From 40af2156d99e5454b3beffb5e0a5454ea6520457 Mon Sep 17 00:00:00 2001 From: Anthony Ettinger Date: Mon, 17 Aug 2026 07:28:56 +0000 Subject: [PATCH] chore(threatcrush-scan): pin 0.11.3, and pack 2.0.1 to re-sync consumers MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 0.11.3 carries two false-positive fixes that reach nobody on a pinned pack until this moves — which is the standing property this pack documents about itself, not a surprise. - go-shell-exec-command no longer fires on a fully literal argv (profullstack/threatcrush#158). `exec.Command("cmd", "/c", "ver")` has nothing in it for anyone to influence; gosec's G204 draws the same line. - js-uninitialized-buffer no longer fires on a buffer filled before use (#156). Spec and integrity bumped in the same edit, as the input's own description requires: a hash from a different version fails closed, which is the right direction to fail and a confusing one to debug. The hash is npm's `dist.integrity` for 0.11.3, verified independently rather than copied — the published tarball was downloaded and hashed, and `openssl dgst -sha512 | openssl base64` reproduces it byte for byte: sha512-lxWvTtLDgckiWlRB3wMSoBNfMZ/3ao0CcmwETGyKclc+5NMU5Pl0jXSr0h+QrTtfxh7TNStk4ZgP5h8xbEvIWw== Verified against the published package rather than a local build: installed @profullstack/threatcrush@0.11.3 from the registry and re-scanned. Quiesce, the Go CLI whose single finding motivated #158, now reports 0. The malware-test-prs fixtures still report all 43 criticals, so detection has not moved. README's documented default moved with the manifest so the two cannot disagree. The 1.6.0/0.11.0 anecdote further down is left alone; it is accurate history and it is the reason this pack explains the lag at all. Co-Authored-By: Claude Opus 5 (1M context) --- packages/actions/threatcrush-scan/README.md | 4 ++-- packages/actions/threatcrush-scan/sh1pt.actionpack.yaml | 6 +++--- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/packages/actions/threatcrush-scan/README.md b/packages/actions/threatcrush-scan/README.md index 4a50cab3..0ff3ef60 100644 --- a/packages/actions/threatcrush-scan/README.md +++ b/packages/actions/threatcrush-scan/README.md @@ -14,8 +14,8 @@ sh1pt actions install threatcrush-scan --repo owner/name --pr | --- | --- | --- | | `scanPath` | `.` | Path to scan, relative to the repository root. | | `nodeVersion` | `20` | See *Node 20, deliberately*, below. | -| `threatcrushPackageSpec` | `@profullstack/threatcrush@0.11.2` | npm spec used to install the CLI. Pinned rather than `@latest` so one bad publish cannot break every consumer at once; bump it in a pack release. | -| `threatcrushIntegrity` | *(sha512 of 0.11.2)* | SRI hash of that tarball. The workflow downloads, hashes and compares before installing, and refuses to install on a mismatch. Bump it with the spec — read it from `npm view dist.integrity`. Empty skips the check. | +| `threatcrushPackageSpec` | `@profullstack/threatcrush@0.11.3` | npm spec used to install the CLI. Pinned rather than `@latest` so one bad publish cannot break every consumer at once; bump it in a pack release. | +| `threatcrushIntegrity` | *(sha512 of 0.11.3)* | SRI hash of that tarball. The workflow downloads, hashes and compares before installing, and refuses to install on a mismatch. Bump it with the spec — read it from `npm view dist.integrity`. Empty skips the check. | | `failOn` | *(empty)* | Comma-separated severities that fail the job, e.g. `critical,high`. Empty is report-only. | | `uploadSarif` | `true` | Upload to the Security tab. Emits `security-events: write`. | | `commentOnPr` | `true` | Post the report as a pull request comment. Emits `pull-requests: write`. | diff --git a/packages/actions/threatcrush-scan/sh1pt.actionpack.yaml b/packages/actions/threatcrush-scan/sh1pt.actionpack.yaml index b070855f..16186b68 100644 --- a/packages/actions/threatcrush-scan/sh1pt.actionpack.yaml +++ b/packages/actions/threatcrush-scan/sh1pt.actionpack.yaml @@ -5,7 +5,7 @@ description: >- Scans pull requests for hardcoded credentials, injection, SSRF, unsafe deserialisation and dependency tampering, and uploads SARIF to the Security tab. -version: 2.0.0 +version: 2.0.1 publisher: profullstack visibility: public license: MIT @@ -32,7 +32,7 @@ inputs: that fails without a full toolchain. threatcrushPackageSpec: type: string - default: '@profullstack/threatcrush@0.11.2' + default: '@profullstack/threatcrush@0.11.3' description: >- npm spec used to install the CLI. Pinned, not `@latest`: a scanner that runs on every pull request is a dependency, and `@latest` means one bad @@ -42,7 +42,7 @@ inputs: version that was checked first. threatcrushIntegrity: type: string - default: 'sha512-8N3jqCQixK0Onc+/bvuJaNCSvGZlJYZcSAGsd1nEfRZ4kOu1Ifom7Bd1t2muYJAmAxBTPmz1iseWSay/0gg3Gw==' + default: 'sha512-lxWvTtLDgckiWlRB3wMSoBNfMZ/3ao0CcmwETGyKclc+5NMU5Pl0jXSr0h+QrTtfxh7TNStk4ZgP5h8xbEvIWw==' description: >- Subresource-integrity hash of the tarball named by threatcrushPackageSpec, in npm's own `sha512-` form. The workflow downloads, hashes and