fix: clear the blocking vite advisory, and document install and usage - #3
Closed
ralyodio wants to merge 3 commits into
Closed
fix: clear the blocking vite advisory, and document install and usage#3ralyodio wants to merge 3 commits into
ralyodio wants to merge 3 commits into
Conversation
Ports all five commands out of profullstack/scripts: gh-prs, gh-prs-merge, gh-prs-fix-all, tcfeed and domainjson. The point is not the language. It is the two things bash was making expensive. Typed, validated responses. Every gh call went through `jq -r` into a string compare, and `jq -r '.mergeable'` on a response that never had the field prints the four characters `null` — which is not MERGEABLE, so a mergeable PR read as ineligible for a reason nobody wrote, and the failure was indistinguishable from a real verdict. Responses are now parsed once and validated by shape, with the offending field named. Tests. The originals had none, so verifying a change meant running it against live pull requests. 51 tests here stub the subprocess layer, so gh is never invoked and the suite finishes in under a second. gh-prs-merge keeps the --fix behaviour and its refusals: a conflict GitHub declines to merge is left alone with its message printed, a check that ran and failed is a result rather than an obstacle, and there is no --admin. Two structural rules the port enforces: Nothing under bin/ does work at import time. Every entry guards on isMain(import.meta.url) and anything testable lives in src/. That is not decorative — a test that imported bin/gh-prs-fix-all.ts to reach one pure function ran the tool, taking the suite from 60ms to 93 seconds and sweeping live pull requests with --fix implied. isMain resolves the realpath first. These install as symlinks, so argv[1] is the link while import.meta.url is its target; comparing raw reports "imported" for every installed command at once. Commands install as files on PATH rather than shell aliases, because the moshcode pit runs aliases with `zsh -c`, which reads neither ~/.zshrc nor ~/.zsh_aliases. install-links refuses to take over a name it does not own without --force, and refuses a real file even with it. Verified against the originals: gh-prs-merge dry run is byte-identical, and domainjson is set-identical across every record type, rdap key and axfr entry (only DNS round-robin ordering differs). Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Socket blocked the PR on GHSA-fx2h-pf6j-xcff (high) — vite's `server.fs.deny` bypass on Windows alternate paths. vitest 2.1.9 pulled in vite 5.4.21, and that range is only patched at 6.4.3. vitest 4.1.10 resolves vite 8.2.1, above the 8.0.16 fix. Not exploitable here — it is a dev-server path check in a devDependency of a repo with no dev server — but the fix is a version bump, and arguing for an exception costs more than taking it. All 51 tests pass unchanged on vitest 4. Also corrects the README. It repeated the older tools' claim that the moshcode pit runs aliases with a non-interactive `zsh -c`, which is why they had to be files on PATH. That is no longer true: src/aliases.mjs runs `$SHELL -ic`, which does source ~/.zsh_aliases. Verified both ways and recorded the actual, weaker reason to stay on PATH — a file works from every caller without anything having been sourced first. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The README explained the design and skipped the part someone actually arrives for. Now it opens with a command table, then requirements, then install, then usage per command with runnable examples — the same shape the scripts repo README had, which was the one people used. Renames the link scripts to link:bin / unlink:bin. `link` and `unlink` are pnpm builtins, so `pnpm link` runs pnpm's own command and never touches this script — the README documented a step that would silently do nothing. Every command in the install section was run as written before committing. Also records requirements the tools have always had and never stated: gh authenticated, dig at /usr/bin/dig for domainjson, and OpenRDAP on PATH for its RDAP half. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Contributor
Author
|
Superseded by #4. This branch still carried the commit that #2 had already squashed onto master, so git was being asked to apply it twice — hence the conflict. #4 is the same change rebuilt from master as a single commit, and applies cleanly. Also worth recording: the vite advisory fix landed on master with #2, so nothing security-relevant was outstanding here. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up to #2, which was merged before these two commits landed on the branch.
1.
GHSA-fx2h-pf6j-xcff— high, currently onmasterSocket blocked #2 on this and I fixed it, but the merge took the commit before the fix. So
masterright now carries it.vitest@2.1.9resolvesvite@5.4.21. The advisory (server.fs.denybypass on Windows alternate paths) is only patched at vite6.4.3, so 5.x is inside the vulnerable range with no fix available on that line.vitest@4.1.10resolvesvite@8.2.1, above the8.0.16fix.Not exploitable here — a dev-server path check, in a devDependency, in a repo with no dev server — but it is a version bump, and arguing for an exception costs more than taking it. All 51 tests pass unchanged on vitest 4.
2. The README now has install and usage
It explained the design and skipped the part someone actually arrives for. Now: command table → requirements → install → usage per command with runnable examples.
Also states requirements the tools always had and never documented:
ghauthenticated,digat/usr/bin/digfordomainjson, OpenRDAP onPATHfor its RDAP half.3.
link→link:binlinkandunlinkare pnpm builtins.pnpm linkruns pnpm's own command and never touchesscripts/install-links.mjs— so the install step #2 documented would have silently done nothing. Renamed tolink:bin/unlink:bin, and every command in the install section was run as written before committing.Verification
pnpm test— 51 passed on vitest 4.1.10.pnpm typecheck— clean.pnpm link:bin --dry-runand--remove --dry-runboth behave as documented.vite@8.2.1in the lockfile.🤖 Generated with Claude Code