG and BMP are kept.alt=">"tag that the regex misreads throws through the real parser.generate()on an ICNS file named.pngplus an inline ICNS data URI and gets two warnings and no hang. Without the guard, this case is killed at the timeout.Still open (in TODOS.md, #2753 residual, revisit 2026-12-15): with
--allow-network, html-to-docx downloads remote images and sizes them with the bundled copy.Dependencies (replaces #3228)
@types/bun1.4.2 → 1.4.3 andprettier3.9.9 → 3.9.10.format:cso:checkis clean. The new types retire 18 test type diagnostics, so the baseline shrinks. Oneas constintest/ceo-finding-fixture.test.tskeeps atest.eachtable typed as tuples..github/dependabot.ymlignores semver-minor and semver-major updates for@anthropic-ai/claude-agent-sdkand@anthropic-ai/sdk. Their breaking 0.x releases (0.2 → 0.3, 0.78 → 0.133) count as minor to dependabot, so ignoring majors alone would not stop build(deps-dev): bump the development-dependencies group across 1 directory with 4 updates #3228 from coming back. Patch updates still flow.--frozen-lockfileunder Bun 1.4.2, the version CI pins.Version Gate: dependabot exemption
scripts/compare-pr-version.tshard rule 1 (VERSION above base) failed every dependabot package.json PR. The workflow now passesPR_AUTHOR(github.event.pull_request.user.login) andPR_CHANGED_FILES(paginatedpulls/N/files, read-only token). Rule 1 is skipped only when the author isdependabot[bot]and every changed file is apackage.json,bun.lock/bun.lockbat any depth, or.github/dependabot.yml. An empty or failed file lookup keeps the rule (a failed paginated call empties the list), and the collision rule is unchanged.test/compare-pr-version.test.tsruns the script for human authors, mixed files, look-alike names (evil-package.json,package.json.bak), a missing author or file list, a bumped dependabot collision, and the workflow wiring.Gate edits
scripts/compare-pr-version.ts+.github/workflows/version-gate.yml: new dependabot exemption to hard rule 1, described above.test/osv-ignore-expiry.test.ts: the OSV ignore ledger: image-size (no fixed release) via html-to-docx — re-justify by 2026-11-30 #2753 test asserted that both image-size ignores exist. It now asserts they are gone,overrides['image-size'] === '2.0.4', and the lock resolves 2.0.4 with no 1.x. The expiry window test and the 14-day threshold are unchanged.test/osv-config-wiring.test.ts: adds an assertion thatlib/diagram-renderoverrides chokidar to 4.x and its lock has no braces. The existing conditional braces-page test is unchanged.test/workflow-action-pins.test.ts: adds an assertion for the Anthropic SDK dependabot ignores.test/ceo-finding-fixture.test.ts: oneas constso atest.eachtable types as tuples under @types/bun 1.4.3. Runtime behavior is unchanged.tsconfig.test.json: includes the newmake-pdf/src/html-to-vdom.d.ts.scripts/typecheck-test-baseline.json: 18 fixed diagnostics removed (allowance only shrinks; regenerated with--write-baseline)..osv-scanner.toml: 6 suppressions removed, 1 re-dated with reason and upstream link.Fixes #2754. #2753 stays open for the
--allow-networkgap: html-to-docx still downloads remote images and sizes them with its bundled image-size 1.x copy (TODOS, revisit 2026-12-15).