mirror of
https://github.com/NeuralNomadsAI/CodeNomad.git
synced 2026-11-13 09:14:20 +00:00
2f153e2e34
Some checks are pending
Download Caches / seed (macos-15-intel) (push) Waiting to run
Download Caches / seed (macos-26) (push) Waiting to run
Download Caches / seed (ubuntu-24.04) (push) Waiting to run
Download Caches / seed (windows-2025) (push) Waiting to run
Publish help / build (push) Waiting to run
Publish help / deploy (push) Blocked by required conditions
fix(security): qualify electron-builder 26 before Windows signing Resolve the ten remaining builder/runtime/tar alerts with electron-builder and app-builder-lib 26.18.0, builder-util-runtime 9.7.0 and tar 7.5.22. Declare the server tests' actual AJV 6 dependency so builder's AJV 8 hoisting cannot change their API; preserve the separate AJV2020 alias and production AJV 8. Before the Windows builder CLI starts, apply the three-line reviewed resource-editor correction behind an exact source hash and version fence. Keep full stable/prerelease ProductVersion and FileVersion strings alongside their numeric Windows prefixes. The actual packager edits resources before signIf; unsigned and signed metadata checks remain unchanged. Integrate the qualified PWA/runtime dependency graph rather than overwrite its lockfile. Correct the new minimatch consumers through family-scoped overrides, retain historical ASAR/temp callback APIs and remove config-file-ts's unused closure. Qualify actual matching, file copies, ASAR merges, TypeScript configuration, cancellation and resource-edit ordering. Frozen Windows/Linux installs, consumer tests, typechecks, complete builds, real offline PWA behavior and the normal Windows packaging/executable smoke qualify the combined candidate. The existing blocked Dependabot proposal stays visible until this tested replacement is merged and its alerts are independently checked. Include the explicitly user-authorized artifact announcer permission pair (PR-write, Issues-read), guarded by thirteen helper tests and the unchanged trusted-default-branch boundary. No new secret or protection change. Capture original Windows identity probes in the test fixture instead of a second misleading diagnostic lookup. Preserve the shared identity budget, retries and fencing; fifteen Node and eighteen native module checks pass. The initial OS incident remains open in #1462. Incorporate the already merged GLib backport and verify the complete 4,456-file tree before final full CI. |
||
|---|---|---|
| .. | ||
| main | ||
| preload | ||
| resources | ||
| assets.d.ts | ||
| tsconfig.json | ||