Skip to content

fix(lib): bound the memory cache, follow fetch redirect rules, lint chained test modifiers - #2447

Merged
Makisuo merged 18 commits into
chore/audit-selfhost-cifrom
fix/audit-libraries
Nov 10, 2026
Merged

Makisuo merged 18 commits into
chore/audit-selfhost-cifrom
fix/audit-libraries

Merge branch 'chore/audit-selfhost-ci' into fix/audit-libraries

b394a3d
Select commit
Loading
Failed to load commit list.
Maple Review Bot / Maple / review succeeded Nov 10, 2026 in 2m 50s

Confidence 10/10 · No issues found

🟢 Confidence 10/10 · safe to merge. Eviction, redirect and lint fixes are pinned by new tests; only the deliberate one-character truncate duplication (F1) is left open.
1 note · tests covered · risk medium

Bounds the in-memory cache backend, makes non-strict redirects follow the fetch standard, and stops test-slop skipping chained test modifiers, plus a shared-helper cleanup across email, status-page and chat-platform. Safe to merge; only the deliberate one-character truncate duplication (F1) stays open.

  • makeMemoryBackend sweeps expired entries on put once the map doubles past 256
  • Non-strict redirects now turn 301/302 POST and 303 non-GET into a body-less GET
  • escapeHtml and truncate move to @maple/strings; email keeps its own truncate
  • test-slop walks chained modifiers such as it.effect.each(rows)

Still open from earlier reviews

Production impact

Production traffic of the changed files (last 7 days)
File Calls/day Busiest operations
lib/safe-fetch/src/index.ts 3.1k POST 1.4k/day, 0.2% err
POST 1.3k/day, 0.1% err
GET 310/day, 0.1% err
lib/oxlint-config/plugins/test-slop.mjs 18 test 18/day, 15.4% err
What was checked
  • sweepExpired deletes only entries past expiresAt; the new test keeps a live key and bounds size()
  • fetchRedirectRequest is applied after the unchanged cross-origin credential stripping (lib/safe-fetch/src/index.ts:386)
  • Deleted escalationStepCount, blockRefs, MAX_STRING_LITERAL_BYTES and the un-exported helpers have no remaining users (grep at head)

b394a3d · Reply "won't fix" to dismiss a finding, or mention @maple-review-bot to ask about one.