[WRONG BRANCH] release: refresh preview onto the audit-clean dev head for v2.41.0-preview.20260903 - #3347
Conversation
The carry-attribution scanner stripped HTML comments with a pattern that required the closing delimiter. An unterminated `<!--` therefore matched nothing and the entire tail stayed in the scanned text, while GitHub renders none of it. That is a divergence between what the gate enforces and what a reader sees, and it runs both ways: a carry claim the gate reads but nobody can see, or one the gate misses because an author closed the comment somewhere the scanner did not expect. pr-quality.cjs already got this right - its comment pattern carries the `(?:-->|$)` alternative for exactly this reason - so this is the two files agreeing rather than a new rule. CodeQL raised it as js/incomplete-multi-character-sanitization (high) on the v2.41.0 promotion. Its own framing does not apply: this output is fed to a regex, never to a renderer, so there is no HTML element injection here. The underlying observation is still correct for what the strip is actually for. Two regression tests, one per direction: carry language after an unclosed comment is ignored, and carry language after a properly closed one is still read - the guard must not swallow the body wholesale. Verification: node --test .github/scripts/*.test.cjs 543 pass 0 fail; bun test tests/ci-workflows.test.ts 135 pass 0 fail. Co-authored-by: jun <jun@lidge.dev>
…VEs (#3313) (#3346) fast-uri 3.1.5 carries four high-severity advisories, all reachable through @modelcontextprotocol/sdk > ajv > fast-uri: host confusion via skipped IDN canonicalization, SSRF via malformed IPv6 normalization, SSRF via repeated hostname percent-decoding, and host confusion via percent-encoded scheme normalization. qs 6.15.3 carries two moderate ones. This is not a latent finding. The v2.41.0-preview publish dispatched today failed in release.yml's own dependency-audit step (run 33738740649), which is the gate working as designed: a release cannot go out carrying four high advisories. The fix has to land on dev before the release train can move. Carried from #3314 by agentHits, who found it and wrote the overrides. Landed directly because the release is blocked on it and that PR's contributor readiness gate cannot clear from a fork. Verification: bun run audit:high clean at both levels (143 and 81 packages); bun test tests/repo-hygiene.test.ts passes. Closes #3313 Co-authored-by: jun <jun@lidge.dev> Co-authored-by: agentHits <zvercombat26rus@icloud.com>
…3345) The guard timed a single parse against a 50ms budget. On a loaded macOS runner that sample came back at 53.77ms and failed the v2.41.0 promotion, for a parse whose subject regression is 522ms — three orders of magnitude away. A first call also carries regex compilation and JIT warm-up that the parse itself does not. A gate that fires on runner weather teaches everyone to re-run it, which is exactly how a real ReDoS regression would get waved through. Best-of-N is the right statistic here, and that is measured rather than assumed. Running the semver.org prerelease pattern this module replaced, three runs each: 17.4-17.6ms at 20 repetitions, then 491-545ms at 30, 39 and 45. The blowup is on every run with under 10% spread, because superlinear backtracking is a property of the pattern; the 4ms of jitter that broke the single-sample form is not. If the exponential path returns, no run is fast. The measurements are in the test file, so the next person to touch the budget can see what it is actually separating. Verification: bun test tests/strict-semver.test.ts 7 pass 0 fail; bun run typecheck exit 0. Co-authored-by: jun <jun@lidge.dev>
|
✅ Deterministic PR hygiene checks passed. |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
github-actions
Bot
changed the title
⏳ DRAFT
What to do
Its title has been prefixed with |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Team Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (4)
Included review availability: Your plan provides up to 10 included reviews per hour; 5 remain after this review. 📝 WalkthroughWalkthroughThe pull request updates HTML comment handling, adds attribution coverage, refreshes two dependency overrides, and changes semver performance tests to use repeated best-of-five timing measurements. ChangesHTML comment attribution parsing
Dependency override updates
Semver performance test stabilization
Estimated code review effort: 3 (Moderate) | ~20 minutes Merge Risk: ⚪ Minimal · up to This updates dependency overrides, makes semver timing checks less sensitive to measurement noise, and correctly ignores attribution text after unclosed HTML comments. No current merge-blocking risk remains. 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
Full details: Docstring CoverageExplanation Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 3 files. (1 skipped: 1 unsupported.) Full details: Title checkExplanation The title clearly describes the main change: refreshing the preview branch onto the audit-clean dev head for the specified v2.41.0 preview release. The "[WRONG BRANCH]" prefix adds noise but does not make the title misleading. ✨ Finishing Touches 💡 1🛠️ Fix failing CI checks 💡
📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 1017867370
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| * this output is matched by regex, never rendered — but the underlying | ||
| * observation, that the strip is incomplete, is correct for this gate's purpose. | ||
| */ | ||
| const HTML_COMMENT_RE = /<!--[\s\S]*?(?:-->|$)/g; |
There was a problem hiding this comment.
When a PR body contains a literal <!-- inside inline code before a visible carry declaration—for example, The token \<!--` starts a comment. Supersedes #2797.—this new end-of-input alternative treats the code-span content as an unclosed HTML comment and removes the declaration before referencedCarryNumbers` scans it. GitHub renders the opener literally inside the code span, so the missing-attribution gate incorrectly passes and can allow the contributor credit to be lost; protect/remove inline code before comment stripping, or use a Markdown-aware scanner, and add this case to the regression tests.
AGENTS.md reference: AGENTS.md:L266-L276
Useful? React with 👍 / 👎.
리뷰 · 우선순위 74 / 80이 PR은 제품 기능을 새로 넣지 않습니다. 왜 지금이냐면, 오늘 첫 현재 자동 게이트가 제목에 .github/scripts/pr-carry-attribution.cjs HTML_COMMENT_RE - 메인테이너의 판단이 필요한 지점
너의 추천 이 댓글은 grok-bot이 작성했습니다 |
1 participant
Summary
previewonto the currentdevhead (1f00ff52b) so the2.41.0-preview.20260903publish can complete. The version was already set by [WRONG BRANCH] release: v2.41.0-preview.20260903 #3341; this brings the three fixes that landed after it.release.yml's dependency-audit step on four highfast-uriadvisories. That is the gate doing its job, and it is what these three commits close:2b5a38aaffast-uri→ ^3.1.7 andqs→ ^6.16.0;audit:highclean, which is the step that failed1f00ff52bb15cbb2c3Merges cleanly; no conflict this time, since #3341 already resolved the version.
Verification
bun run audit:high—No vulnerabilities foundat both levels (143 packages root, 81 GUI). Same command the release workflow failed on.d7de528cd) already carried push-eventCross-platform CIandService lifecycleto success; this PR's head has to clear them again before the next dispatch, which is the gaterelease.yml:222requires.Screenshot
Carries the Meta provider mark from #3338:
Checklist
Summary by CodeRabbit
Bug Fixes
Tests
Chores