chore(stack): restack guarded restore on digest provider root - #386
Conversation
Non-destructively retain the canonical #299 two-file CI/TDD delta while inheriting protected main@3b38ead2d00f44eb578d0689087b9293b3dabe1e, including the v0.6.0 release exact-checkout repair. No release identity or protected-main state is changed.
…ive-overrides-20260820 fix(security): raise transitive dependency floors
- Add set -euo pipefail and fail-closed registry lookups (npm, PyPI isolated mode with explicit public index) - Add open-issue queue query excluding PR duplicates; refresh candidate PR set to the live open queue - Paginate REST file/review/check-run calls and GraphQL reviewThreads beyond the first 100 results
…tes-298 fix(ci): run exact-head gates on stacked pull requests
…al-gap-baseline-20260820 docs: add product-technical gap baseline
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
| # (published months before trusted-publishing adoption) installable without | ||
| # exempting current package names or disabling lockfile verification. | ||
| blockExoticSubdeps: true | ||
| minimumReleaseAge: 10080 |
There was a problem hiding this comment.
🔍 Release-age gate versus frozen-lockfile installs
minimumReleaseAge: 10080 blocks versions published under 7 days ago (pnpm-workspace.yaml). CI installs with --frozen-lockfile. If a freshly bumped patch (fast-uri, nanoid, postcss) is newer than the window, installs can be refused. Confirm the pinned pnpm exempts locked versions from the age gate.
Was this helpful? React with 👍 or 👎 to provide feedback.
| @@ -4,7 +4,6 @@ on: | |||
| push: | |||
| branches: [main] | |||
| pull_request: | |||
There was a problem hiding this comment.
📝 Info: CI now runs for PRs against any base
Dropping branches: [main] from the pull_request trigger makes CI run for PRs against any base branch, enabling stacked-PR coverage. The new exact-head test asserts this. Behavior change noted.
Was this helpful? React with 👍 or 👎 to provide feedback.
| const resolvedEntry = realpathSync(fileURLToPath(import.meta.resolve('${packageJson.name}'))); | ||
| assertInsideConsumer(resolvedEntry, 'packed ESM entry escaped consumer tree'); | ||
| const packageRelative = relative(${JSON.stringify(packageDirectory)}, resolvedEntry); | ||
| const packageRelative = relative(packedPackageDirectory, resolvedEntry); | ||
| assert.equal(isAbsolute(packageRelative), false); | ||
| assert.equal( | ||
| packageRelative === '..' || packageRelative.startsWith('..' + sep), | ||
| false, | ||
| ); | ||
| const editor = await import(pathToFileURL(resolvedEntry).href); |
There was a problem hiding this comment.
📝 Info: Package execution now gated on containment
The ESM/CommonJS verifiers resolve and canonicalize the entry, assert containment, then dynamically import/require. This removes the prior window where a static import executed package code before the containment check. The new symlink-escape tests confirm rejection before execution.
Was this helpful? React with 👍 or 👎 to provide feedback.
abe84db
into
fix/if-match-digest-preflight-276
1 participant
Non-destructive stack maintenance only. Merge current parent
fix/digest-provider-preflight-221@09f941c8a34eaf9461dd27fc185d64f158f9cf94into childfix/if-match-digest-preflight-276@bdc7f55bd9c47d99dd192352721b471df35bbe4c. Preserve #277 ownership as exactly its two guarded-restore paths while inheriting the protected-main synchronization now present in #222. No force push or destructive rebase.