chore(threatcrush-scan): pin 0.11.3, and pack 2.0.1 to re-sync consumers - #971
Merged
Conversation
0.11.3 carries two false-positive fixes that reach nobody on a pinned pack until this moves — which is the standing property this pack documents about itself, not a surprise. - go-shell-exec-command no longer fires on a fully literal argv (profullstack/threatcrush#158). `exec.Command("cmd", "/c", "ver")` has nothing in it for anyone to influence; gosec's G204 draws the same line. - js-uninitialized-buffer no longer fires on a buffer filled before use (#156). Spec and integrity bumped in the same edit, as the input's own description requires: a hash from a different version fails closed, which is the right direction to fail and a confusing one to debug. The hash is npm's `dist.integrity` for 0.11.3, verified independently rather than copied — the published tarball was downloaded and hashed, and `openssl dgst -sha512 | openssl base64` reproduces it byte for byte: sha512-lxWvTtLDgckiWlRB3wMSoBNfMZ/3ao0CcmwETGyKclc+5NMU5Pl0jXSr0h+QrTtfxh7TNStk4ZgP5h8xbEvIWw== Verified against the published package rather than a local build: installed @profullstack/threatcrush@0.11.3 from the registry and re-scanned. Quiesce, the Go CLI whose single finding motivated #158, now reports 0. The malware-test-prs fixtures still report all 43 criticals, so detection has not moved. README's documented default moved with the manifest so the two cannot disagree. The 1.6.0/0.11.0 anecdote further down is left alone; it is accurate history and it is the reason this pack explains the lag at all. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
vu1nz Security Review0 finding(s) in PR #? No security issues found. |
ThreatCrush Security Scan84 finding(s) HIGH/CRITICAL: 1 | MEDIUM: 20 | LOW: 63
…and 34 more. Full results in the Security tab. Snippets are redacted; ThreatCrush never prints matched credential material. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A scanner release is not finished until this pin moves — the property this pack's own README explains. threatcrush v0.11.3 is published, so here is the other half.
What 0.11.3 carries
go-shell-exec-commandno longer fires on a fully literal argv (threatcrush#158).exec.Command("cmd", "/c", "ver")re-introduces a shell but has nothing in it for anyone to influence; gosec's G204 draws the line in the same place. Concatenation,fmt.Sprintfand bare variables still report.js-uninitialized-bufferno longer fires on a buffer filled before use (threatcrush#156).The bump
threatcrushPackageSpec@profullstack/threatcrush@0.11.2@profullstack/threatcrush@0.11.3threatcrushIntegritysha512-8N3jqCQi…sha512-lxWvTtLD…version2.0.02.0.1Both inputs moved in the same edit, as the input's own description requires: a hash from a different version fails closed, which is the right direction to fail and a confusing one to debug. The pack version moves so the fleet re-syncs consumers.
Verification
The hash was not copied from
npm view— it was reproduced. The published tarball was downloaded and hashed independently:Matches the manifest byte for byte.
And the behaviour was verified against the published package rather than a local build — installed from the registry, then re-scanned:
Every
{{placeholder}}inworkflow.ymlstill resolves against the manifest's inputs, and the YAML parses.🤖 Generated with Claude Code