fix(security): close the open code-scanning backlog — 7 fixes + the ADR 0034 triage register - #37

Merged

wshallwshall merged 10 commits into

mainfrom

Jul 29, 2026

Commits on Jul 29, 2026

test(cert-cli): assert the exact DN instead of a hostname substring
wshallwshall
committed
3d1dec2
fix(api): kill the quadratic Content-Disposition scan in the multipart parser
wshallwshall
committed
89c73d0
fix(ide): resolve each scanned module once, by descriptor, not twice by path
wshallwshall
committed
b58ea56
fix(ci): drop the unpinned pip bootstrap from the SBOM scratch venv
wshallwshall
committed
72fffd7
test(api): make the ReDoS growth-ratio check noise-proof
wshallwshall
committed
9bd23eb
fix(ci): the DEP-1 lock-check venv had the same unpinned pip bootstrap
wshallwshall
committed
f9b60c4
fix(api): bound a multipart part's header block before parsing it
wshallwshall
committed
9899ba7
docs(ide): claim only the identity guarantee the fd rewrite actually buys
wshallwshall
committed
f6c4d0c
docs(adr): record the second static-analysis triage round in ADR 0034
wshallwshall
committed
895d009
Merge branch 'main' into sec
wshallwshall
authored
fc86c78