From 0e6643848916d16ee02fee00c9044d36e6e31165 Mon Sep 17 00:00:00 2001 From: "sadrbot[bot]" <346629323+sadrbot[bot]@users.noreply.github.com> Date: Sun, 1 Nov 2026 11:54:48 +0000 Subject: [PATCH 1/2] sadr: move the Semgrep CI image to 1.182.0 Pin semgrep/semgrep:1.182.0 by a digest built 2026-10-20T20:03Z, which cleared the 7-day cooldown. Semgrep 1.183.0 clears it on 2026-11-05T18:33Z. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/semgrep.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/semgrep.yml b/.github/workflows/semgrep.yml index e7f15c8..0a0e26e 100644 --- a/.github/workflows/semgrep.yml +++ b/.github/workflows/semgrep.yml @@ -20,7 +20,7 @@ jobs: env: SEMGREP_APP_TOKEN: ${{ secrets.SEMGREP_APP_TOKEN }} container: - image: semgrep/semgrep:1.181.0@sha256:81474464c1f07483ba0682a44787fd93c91397419762a04abe2bafaae396304b + image: semgrep/semgrep:1.182.0@sha256:4a34048c04fef049f71665047f074cffb00cc3d89482f965a5cd151d589237af steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - run: semgrep ci From 4be732eb13e0581cb34b8b1f736a4cde17b7109c Mon Sep 17 00:00:00 2001 From: "sadrbot[bot]" <346629323+sadrbot[bot]@users.noreply.github.com> Date: Sun, 1 Nov 2026 11:56:29 +0000 Subject: [PATCH 2/2] sadr: lift the Node 24.22.1 cooldown exception Node 24.22.1 was published 2026-10-21T10:38Z and cleared the 7-day cooldown on 2026-10-28T10:38Z. It stays the pin: it is the newest release of the newest LTS line (24) before the cooldown cutoff. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/conformance.yml | 3 --- 1 file changed, 3 deletions(-) diff --git a/.github/workflows/conformance.yml b/.github/workflows/conformance.yml index 07aa9b7..a00e0ea 100644 --- a/.github/workflows/conformance.yml +++ b/.github/workflows/conformance.yml @@ -24,7 +24,6 @@ jobs: - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: - # sadr: cooldown exception CVE-2026-105481 CVE-2026-105482 CVE-2026-105483 CVE-2026-106069 CVE-2026-106073 CVE-2026-106074 CVE-2026-111497, lift when 24.22.1 clears the cooldown node-version: 24.22.1 # koreader/test-data holds leaves.epub and tall.pdf, whose partial-MD5 @@ -60,7 +59,6 @@ jobs: - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: - # sadr: cooldown exception CVE-2026-105481 CVE-2026-105482 CVE-2026-105483 CVE-2026-106069 CVE-2026-106073 CVE-2026-106074 CVE-2026-111497, lift when 24.22.1 clears the cooldown node-version: 24.22.1 - name: Wait for the reference server @@ -139,7 +137,6 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: - # sadr: cooldown exception CVE-2026-105481 CVE-2026-105482 CVE-2026-105483 CVE-2026-106069 CVE-2026-106073 CVE-2026-106074 CVE-2026-111497, lift when 24.22.1 clears the cooldown node-version: 24.22.1 - run: node --check verify.mjs - run: node --check vectors/check.mjs