chore(deps-dev): bump postcss from 8.5.6 to 8.5.13 in /viewer - #5
Merged
Merged
Conversation
Bumps [postcss](https://github.com/postcss/postcss) from 8.5.6 to 8.5.13. - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@8.5.6...8.5.13) --- updated-dependencies: - dependency-name: postcss dependency-version: 8.5.13 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
AaronAspinwall123
added a commit
that referenced
this pull request
May 8, 2026
Five issues raised in the Copilot Code Review and confirmed by manual inspection. All 560 Python tests pass (+9 new) and viewer `npm run check` reports 0 errors / 0 warnings. #1 (security, viewer/src/lib/server/artifacts.ts): manifestRelativePath now filters out '..' parts and manifestArtifactPath returns null when the path would escape the suite directory; runSeedRows already falls back to the legacy seeds.jsonl in that case. #2 (bug, viewer/src/lib/server/artifacts.ts): listRunIds now also filters entries through isSafeArtifactId so the run list cannot include names that requireSafeId would later reject with a 500. #3 (critical, p2m/runner.py + p2m/core/artifact_cache.py): when artifact caching is active, the runner now overrides save_dir/save_path in raw_cfg via override_cacheable_output_paths so user YAML cannot redirect cacheable stage outputs outside the versioned artifact dir. finalize_artifact_plan would otherwise fail to find the outputs. #4 (security, p2m/viewer_read_model.py): _manifest_relative_path now rejects '..' segments and returns None; _seed_artifact_path falls back to suite_dir/seeds.jsonl when the helper rejects the manifest path. #5 (operational, p2m/core/artifact_cache.py): _load_json_object now catches json.JSONDecodeError and OSError, prints a stderr warning, and returns None so a corrupt latest.json/artifact.json degrades to a cache miss instead of aborting the pipeline. _resolve_ref_path also rejects '..' segments as defense in depth. New tests: - test_artifact_cache.py: corrupt JSON gracefully ignored, non-object payload rejected, _resolve_ref_path traversal rejection, override_cacheable_output_paths for policy save_dir, seeds save_path, and unknown stage no-op. - test_runner_artifact_cache.py: end-to-end test that user-supplied save_dir/save_path in raw_cfg is overridden so artifacts still land in the versioned cache directory. - test_viewer_server_artifacts.py: _manifest_relative_path traversal rejection (in both the existing TS-gated class and a new always-run ViewerReadModelHelpersTest class) and _seed_artifact_path fallback on malicious manifests. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
tangym
added a commit
that referenced
this pull request
May 29, 2026
* Refine init system prompt conversation flow Replace flat bullet list with structured numbered sections (1-5) covering system context, target type, behavior definition, test set generation, and judge configuration per minthigpen's PR #110 review. * Add section-coverage pacing guardrails to init prompt Smaller models (e.g. gpt-5.4-mini) were jumping to propose after only 2 questions, skipping Behavior Definition, Test Set Generation, and Judge Configuration entirely. Add three guardrails without changing minthigpen's 5-section structure: - Tighten the 'fewer rounds' clause to require verification of each remaining section rather than blanket permission to skip. - Add pacing instruction: acknowledge info from verbose answers but continue asking about uncovered sections. - Add a pre-propose self-check: verify all 5 sections have concrete answers before switching to propose. * Move section checklist into propose action as prerequisite gate Smaller models ignored the standalone 'Before proposing' section. Merge the 5-point checklist into the propose action definition itself, with stronger language: 'do NOT emit propose until every check is yes' and 'you MUST use ask instead'. * Don't ask for system prompt when target is callable Callable targets own their own prompt. Only ask for a system prompt when the user selects the model target type. * Make judge presets explicitly optional in init prompt Rewrite Section 5 (Judge Configuration) to: - Separate presets and custom dimensions into two explicit questions - State clearly that presets are optional and if declined, omit the preset: key from the YAML entirely - Add a 'Critical' paragraph reinforcing literal respect for user answers - Update checklist item #5 to say 'whether to include' instead of 'which' Fixes the issue where mini models added all judge presets (safety-core, grounding, tool-use, robustness, operational) even when the user explicitly said 'none'. * Increase default --max-turns from 20 to 30 With 5 question sections, propose/refine cycles, and potential validation retries for malformed YAML, 20 turns is too tight. 30 provides comfortable headroom without being unlimited.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps postcss from 8.5.6 to 8.5.13.
Release notes
Sourced from postcss's releases.
Changelog
Sourced from postcss's changelog.
Commits
af58cf1Release 8.5.13 versionf227dbdTemporary ignore pnpm 11 configd3abd40Update dependenciesdd06c3eRevert stringifier changes because of the conflict with postcss-scssae889c8Try to fix CIe0093e4Move to pnpm 119bc81c4Release 8.5.12 version85c4d7dAnother try to fix coverage94484caTry to fix coveragec64b748Load only .map source mapsDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.