-
Notifications
You must be signed in to change notification settings - Fork 4
[MAIN-HEALTH-SEC-002] Restore dependency security gates #3673
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Draft
ootakazuhiko
wants to merge
15
commits into
main
Choose a base branch
from
security/main-high-audit-recovery-20260730
base: main
Could not load branches
Branch not found: {{ refName }}
Loading
Could not load tags
Nothing to show
Loading
Are you sure you want to change the base?
Some commits from the old base branch may be removed from the timeline,
and old review comments may become outdated.
Draft
Changes from all commits
Commits
Show all changes
15 commits
Select commit
Hold shift + click to select a range
b4f09b0
fix(deps): update direct vulnerable dependency families
ootakazuhiko 4a37159
fix(deps): remediate transitive advisory chains
ootakazuhiko 5f2bc37
test(security): verify dependency remediation compatibility
ootakazuhiko b7a0f1c
fix(deps): stabilize patched lockfile peer snapshots
ootakazuhiko 777cc03
fix(ci): include dependency patches in sparse validation
ootakazuhiko d112551
test(security): enforce dependency compatibility in verify lite
ootakazuhiko c5807f7
fix(ci): package dependency patches in container builds
ootakazuhiko ea13478
fix(ci): preserve verify-lite summary on compatibility failure
ootakazuhiko 585498c
fix(ci): record dependency compatibility evidence
ootakazuhiko ec6c544
fix(ci): install complete container test workspace
ootakazuhiko 363b6d2
chore(deps): normalize minimatch patch metadata
ootakazuhiko e35e690
fix(test): tolerate volatile local profile state
ootakazuhiko 40a2b79
fix(deps): align lock with reproducibility install
ootakazuhiko 30e827c
fix(ci): let flake detection observe completed suites
ootakazuhiko 0589751
fix(ci): isolate reusable SBOM concurrency
ootakazuhiko File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -34,6 +34,7 @@ jobs: | |
| spec | ||
| .ae | ||
| packages/spec-compiler | ||
| patches | ||
| src | ||
| scripts/ci | ||
| configs/tsconfig | ||
|
|
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,8 @@ | ||
| diff --git a/minimatch.js b/minimatch.js | ||
| index fe1f3b2df9e62f545bfac4728492424f035c2455..68461f3d2af273e8218e55b1ef34a32341dc6556 100644 | ||
| --- a/minimatch.js | ||
| +++ b/minimatch.js | ||
| @@ -10 +10,2 @@ var GLOBSTAR = minimatch.GLOBSTAR = Minimatch.GLOBSTAR = {} | ||
| -var expand = require('brace-expansion') | ||
| +var braceExpansion = require('brace-expansion') | ||
| +var expand = braceExpansion.expand || braceExpansion |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,8 @@ | ||
| diff --git a/minimatch.js b/minimatch.js | ||
| index 731ed17c6852768f4e1636aabbf532c30dcbca5e..1aa15de4ca94ec418a282815f008fbe7b545ace4 100644 | ||
| --- a/minimatch.js | ||
| +++ b/minimatch.js | ||
| @@ -19 +19,2 @@ minimatch.GLOBSTAR = GLOBSTAR | ||
| -const expand = require('brace-expansion') | ||
| +const braceExpansion = require('brace-expansion') | ||
| +const expand = braceExpansion.expand || braceExpansion |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,32 @@ | ||
| diff --git a/dist/commonjs/index.js b/dist/commonjs/index.js | ||
| index c12dc5e6476874f9dbba429a19e445a4a688e1df..0cf188263ad4214155e167ae3f404a65c09bc551 100644 | ||
| --- a/dist/commonjs/index.js | ||
| +++ b/dist/commonjs/index.js | ||
| @@ -4,7 +4,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) { | ||
| }; | ||
| Object.defineProperty(exports, "__esModule", { value: true }); | ||
| exports.unescape = exports.escape = exports.AST = exports.Minimatch = exports.match = exports.makeRe = exports.braceExpand = exports.defaults = exports.filter = exports.GLOBSTAR = exports.sep = exports.minimatch = void 0; | ||
| -const brace_expansion_1 = __importDefault(require("brace-expansion")); | ||
| +const brace_expansion_1 = require("brace-expansion"); | ||
| const assert_valid_pattern_js_1 = require("./assert-valid-pattern.js"); | ||
| const ast_js_1 = require("./ast.js"); | ||
| const escape_js_1 = require("./escape.js"); | ||
| @@ -157,7 +157,7 @@ const braceExpand = (pattern, options = {}) => { | ||
| // shortcut. no need to expand. | ||
| return [pattern]; | ||
| } | ||
| - return (0, brace_expansion_1.default)(pattern); | ||
| + return (0, brace_expansion_1.expand)(pattern); | ||
| }; | ||
| exports.braceExpand = braceExpand; | ||
| exports.minimatch.braceExpand = exports.braceExpand; | ||
| diff --git a/dist/esm/index.js b/dist/esm/index.js | ||
| index 737c8095415235e69e4717b505d0ee4ea3c0b6fa..ad5aa644f7957fb39627327bdd6435f4007dca30 100644 | ||
| --- a/dist/esm/index.js | ||
| +++ b/dist/esm/index.js | ||
| @@ -1,4 +1,4 @@ | ||
| -import expand from 'brace-expansion'; | ||
| +import { expand } from 'brace-expansion'; | ||
| import { assertValidPattern } from './assert-valid-pattern.js'; | ||
| import { AST } from './ast.js'; | ||
| import { escape } from './escape.js'; |
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
When a standalone SBOM run and the reusable SBOM job overlap on the same ref—for example, a main push or
/run-security-dispatchwhile the scheduled/manualsecurity.ymlcall is running—both now use this identical repository-wide concurrency group. Becausecancel-in-progressis enabled, the newer invocation cancels the other; cancelling the reusable invocation also leaves the parent Security Analysis run without its SBOM result. Include the invocation context or run identity in this namespace while keeping it distinct from the caller's own group.AGENTS.md reference: AGENTS.md:L22-L22
Useful? React with 👍 / 👎.