ci: dependabot title exemption, dependency floors, masked account id - #110
Merged
Conversation
…unt id Phase C of the OSS-ready program: - static-checks: the 72-character PR-title ceiling no longer applies to dependabot[bot] (machine-generated titles grow with group size and are not configurable; the Conventional-Commits pattern still applies to everyone; commitlint's own ceiling is 100) - dependency floors: dompurify override advanced to 3.4.12; body-parser floored to 2.3.0 (resolved 2.2.2 was inside the advisory range via express and @modelcontextprotocol/sdk paths) - deploy-cloudflare reads CLOUDFLARE_ACCOUNT_ID from secrets (masked in public logs; the secret already exists, the variable is removed after the next validated deploy) - build-snapshot environment casing normalized to Production - sandbox Dockerfile documents that alerts #9/#8 are lockfile-metadata findings mitigated by the runtime-security-overrides overlay
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Phase C of the OSS-ready program.
dependabot[bot](titles are machine-generated and unshortenable — chore(deps): bump actions/checkout from 6.0.3 to 6.1.0 in the actions group across 1 directory #76/chore(deps): bump the python group across 1 directory with 4 updates #78 fail today solely on length; commitlint's own ceiling is 100).dompurify→ 3.4.12 (closes alert refactor(platform): finalize the V2 architecture #5);body-parser→ 2.3.0 (resolved 2.2.2 was in-range via express + MCP-SDK paths, closes alert fix(ci): build db dep closure before db:generate (DB Migrate) #4).CLOUDFLARE_ACCOUNT_IDnow read from secrets (masked in public run logs; secret created beforehand; the variable is deleted after the next validated dispatch — historical logs remain unredacted regardless).build-snapshotenvironment casing normalized toProduction; sandbox Dockerfile comment ties alerts chore(deps): bump numpy from 2.3.5 to 2.5.1 in /infra/containers/sandbox #9/chore(deps): bump ipython from 9.13.0 to 9.15.0 in /infra/containers/sandbox #8 to the existing overlay mitigation.Verification notes
pnpm lint/pnpm typecheck/pnpm turbo build --force/pnpm deadcode/pnpm architecture:check/pnpm turbo skills:build— independent clean-install rerunpnpm why body-parsersingle-resolves 2.3.0.