Fix incomplete source audits and behavioral false positives - #725
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Source audits could report success with missing or partially sampled files, and static patterns incorrectly classified bounded Babel loops and quoted code examples as dangerous behavior. Syntax-aware scans now distinguish executable code, retain targeting-based protestware controls, invalidate old cached results, and report incomplete coverage in both human and JSON output with exit code 1. Regex
.exec()no longer implies a child process.Current-head CI is green, including 14,287 macOS workspace tests and Linux/Windows gates.
Validation: regressions reproduced before fixes; workspace build and clippy (
--all-targets, Rust 1.94.0) clean; fmt clean; fast gates passed (6,293 workspace, 5,121 CLI unit, 97 CLI integration tests). Final security tests: 528 passed; all 70 audit workflows passed, including JSON snapshots; 14 install/audit cross-command workflows also pass. All 16 CI helper groups passed. Fresh CLI runs verified official Babel 7.29.8, missing/oversized sources, positive controls, OSV failures, and cache refresh. Dev registry publish/install/audit and browser checks agree.Eight alternating cold-cache Babel audit samples per debug binary: median 161.1 → 211.4 ms, peak RSS 58.77 → 65.27 MiB. This is the bounded parsing cost for more accurate classification; release performance was not measured. The install-readiness harness passed warm and unchanged installs; its live-network cold comparison was slower (389 → 545 ms) with resolution variance. Eight alternating cold installs through a local mirror of the same four official Babel archives measured 104.9 → 106.0 ms and 87.13 → 87.28 MiB peak RSS, showing no material install regression without network variation.
Finding ledger: 3 requested CLI findings plus 1 adjacent finding received; 4 verified/fixed, 0 rejected, 0 blocked, 0 pending. Registry #183 and docs #223 cover the remaining findings. No migration.
Generated by OpenAI Codex (
GPT-6) using the Codex agent harness.