Skip to content

cask/audit: anchor cask audit regexps to url - #23870

Merged
MikeMcQuaid merged 1 commit into
mainfrom
fix-url-regexp-anchor
Sep 7, 2026
Merged

cask/audit: anchor cask audit regexps to url#23870
MikeMcQuaid merged 1 commit into
mainfrom
fix-url-regexp-anchor

Conversation

@krehel

@krehel krehel commented Sep 7, 2026

Copy link
Copy Markdown
Member
  • audit_hosting_with_livecheck matched sourceforge.net/, dl.devmate.com/ and rink.hockeyapp.net/ anywhere in the download URL, so a lookalike host, a mirror path or a query parameter that merely contained one of those hosts produced a false "Download is hosted on X, please add a livecheck" error.
  • Anchor each regexp to the URL authority so it only matches when the download is actually served from that host. SourceForge keeps matching its downloads. and project subdomains.
  • Continues the cleanup of these three regexps started in Escape dots in domain regexps聽#23799, which escaped their dots.

  • Have you followed our Contributing guidelines?
  • Have you checked for other open Pull Requests for the same change?
  • Have you explained what your changes do? Performance claims (e.g. "this is faster") must include brew benchmark results.
  • Have you explained why you'd like these changes included, not just what they do?
  • For bug fixes, have you given step-by-step brew commands to reproduce the bug?
  • Have you written new tests (excluding integration tests)? Here's an example.
  • Have you successfully run brew lgtm (style, typechecking and tests) locally?

  • I did not use AI/LLM to create this PR, or I disclosed the tool/model below and reviewed its output; I did not attribute commits to AI and will answer maintainer questions and review comments myself without AI/LLM.

Fable 5.1 with manual verification and review.

Copilot AI balanced review requested due to automatic review settings September 7, 2026 13:55

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

馃煛 Changes recommended

The SourceForge pattern can still match hostnames appearing in query parameters.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Anchors cask audit hosting checks to URL authorities to reduce false livecheck errors.

Changes:

  • Anchors SourceForge, DevMate and HockeyApp patterns.
  • Adds a DevMate mirror-path regression test and fixture.
File summaries
File Description
Library/Homebrew/cask/audit.rb Tightens hosting regexps.
Library/Homebrew/test/cask/audit_spec.rb Tests a DevMate false positive.
Library/Homebrew/test/support/fixtures/cask/Casks/devmate-lookalike-without-livecheck.rb Adds the regression fixture.
Review details
  • Files reviewed: 3/3 changed files
  • Comments generated: 1
  • Review effort level: Balanced

馃挕 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

Comment thread Library/Homebrew/cask/audit.rb Outdated
Comment thread Library/Homebrew/cask/audit.rb Outdated
- `audit_hosting_with_livecheck` matched `sourceforge.net/` and
  `dl.devmate.com/` anywhere in the download
  URL, so a lookalike host, a mirror path or a query parameter that
  merely contained one of those hosts produced a false "Download is
  hosted on X, please add a livecheck" error.
- Anchor each regexp to the URL authority so it only matches when the
  download is actually served from that host. SourceForge keeps
  matching its `downloads.` and project subdomains.
- remove references to hockeyapp as no casks use the url
@krehel
krehel force-pushed the fix-url-regexp-anchor branch from f03aa48 to 3804f92 Compare September 7, 2026 14:22

@MikeMcQuaid MikeMcQuaid left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks!

@MikeMcQuaid
MikeMcQuaid added this pull request to the merge queue Sep 7, 2026
Merged via the queue into main with commit 2f68805 Sep 7, 2026
51 checks passed
@MikeMcQuaid
MikeMcQuaid deleted the fix-url-regexp-anchor branch September 7, 2026 15:36
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants