feat(security): add the NVD reconciliation library and the #7276 post-mortem by Dongni-Yang · Pull Request #7370 · NVIDIA/NemoClaw

Dongni-Yang · 2026-07-22T06:11:42Z

Summary

The non-operational NVD slice of #7338: NVD as a supplementary reconciliation source (a pure library plus offline CLI plumbing) and the #7276 post-mortem answering the issue's "Questions to answer" — the post-mortem is an explicit #7338 acceptance checkbox.

Restructured 2026-07-24 to match the #7354/#7398 split: this PR was previously stacked on pre-narrowing #7354 and included the scheduled workflow's NVD step. That step (and the policy-defaults doc section) now belongs to the sign-off-gated #7398; this PR is rebased onto main and carries only pieces that define no operational surface — nothing here is scheduled, holds write permissions, or encodes policy. It can merge on normal review.

Changes

scripts/lib/nvd-reconciliation.mts (new, pure, dependency-free): parses NVD 2.0 API records (malformed → null, never throws; live-verified against services.nvd.nist.gov, including a 358-criteria CPE record and the reserved-id empty envelope) and reconciles each signal: corroborated / nvd-missing / nvd-divergent. Annotations are informational only — they carry no action or confidence and cannot alter a signal's dedupe identity (test-asserted), per the issue's requirement that ambiguous NVD/CPE matches never become authoritative npm mappings.
Signal plumbing: AdvisorySignal gains an optional cveId from the GHSA record's cve_id; the scan CLI accepts --nvd-records <file> (offline attachment — the CLI never performs network requests) and --inventory <file> (hermetic test runs).
Docs: NVD reconciliation semantics, and the fix(images): backport historical OpenClaw security patches #7276 post-mortem classifying each finding per the acceptance criteria — fast-uri: reviewed-mapping delay, directly demonstrated; @opentelemetry/core: audit-coverage/execution-order gap; Jaeger: consistent but unproven; tar: unproven, evidence not retained. Post-mortem wording states plainly which covering mechanisms are merged and which ride the gated feat(security): schedule the advisory early-warning scan #7398.

What moved to #7398

The scheduled workflow's NVD reconciliation step (rate-capped fetch, NVD: unavailable degradation, rolling-issue annotation) and the proposed policy defaults — operational surface under #7338's owner-sign-off gate.

Documentation Writer Review

Documentation writer subagent reviewed the completed changes
Result: no-docs-needed
Evidence: scripts/lib/nvd-reconciliation.mts and test/nvd-reconciliation.test.ts now traverse nested NVD configuration nodes as an internal correctness fix for the documented vulnerable-CPE parsing contract; no user-facing command, flag, configuration, output schema, or workflow changes.
Agent: Codex Desktop

Testing

test/nvd-reconciliation.test.ts: 122 tests green across the three suite files locally; tsc strict clean on both .mts entry points; biome, SPDX, test-size-budget, title-style, and source-shape guardrails verified locally.
CLI smoke-verified: --list-packages runs against the repo inventory.
Maintainer follow-up: npx vitest run --project integration test/nvd-reconciliation.test.ts test/advisory-early-warning.test.ts passes 93/93 with nested NVD configuration coverage.

Refs #7338 (the issue closes via #7398 once product/security owners record sign-off)

Signed-off-by: Dongni-Yang dongniy@nvidia.com

🤖 Generated with Claude Code

Summary by CodeRabbit

New Features
- Advisory early-warning signals can include an optional CVE identifier when available.
- Added offline NVD supplementary reconciliation that annotates results with corroborated, nvd-missing, or nvd-divergent.
- Added --inventory <file> for hermetic inventories and --nvd-records <file> to attach pre-fetched NVD reconciliation data without network access.
Documentation
- Expanded early-warning correlation documentation, including NVD reconciliation behavior and the updated #7276 post-mortem.
Bug Fixes
- Malformed inventory entries now fail the run instead of silently shrinking the inventory.
Tests
- Updated and expanded coverage for CVE extraction, NVD processing, and CLI offline behavior.

Public advisories can affect maintained packages weeks before they reach the reviewed corpus that npm audit enforces (#7276 timeline). Add an early-warning path and per-audit provenance so those windows become visible and provable from retained artifacts: - scripts/lib/advisory-early-warning.mts: dependency-free correlation of GitHub Security Advisory records (reviewed, unreviewed, and malware) against the reviewed-graph package inventories; exact npm name and parseable-range matches produce investigate signals, ambiguous or CPE-style matches stay informational and never block. - .github/workflows/advisory-early-warning.yaml: six-hourly paginated scan of all three advisory types, correlated against the inventory, reporting into one rolling security-labeled issue (marker- and author-verified, deduplicated by advisory id plus package). - scripts/audit-reviewed-npm-graph.mts and the wechat runtime audit action now write a *.provenance.json sidecar next to each raw report: scanner and npm/node versions, configured registry and derived bulk advisory endpoint, run start/end times, extracted advisory ids, and a failure marker whenever the audit attempt itself failed - including npm's parseable-error-JSON failure mode - so a failed attempt can never be mistaken for a comparable non-detection. - docs/security/advisory-early-warning.md: how the path works plus proposed defaults (scope, ownership, alert destination, SLA) pending maintainer confirmation. Refs #7338 Signed-off-by: Dongni-Yang <dongniy@nvidia.com> Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

CodeRabbit: every source file carries the SPDX header; match the sibling docs/security file comment syntax. Refs #7338 Signed-off-by: Dongni-Yang <dongniy@nvidia.com> Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Follow-up to the #7338 early-warning scan: use NVD as the supplementary reconciliation source the issue calls for, without ever treating NVD or CPE data as an authoritative npm mapping. - scripts/lib/nvd-reconciliation.mts: pure parser for NVD 2.0 records and per-signal reconciliation annotations (corroborated, nvd-missing, nvd-divergent) that are informational only - they never change a signal's action, confidence, or dedupe identity. - Advisory signals now carry the GHSA record's cve_id when present; the scan CLI accepts --nvd-records for offline attachment. - The scheduled workflow queries NVD for up to 20 signal CVE ids per run (7s spacing for the unauthenticated rate limit, cap logged when exceeded) and appends the annotation to the rolling issue lines. NVD being unreachable degrades to an "unavailable" note and never fails the run - deliberately softer than the fail-loud GitHub fetch, since NVD is supplementary. - docs: NVD reconciliation semantics plus the #7276 post-mortem section answering the issue's detection-trigger questions strictly from its own evidence table. Refs #7338 Signed-off-by: Dongni-Yang <dongniy@nvidia.com> Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

coderabbitai · 2026-07-22T06:11:49Z

📝 Walkthrough

Walkthrough

The change adds validated CVE identifiers to advisory signals, introduces offline NVD 2.0 reconciliation, extends the scan CLI with inventory and NVD input files, adds comprehensive tests, and documents reconciliation behavior and post-mortem detection triggers.

Changes

Advisory NVD reconciliation

Layer / File(s)	Summary
Propagate validated CVE identifiers `scripts/lib/advisory-early-warning.mts`, `test/advisory-early-warning.test.ts`	Correlation derives valid advisory CVE identifiers, preserves the first valid value across duplicate records, and conditionally emits `cveId` in signals.
Parse and reconcile NVD records `scripts/lib/nvd-reconciliation.mts`, `test/nvd-reconciliation.test.ts`	NVD 2.0 responses are parsed into reduced records, vulnerable CPE criteria are collected, and signals receive `corroborated`, `nvd-missing`, or `nvd-divergent` annotations.
Integrate offline reconciliation into the scan CLI `scripts/advisory-early-warning-scan.mts`, `test/nvd-reconciliation.test.ts`	The CLI supports `--inventory` and `--nvd-records`, formats optional NVD details, and validates offline annotated and unannotated output paths.
Document reconciliation and detection triggers `docs/security/advisory-early-warning.md`	Documentation describes the signal contract, offline NVD reconciliation, invariant action and confidence fields, and post-mortem trigger classifications.

Estimated code review effort: 4 (Complex) | ~45 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Operator
  participant EarlyWarningScan
  participant AdvisoryCorrelation
  participant NvdReconciliation
  participant NvdRecordsFile
  Operator->>EarlyWarningScan: Run with --inventory and --nvd-records
  EarlyWarningScan->>AdvisoryCorrelation: Correlate advisories against inventory
  AdvisoryCorrelation-->>EarlyWarningScan: Signals with optional cveId
  EarlyWarningScan->>NvdRecordsFile: Load pre-fetched responses
  EarlyWarningScan->>NvdReconciliation: Attach NVD reconciliations
  NvdReconciliation-->>EarlyWarningScan: Annotated signals
  EarlyWarningScan-->>Operator: Print informational signal details

Possibly related PRs

NVIDIA/NemoClaw#7398: Implements or consumes the advisory early-warning pipeline’s scheduled NVD enrichment and overlaps with CVE propagation and reconciliation annotations.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title captures the main additions: the NVD reconciliation library and the `#7276` post-mortem.

✨ Finishing Touches

📝 Generate docstrings

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch dongniy/7338-nvd-reconciliation

_{Comment @coderabbitai help to get the list of available commands.}

github-code-quality · 2026-07-22T06:12:33Z

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall coverage in commit 389a282 in the dongniy/7338-nvd-rec... branch remains at 96%, unchanged from commit 88b3e35 in the main branch.

TypeScript / code-coverage/cli

The overall coverage in commit 389a282 in the dongniy/7338-nvd-rec... branch remains at 80%, unchanged from commit 88b3e35 in the main branch.

Show a code coverage summary of the most impacted files.

File	`main` 88b3e35	`dongniy/7338-nvd-rec...` 389a282	+/-
`src/lib/messagi...nnels/policy.ts`	100%	100%	0%
`src/lib/onboard...der-metadata.ts`	100%	100%	0%
`src/lib/sandbox...rce-identity.ts`	87%	87%	0%
`src/lib/securit...ntial-filter.ts`	93%	93%	0%
`src/lib/trace.ts`	94%	94%	0%
`src/lib/platform.ts`	84%	89%	+5%

_{Updated July 24, 2026 17:48 UTC}

…ovenance

…conciliation

github-actions · 2026-07-22T06:19:56Z

PR Review Advisor — Informational

Advisor assessment: Informational / high confidence
Next action: No advisor follow-up needed.
Findings: 0 blockers · 0 warnings · 0 suggestions
Status: No actionable findings remain in the canonical review ledger.

Model lanes

GPT-5.6 Terra (primary): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
Nemotron 3 Ultra (second opinion): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
Model comparison: normalized findings match; normalized E2E selections match; severity counts match.

Nemotron output stays in workflow artifacts and does not change the assessment above.

E2E guidance

Advisory only. E2E / PR Gate selects and runs jobs independently.

Recommended E2E: None

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.

The source-shape scanner rightly flags assertions derived from repo config reads; give the scan CLI an explicit --inventory input so the CLI tests run against literal fixtures instead of the live reviewed inventory. The scheduled workflow keeps the repo-derived default. Refs #7338 Signed-off-by: Dongni-Yang <dongniy@nvidia.com> Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Dongni-Yang · 2026-07-22T22:29:08Z

Converting to draft: this PR is stacked on #7354, which was just narrowed per review — the scheduled early-warning workflow this PR extends moved to draft #7398, gated on product/security-owner sign-off on #7338. I'll restructure this PR the same way once the narrowing settles: the NVD reconciliation library and CLI plumbing can proceed against #7354's narrowed branch, and the workflow reconciliation step will fold into #7398.

copy-pr-bot · 2026-07-22T22:29:09Z

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

Resolve to the restructured non-operational slice: the NVD reconciliation library, scan-CLI plumbing (--nvd-records, --inventory, cveId), tests, and the reconciliation-semantics + #7276 post-mortem docs, rebased onto main after #7354 squash-merged. The scheduled workflow's NVD step and the policy-defaults doc section move to the sign-off-gated #7398, matching the #7354/#7398 split. Refs #7338 Signed-off-by: Dongni-Yang <dongniy@nvidia.com> Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

github-actions · 2026-07-24T07:20:05Z

🌿 Preview your docs: https://nvidia-preview-pr-7370.docs.buildwithfern.com/nemoclaw

The operational half of the NVD reconciliation split (#7370 carries the library and CLI plumbing): the scheduled workflow queries NVD for up to 20 signal CVE ids per run (7 s spacing for the unauthenticated rate limit, cap logged when exceeded) and appends the agreement annotation to the rolling-issue lines. NVD being unreachable degrades to an "NVD: unavailable" note and never fails the run — deliberately softer than the fail-loud GitHub advisory fetch, since NVD is supplementary. Annotations extend line text only; the dedupe key is unchanged. Merge order: #7370 must land first — this workflow invokes the scan CLI's --nvd-records flag, which #7370 introduces. Refs #7338 Signed-off-by: Dongni-Yang <dongniy@nvidia.com> Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Refs #7338 Signed-off-by: Dongni-Yang <dongniy@nvidia.com> Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

coderabbitai

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@docs/security/advisory-early-warning.md`:
- Around line 43-49: Revise the added prose in the advisory documentation
sections, including the inventory description and the ranges noted in the
review, to use active voice addressed to the reader in present tense. Keep
exactly one complete sentence on each Markdown source line, preserving the
existing technical meaning and structured data notation.

In `@scripts/advisory-early-warning-scan.mts`:
- Around line 68-86: The loadInventoryOverride function silently skips malformed
inventory entries; add a warning whenever an entry has an invalid or missing
name or version before continuing. Include enough context to identify the
dropped entry and inventory file, while preserving acceptance of valid entries
and the existing fallback for origin.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 0c3c84b2-03b4-442e-bb59-55d42ec8e281

📥 Commits

Reviewing files that changed from the base of the PR and between 04e6dfa and 2a27dd0.

📒 Files selected for processing (6)

docs/security/advisory-early-warning.md
scripts/advisory-early-warning-scan.mts
scripts/lib/advisory-early-warning.mts
scripts/lib/nvd-reconciliation.mts
test/advisory-early-warning.test.ts
test/nvd-reconciliation.test.ts

… doc style Review follow-up: a malformed --inventory entry now fails the scan run with an error naming the entry index instead of silently shrinking the inventory (which would under-report advisories with no visible signal), and the added doc sections follow the documentation style guide (one sentence per source line, direct imperatives for the CLI flags). Refs #7338 Signed-off-by: Dongni-Yang <dongniy@nvidia.com> Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Refs #7338 Signed-off-by: Dongni-Yang <dongniy@nvidia.com> Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Signed-off-by: Apurv Kumaria <akumaria@nvidia.com>

apurvvkumaria

Security and merge-readiness review complete. The NVD path remains offline and informational, validates CVE identifiers and inventory input, does not alter enforcement or confidence, traverses nested configuration nodes without cycles, and has no unresolved review threads. All CI is green; targeted advisory/NVD coverage passes 93/93.

## Summary Adds the canonical pre-tag `## v0.0.95` release entry to `docs/changelog/2026-07-24.mdx`, before the existing v0.0.94 entry. The entry summarizes approved user-visible changes merged since v0.0.94 and excludes internal-only prerequisites. ## Changes - Adds the v0.0.95 summary and detailed bullets for gateway lifecycle, recovery, state transfer, inference compatibility, sandbox security, Discord policy, and E2E evidence. - Links each user-facing theme to the most specific published documentation. - Records the release entry in the shared native changelog used by the OpenClaw, Hermes, and Deep Agents guides. Source summary: - [#7246](#7246), [#7228](#7228), [#7267](#7267), [#7489](#7489), [#7509](#7509), [#7351](#7351), and [#7290](#7290) -> `docs/changelog/2026-07-24.mdx`: Gateway authority, forward teardown and retry, managed recovery, Hermes restart recovery, scoped uninstall, and orphan-aware backup behavior. - [#7344](#7344) and [#7416](#7416) -> `docs/changelog/2026-07-24.mdx`: Atomic SQLite restore and host download verification. - [#7476](#7476), [#7347](#7347), [#7281](#7281), [#7485](#7485), [#7491](#7491), and [#7422](#7422) -> `docs/changelog/2026-07-24.mdx`: Windows Ollama reuse, CDI fallback, bounded OpenRouter connection setup, Nemotron-3 request compatibility, and managed Deep Agents retry and provider-error behavior. - [#6884](#6884), [#7481](#7481), [#6878](#6878), [#7467](#7467), [#7502](#7502), [#7503](#7503), [#7504](#7504), and [#7486](#7486) -> `docs/changelog/2026-07-24.mdx`: Trusted base-image overrides, local rebuild images, runtime validation, config preservation, reviewed package updates, and fewer final-image payload layers. - [#7303](#7303) -> `docs/changelog/2026-07-24.mdx`: Scoped Discord application-command management. - [#7488](#7488), [#7465](#7465), [#7497](#7497), [#7464](#7464), [#7501](#7501), [#7494](#7494), and [#7493](#7493) -> `docs/changelog/2026-07-24.mdx`: Selected-test risk signals, retry cleanup, full root-image validation, direct-main Hermes setup, executed PR-gate evidence, nightly history, and runner wait reporting. - [#7447](#7447) is an internal pinned-runtime prerequisite and is intentionally excluded from canonical supported-integration documentation. - [#7370](#7370) adds maintainer-only advisory reconciliation tooling and does not change supported user behavior. - [#7495](#7495) updates existing documentation and does not add a new v0.0.95 behavior claim. ## Type of Change - [ ] Code change (feature, bug fix, or refactor) - [ ] Code change with doc updates - [x] Doc only (prose changes, no code sample modifications) - [ ] Doc only (includes code sample changes) ## Quality Gates - [ ] Tests added or updated for changed behavior - [x] Existing tests cover changed behavior — justification: `test/changelog-docs.test.ts` validates the dated changelog structure, heading uniqueness, and published links. - [ ] Tests not applicable — justification: - [x] Docs updated for user-facing behavior changes - [ ] Docs not applicable — justification: - [ ] Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging) - [ ] Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: - [ ] Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: ## Documentation Writer Review - [x] Documentation writer subagent reviewed the completed changes - Result: `docs-updated` - Evidence: `docs/changelog/2026-07-24.mdx`; writing rules, documentation style, factual release meaning, and published links reviewed at exact head `58b02f2bf`. - Agent: Codex documentation writer reviewer   ## DGX Station Hardware Evidence - [ ] Tested on DGX Station - Tested commit: - Station profile/scenario: - Result: - Supporting evidence: ## Verification - [x] PR description includes a `Signed-off-by:` line and every commit appears as `Verified` in GitHub - [x] Normal `pre-commit`, `commit-msg`, and `pre-push` hooks passed, or `npm run check:diff` passed when hooks were skipped or unavailable - [x] Targeted behavior tests pass for the current change set, or tests are marked not applicable above — command/result or justification: `npx vitest run test/changelog-docs.test.ts` passed 6 tests. - [ ] Applicable broad gate passed — `npm test` for broad runtime/test-harness changes; `npm run check` for repo-wide validation/coverage changes — command/result: - [x] Quality Gates section completed with required justifications or waivers - [x] No secrets, API keys, or credentials committed - [ ] `npm run docs` builds without warnings (doc changes only) — the build passed with 0 errors and 2 Fern warnings. - [x] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) - [ ] New doc pages include SPDX header and frontmatter (new pages only) --- Signed-off-by: Senthil Ravichandran <senthilr@nvidia.com>  ## Summary by CodeRabbit * **Documentation** * Added a new v0.0.95 changelog entry above v0.0.94. * Documented improved externally supervised gateway lifecycle ownership. * Improved snapshot restore reliability and SQLite state handling. * Tightened CLI `backup-all` behavior and host artifact verification. * Updated Windows onboarding guidance (including Ollama service reuse and CDI directory fallback). * Noted inference compatibility fixes, deeper agent failure classification, stricter base-image validation, updated Discord bot command permissions, and refined E2E release automation evidence handling.  --------- Signed-off-by: Senthil Ravichandran <senthilr@nvidia.com>

Dongni-Yang and others added 3 commits July 22, 2026 11:32

docs(security): add SPDX header to advisory early-warning doc

1b53bb7

CodeRabbit: every source file carries the SPDX header; match the sibling docs/security file comment syntax. Refs #7338 Signed-off-by: Dongni-Yang <dongniy@nvidia.com> Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Dongni-Yang mentioned this pull request Jul 22, 2026

Detect public advisories before reviewed ecosystem mappings reach scanners #7338

Closed

8 tasks

Dongni-Yang added 2 commits July 22, 2026 14:13

Merge remote-tracking branch 'origin/main' into dongniy/7338-audit-pr…

9759ce2

…ovenance

Merge branch 'dongniy/7338-audit-provenance' into dongniy/7338-nvd-re…

acf6675

…conciliation

Dongni-Yang marked this pull request as draft July 22, 2026 22:29

wscurran added area: cli Command line interface, flags, terminal UX, or output area: security Security controls, permissions, secrets, or hardening feature PR adds or expands user-visible functionality labels Jul 23, 2026

Base automatically changed from dongniy/7338-audit-provenance to main July 23, 2026 22:39

Dongni-Yang changed the title ~~feat(security): reconcile early-warning signals with NVD~~ feat(security): NVD supplementary reconciliation library and the #7276 post-mortem Jul 24, 2026

Dongni-Yang marked this pull request as ready for review July 24, 2026 07:19

Dongni-Yang mentioned this pull request Jul 24, 2026

feat(security): schedule the advisory early-warning scan #7398

Closed

4 tasks

Dongni-Yang changed the title ~~feat(security): NVD supplementary reconciliation library and the #7276 post-mortem~~ feat(security): add the NVD reconciliation library and the #7276 post-mortem Jul 24, 2026

chore: retrigger checks after the pr title fix

cb4de75

Refs #7338 Signed-off-by: Dongni-Yang <dongniy@nvidia.com> Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

coderabbitai Bot reviewed Jul 24, 2026

View reviewed changes

Comment thread docs/security/advisory-early-warning.md Outdated

Comment thread scripts/advisory-early-warning-scan.mts

Dongni-Yang and others added 3 commits July 24, 2026 15:31

chore: apply biome format to the inventory test fixture

63efa7f

Refs #7338 Signed-off-by: Dongni-Yang <dongniy@nvidia.com> Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

fix(security): traverse nested NVD configuration nodes

389a282

Signed-off-by: Apurv Kumaria <akumaria@nvidia.com>

apurvvkumaria approved these changes Jul 24, 2026

View reviewed changes

apurvvkumaria merged commit 892d524 into main Jul 24, 2026
108 checks passed

apurvvkumaria deleted the dongniy/7338-nvd-reconciliation branch July 24, 2026 20:20

github-actions Bot added the v0.0.95 label Jul 24, 2026

ericksoa mentioned this pull request Jul 24, 2026

perf(openclaw): collapse final image payload layers #7486

Merged

23 tasks

coderabbitai Bot mentioned this pull request Jul 24, 2026

docs: complete post-tag audit fixes #7495

Merged

26 tasks

senthilr-nv mentioned this pull request Jul 25, 2026

docs: add v0.0.95 release entry #7513

Merged

23 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat(security): add the NVD reconciliation library and the #7276 post-mortem#7370

feat(security): add the NVD reconciliation library and the #7276 post-mortem#7370
apurvvkumaria merged 11 commits into
mainfrom
dongniy/7338-nvd-reconciliation

Dongni-Yang commented Jul 22, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Jul 22, 2026 •

edited

Loading

Walkthrough

Changes

Sequence Diagram(s)

❌ Failed checks (1 warning)

Uh oh!

github-code-quality Bot commented Jul 22, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Jul 22, 2026 •

edited

Loading

Uh oh!

Dongni-Yang commented Jul 22, 2026

Uh oh!

copy-pr-bot Bot commented Jul 22, 2026

Uh oh!

github-actions Bot commented Jul 24, 2026

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

Uh oh!

apurvvkumaria left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

Dongni-Yang commented Jul 22, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Changes

What moved to #7398

Documentation Writer Review

Testing

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Jul 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Sequence Diagram(s)

❌ Failed checks (1 warning)

Uh oh!

github-code-quality Bot commented Jul 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Coverage Overview

TypeScript / code-coverage/plugin

TypeScript / code-coverage/cli

Uh oh!

github-actions Bot commented Jul 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Review Advisor — Informational

Model lanes

E2E guidance

Uh oh!

Dongni-Yang commented Jul 22, 2026

Uh oh!

copy-pr-bot Bot commented Jul 22, 2026

Uh oh!

github-actions Bot commented Jul 24, 2026

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

apurvvkumaria left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Dongni-Yang commented Jul 22, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Jul 22, 2026 •

edited

Loading

github-code-quality Bot commented Jul 22, 2026 •

edited

Loading

github-actions Bot commented Jul 22, 2026 •

edited

Loading