Repository navigation
authors: map by email alone, so .mailmap stops repeating the profile display name; filelock 4.2.4 for three new advisories - #20
Merged
Conversation
CVE-2026-112940, CVE-2026-112913 and CVE-2026-112907, all fixed in filelock 4.2.1, turned the gate red at pip-audit; every service's lock carried 3.32.3, main included. filelock reaches the venvs only through pip-audit's own HTTP cache (cachecontrol[filecache], filelock>=3.8.0, no upper bound), and the images install runtime packages only, so no published image carries it. 4.2.4 is the newest release from the project's own release flow; installed into each venv, the locks regenerated by scripts/relock.sh, and filelock is the only pin that moved. STACK GATE GREEN.
…display name The file mapped old author names onto the one human identity by repeating each old name, one of them the account's profile display name, which then sat in a tracked file of a public repository. The two commits GitHub authored under that display name (the merges of #1 and #5) carry the owner's email, so mapping the email alone gives log, shortlog and blame the same result without naming any old name. The second line mapped a local-machine address no commit in the history uses; it is gone. Read back: git log --use-mailmap shows the same identities before and after, one human identity plus Dependabot's one, and the two merge commits read as the owner. Nothing in the repository reads .mailmap. The history keeps the earlier file.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
.mailmap(added in 9316a21) mapped old author names onto the one human identity by repeating each old name — one of them the account's profile display name, which then sat in a tracked file of a public repository. The two commits GitHub authored under that display name (the merges of #1 and #5) carry the owner's email, so mapping that email alone gives every git command that reads authors the same result without the file naming any old name.The second line mapped a local-machine address that no commit in the history uses; it is gone.
Read back:
git log --use-mailmapshows the same identities before and after, one human identity across every human commit plus Dependabot's one, and the two merge commits read as the owner. Nothing in the repository reads.mailmap. The history keeps the earlier file; this only stops the current tree from carrying the name.A second commit relocks filelock 4.2.4 for CVE-2026-112940, CVE-2026-112913 and CVE-2026-112907, all fixed in 4.2.1 and published after main's last CI run: the gate went red at pip-audit on this branch, and main carries the same lock. filelock reaches the venvs only through pip-audit's own HTTP cache (
cachecontrol[filecache], no upper bound), and the images install runtime packages only, so no published image carries it. 4.2.4 is the newest release from the project's own release flow; filelock is the only pin that moved in the three locks.Gate: STACK GATE GREEN locally; CI read back before merging.