Repository navigation
fix([issue-15768]): review runtime advisory matches and preserve upstream blockers - #15791
Merged
Merged
Conversation
atomantic
added
implementer:gpt-6-1-sol
This was referenced Nov 11, 2026
This was referenced Nov 11, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The strict runtime scan reported 72 new package/advisory pairs. Record evidence for each exact version: eight PostgreSQL OpenSSL 3.0 matches are upstream-excluded ranges; 64 remain explicitly blocked by Debian backports and compatible upstream images in #15788. Detailed primary-source and runtime-path analysis is in
docs/RUNTIME_ADVISORY_TRIAGE.md.Correct earlier GSS rationales: PostgreSQL can process a GSSENCRequest before pg_hba authentication, so default SCRAM cannot establish unreachability. Keep existing blocked dispositions, GSS compatibility, image/snapshot pins, volume format and scan validation.
Validation:
npm run pregatepassed.Local review: gpt-6.1-terra, two rounds, clean on
2018244049ad6a9a60d555bab8cf33aaacd36ac4; no findings. The completion head is the same inspected commit. A passing reconciliation remains a reviewed vulnerability inventory, not a zero-vulnerability claim; the external eidoverse parent coverage gap remains reported.Hosted CI limitation: Browser suites (2/2) failed the pre-existing footage pixel parity assertion (mean RGB error 88.126 vs <0.3) in a data/docs-only synthetic merge. A single macOS 26.6.2 / Chrome 157.0.8103.40 headless focused check passed; that does not prove a flake cause. Investigation and missing comparison diagnostics are tracked in #15795. The required check remains unresolved; no assertion changes or reruns were made in this lane.
Closes #15768
Hosted CI recovery
Initial ordinary CI failed a footage pixel-parity assertion in browser shard 2. The complete parity suite passed 17/17 once on macOS/Chrome headless; this is non-reproduction, not a diagnosis. One same-head failed-jobs diagnostic rerun passed: attempt 2. The two distinct hosted footage failures and missing diagnostic artifacts remain tracked in #15795; no assertion, deadline or required check was relaxed.
The independent fresh strict image scan passed all five targets; downloaded artifacts were independently bound to the exact head/run, image/source, recipe and database metadata, with zero unreviewed pairs.