Skip to content

chore(deps): update pre-commit hook codespell-project/codespell to v2.4.3 - #366

Merged
dreadnode-renovate-bot[bot] merged 1 commit into
mainfrom
renovate/codespell-project-codespell-2.x
Jul 19, 2026
Merged

chore(deps): update pre-commit hook codespell-project/codespell to v2.4.3#366
dreadnode-renovate-bot[bot] merged 1 commit into
mainfrom
renovate/codespell-project-codespell-2.x

Conversation

@dreadnode-renovate-bot

@dreadnode-renovate-bot dreadnode-renovate-bot Bot commented Jul 19, 2026

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Type Update Change
codespell-project/codespell repository patch v2.4.2 → v2.4.3

Note: The pre-commit manager in Renovate is not supported by the pre-commit maintainers or community. Please do not report any problems there, instead create a Discussion in the Renovate repository if you have any questions.

Release Notes

codespell-project/codespell (codespell-project/codespell)

v2.4.3

Compare Source

What's Changed

New Contributors

Full Changelog: codespell-project/codespell@v2.4.2...v2.4.3

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

@dreadnode-renovate-bot
chore(deps): update pre-commit hook codespell-project/codespell to v2…
e6ffa2c 
….4.3

| datasource  | package                     | from   | to     |
| ----------- | --------------------------- | ------ | ------ |
| github-tags | codespell-project/codespell | v2.4.2 | v2.4.3 |
@dreadnode-renovate-bot dreadnode-renovate-bot Bot added the area/pre-commit Changes made to pre-commit hooks label Jul 19, 2026
@dreadnode-renovate-bot
dreadnode-renovate-bot Bot added this pull request to the merge queue Jul 19, 2026
Merged via the queue into main with commit e23b648 Jul 19, 2026
9 checks passed
@dreadnode-renovate-bot
dreadnode-renovate-bot Bot deleted the renovate/codespell-project-codespell-2.x branch July 19, 2026 00:51
This was referenced Jul 30, 2026
Closed
Merged
l50 added a commit to l50/DreadGOAD that referenced this pull request Jul 30, 2026
@l50
refactor: source ares technique credit from loot token_coverage
97719b4 
**Changed:**

- Technique credit now derives from the loot JSON's own `token_coverage` map instead of re-deriving categories from raw vuln_id prefixes, eliminating the second Redis round trip - `transport_ares.go`. ares owns the vuln_id-to-category derivation as of ares-cli dreadnode#366, so `FetchReport` is now a single SSM call.
- Replaced the prefix-matching credit path with a `creditableCategories` join table mapping ares category names to answer-key technique IDs, plus a `uncreditableCategories` refusal table for `other`, `golden_ticket`, `printnightmare`, and `zerologon` - `transport_ares.go`. `printnightmare` and `zerologon` are explicit refusals because ares mints them on evidence that precedes success.
- Reworked `detectTokenCoverageDrift` to surface only categories that are neither creditable nor deliberately refused, failing closed on unknown categories so new ares techniques warn rather than silently dead-credit - `transport_ares.go`.
- `writeTokenCoverageEntries` emits one finding per creditable category with a proven exploit, walking categories in sorted order for deterministic output; evidence now names the category and proven count since ares no longer exposes individual vuln_ids - `transport_ares.go`.
- Restructured the test suite around the category join: added coverage for the credit table, refusal classification, drift detection, deterministic output, and evidence formatting - `transport_ares_test.go`.
- Updated `synthesizeJSONL` call sites to drop the exploited-set argument and drive golden-ticket-adjacent verification through `TokenCoverage` - `verify_test.go`.

**Removed:**

- Removed the Redis fetch path (`fetchExploited`, `splitExploitedSets`, `exploitedSetMarker`) that read the `:exploited` and `:superseded` sets, since technique credit no longer needs the proven subset - `transport_ares.go`.
- Removed the `aresExploitedToTechniqueIDs` prefix table and its aliases (`driftCategoryAliases`, `driftExemptCategories`), which duplicated ares's own categorisation and drifted from it silently - `transport_ares.go`.
- Removed the obsolete tests for the prefix mapping and combined-SMEMBERS parsing (`TestAresExploitedToTechniqueIDs`, `TestSplitExploitedSets`, `TestDriftCategoriesCoverAresTokenCategory`) - `transport_ares_test.go`.
l50 added a commit to l50/DreadGOAD that referenced this pull request Jul 30, 2026
@l50
refactor: source ares technique credit from loot token_coverage (#28)
91eb84f 
**Key Changes:**

- Replaced the Redis-based exploited-set fetch with a single loot JSON
round trip, sourcing technique credit from ares's own `token_coverage`
map now that ares-cli dreadnode#366 made `Exploited` count only proven techniques
- Swapped the vuln_id prefix table for an explicit category-to-technique
join table that consumes ares's categorisation rather than re-deriving
it, eliminating the silent drift that left `acl_*`, `gpo_*`, and
`adcs_esc8` uncreditable for months
- Simplified drift detection to surface only categories this repo has
never classified, since ares now owns the vuln_id-to-category derivation

**Added:**

- Category credit and refusal tables - Introduced `creditableCategories`
(category-to-answer-key-technique join) and `uncreditableCategories`
(deliberate refusals for `other`, `golden_ticket`, `printnightmare`,
`zerologon`) in `transport_ares.go`, with `aresCategoryToTechniqueID` as
the lookup helper
- Token coverage credit path - Added `writeTokenCoverageEntries` to emit
one deterministic (sorted) finding per creditable category with a proven
exploit, deduped against already-emitted findings
- Comprehensive test coverage - Added `TestAresCategoryToTechniqueID`,
`TestAresCreditedTechniquesExistInAnswerKey`,
`TestEveryAresCategoryIsClassified`,
`TestUncreditableCategoriesAreDeliberate`, `TestNoAresCategoryDrifts`,
`TestWriteTokenCoverageEntries`,
`TestWriteTokenCoverageEntriesIsDeterministic`, and
`TestTokenCoverageEvidenceNamesTheCategory` in `transport_ares_test.go`,
asserting every ares category is exactly one of creditable or refused
and that synthesized output stays stable across polls

**Changed:**

- FetchReport flow - Reduced to a single SSM round trip by dropping the
proven/superseded Redis reads; `detectTokenCoverageDrift` and
`synthesizeJSONL` now take only the loot, with drift redefined as
"categories neither creditable nor explicitly refused"
- Evidence strings - Findings now name the category and its proven count
(e.g. `ares token_coverage: acl_abuse (3 proven)`) instead of individual
vuln_ids, reflecting that `token_coverage` is aggregated
- Test call sites - Updated `synthesizeJSONL` callers in
`verify_test.go` to the single-argument signature and populated
`TokenCoverage` where technique credit was previously injected via the
exploited-set slice

**Removed:**

- Redis exploited-set machinery - Deleted `fetchExploited`,
`splitExploitedSets`, the `exploitedSetMarker` constant, and the
`aresExploitedToTechniqueIDs` prefix table from `transport_ares.go`,
along with the `driftCategoryAliases` map and the old
`driftExemptCategories` table
- Obsolete tests - Removed `TestAresExploitedToTechniqueIDs`,
`TestSplitExploitedSets`, `TestAresExploitedTechniquesExistInAnswerKey`,
`TestDriftCategoriesCoverAresTokenCategory`, and
`TestDriftExemptCategoriesAreDeliberate`, which pinned the retired
prefix-and-Redis approach
@l50 l50 mentioned this pull request Jul 30, 2026
Merged
l50 added a commit to l50/DreadGOAD that referenced this pull request Jul 30, 2026
@l50
docs: clarify fork-only ares fixes and correct upstream references (#31)
01cf7a2 
**Key Changes:**

- Documented that the ares#366/dreadnode#367 fixes are fork-only (l50/ares) and
absent from dreadnode/ares
- Added caveats explaining over-crediting and silent under-crediting
risks against a stock ares build
- Updated all issue references from generic "ares-cli"/"ares" to
fully-qualified "l50/ares" repo paths

**Changed:**

- Corrected upstream issue references throughout `transport_ares.go` and
`transport_ares_test.go`, replacing ambiguous "ares-cli dreadnode#366"/"ares
dreadnode#367" mentions with fully-qualified "l50/ares#366" and "l50/ares#367"
identifiers
- Expanded the `aresTokenBucket` doc comment to explain that the
exploited-count fix relies on fork-only changes to
`build_token_coverage_json` and `state/reader.rs`, warning that stock
builds lack `KEY_SUPERSEDED` and will over-credit back-credited
techniques
- Extended the `uncreditableCategories` documentation to clarify the
category promotion is fork-only, detailing how zerologon, nopac, and
printnightmare collapse back to "other" against dreadnode/ares and cause
silent crediting failures for nopac and printnightmare
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

area/pre-commit Changes made to pre-commit hooks renovate

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants