repair(perf): preserve GrooveMap delta while removing stale branch drift #859
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -27,3 +27,4 @@ GHSA-wrw7-89jp-8q8g exp:2026-10-31 | |
| # wheel), so it is outside the request-time attack surface. Remove once a | ||
| # fixed setuptools publishes and uv can resolve it. Revisit by 2026-10-31. | ||
| CVE-2026-59890 exp:2026-10-31 | ||
| CVE-2026-16633 | ||
|
There was a problem hiding this comment. 🟡 New vulnerability suppression added without documentation The new Prompt for agents
Was this helpful? React with 👍 or 👎 to provide feedback.
Contributor
There was a problem hiding this comment. 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
echo "== Trivy ignore entry =="
nl -ba .trivyignore | sed -n '24,34p'
echo "== pdfjs-dist declarations and lockfiles =="
while IFS= read -r file; do
rg -n -C 2 'pdfjs-dist|pdf\.js' "$file" || true
done < <(
fd -HI -t f \
-g 'package.json' \
-g 'package-lock.json' \
-g 'pnpm-lock.yaml' \
-g 'yarn.lock' \
-g 'bun.lockb' \
. \
-E node_modules \
-E services/analysis-engine/.venv
)
echo "== PDF.js usage and mitigations =="
rg -n -C 3 \
'pdfjs-dist|enableScripting|Content-Security-Policy|script-src' \
. \
-g '!node_modules/**' \
-g '!services/analysis-engine/.venv/**' || trueRepository: ContextualWisdomLab/bandscope Length of output: 232 Security Misconfiguration (CWE-693) Reachability: Internal 영구적인 CVE 무시 항목을 제거하거나 만료 정보를 추가하세요.
🤖 Prompt for AI AgentsSource: Learnings There was a problem hiding this comment. 🟨 Undocumented Trivy suppression hides a fixable vulnerability The added
Was this helpful? React with 👍 or 👎 to provide feedback. |
||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -19,23 +19,11 @@ export function configureScorePdfWorker(): void { | |
| * Start parsing validated in-memory score PDF bytes with pdf.js. | ||
| * | ||
| * Only caller-provided bytes are accepted (validated-resource-only rule); | ||
| * this helper never fetches arbitrary URLs. The bytes are copied before they | ||
| * are handed to pdf.js because pdf.js transfers the underlying buffer to its | ||
| * worker, which would otherwise detach the caller's copy and break retries. | ||
| */ | ||
| export function loadScorePdf(data: Uint8Array): PDFDocumentLoadingTask { | ||
| configureScorePdfWorker(); | ||
| return getDocument({ data: new Uint8Array(data) }); | ||
|
There was a problem hiding this comment. 🔍 PR reverts security hardening beyond its stated scope The description claims only three files change, but the diff reverts several security controls:
Was this helpful? React with 👍 or 👎 to provide feedback. There was a problem hiding this comment. 🟨 Fail-closed PDF parser flags removed loadScorePdf now calls
Was this helpful? React with 👍 or 👎 to provide feedback. |
||
| } | ||
|
Comment on lines
26
to
29
There was a problem hiding this comment. 🔍 Broad security revert in a perf-scoped PR The stated scope is a GrooveMap performance tweak, but the diff also reverts npm runtime pinning, the undici pin/override, PDF loader hardening, the firstRangeSqueeze feature, and several tests/docs. The removals are internally consistent (no dangling references), but confirm these reverts are intended and not an artifact of a stale merge base.
Was this helpful? React with 👍 or 👎 to provide feedback.
Comment on lines
26
to
29
There was a problem hiding this comment. 🟨 PDF loader stops disabling XFA and worker resource fetching
Was this helpful? React with 👍 or 👎 to provide feedback. |
||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🟨 Checkout credential persistence re-enabled in CI jobs
Dropping
persist-credentials: falsefrom the checkout step leaves the workflow token in the runner's git config for all later steps, exposing it to subsequent build/test commands and their dependencies.Was this helpful? React with 👍 or 👎 to provide feedback.