Repository navigation
doc-audit: fix stale CLAUDE.md claims + critical zip dependency CVEs - #823
Merged
Merged
Conversation
- main_helpers/CLAUDE.md: spawn_background_save() runs save_files() only (JSON, no git commit), not save_all() as previously documented. - utils/CLAUDE.md: updater.rs's background update check is spawned directly from main.rs, not from main_helpers/update.rs (which only supplies the jittered interval and renders the result). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01J2wAinwdrwNYz4VZ9hDnPG
cargo audit flagged zip 8.5/8.6 for RUSTSEC-2026-0367/0368/0369: extract() could follow attacker-controlled symlinks outside the destination directory (9.1 critical), including SUID/SGID preservation. zip is only used by the Windows updater's extract_archive() via ZipArchive::new()/ extract() -- both signatures are unchanged in 9.1.2, which defaults symlink extraction to ExtractRecursiveInFolder (confined to the destination), so no code changes are needed beyond the version bump. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01J2wAinwdrwNYz4VZ9hDnPG
stphung
enabled auto-merge (squash)
October 26, 2026 17:34
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01J2wAinwdrwNYz4VZ9hDnPG
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Scheduled
/doc-auditrun (6 parallel agents cross-referencing everyCLAUDE.md,docs/*.md,docs/dossiers/*.md, andREADME.mdagainst current source). Two stale claims were found and fixed;make checkalso surfaced a critical, unrelated security issue that's included here since it blocked the gate.src/main_helpers/CLAUDE.md:spawn_background_save()was documented as runningsave_all(); it actually only callssave_files()(JSON-only, no git commit).src/utils/CLAUDE.md: the background update-check integration point was documented as being called frommain_helpers/update.rs; it's actually spawned directly frommain.rs(update.rsonly supplies the jittered interval and renders the result).Cargo.toml: bumpedzipfrom8.5to9.1—cargo auditflagged RUSTSEC-2026-0367/0368/0369 (critical, 9.1 CVSS) whereZipArchive::extract()could follow attacker-controlled symlinks outside the destination directory, including SUID/SGID preservation.zipis only used by the Windows updater'sextract_archive();ZipArchive::new()/.extract()signatures are unchanged in 9.1.2, which also defaults symlink extraction toExtractRecursiveInFolder(confined to the destination dir), so no code changes were needed beyond the version bump.One additional finding was not auto-fixed and is flagged for human review: README.md advertises an MIT license (badge + prose) but no
LICENSEfile exists in the repo andCargo.tomlhas nolicensefield. Adding/removing that claim is a decision for the repo owner, not something to fix unilaterally.All 6 audit agents otherwise found the docs current and accurate — no other discrepancies across core engine, content systems, progression systems, or infrastructure module docs.
Test plan
make check— fmt, clippy, full test suite, progression check, voyage simulator,cargo audit --deny yankedall passzip9.1.2'sZipArchive::new()/.extract()API is unchanged from 8.x by inspecting the vendored crate source (no call-site changes needed insrc/utils/updater.rs)Generated by Claude Code