pullrequests Search Results · language:Dune language:JavaScript language:Python language:JavaScript language:Java
Filter by
182M results
The project now runs CodeQL static analysis (the security-extended query suite) on every push and pull request, and a
clean result is a release gate — the same supply-chain assurance posture as the Ed25519 ...
緊急: ビルド全停止の復旧
#306 で sharp を package.json に追加した際、package-lock.json に sharp の推移的依存(is-arrayish/color-string/simple-swizzle
等)が反映されておらず、Render のビルド(npm ci)が Missing: is-arrayish@0.3.4 from lock file で status ...
问题
DeterministicProvider.chat_with_tools() 永远不返回 tool_calls,AgentLoop 对写操作只输出空文本 → pending_action 永不创建 → confirmation
流程完全短路。
根因
AgentLoop 依赖 LLM 返回 tool_calls 来触发 _step_pending,DeterministicProvider ...
This PR contains the following updates:
| Package | Change | Age | Confidence |
| --- | --- | --- | --- |
| turbo (source) | 2.9.14 → 2.9.18 | age | confidence |
Release Notes
details summary vercel/turborepo ...
Audit report
No fixable problems found (7 unfixable, 25 only fixable manually using --force)
3. to review
dependencies
TL;DR
The script tag at line 18 loads react-cache from unpkg.com without a Subresource Integrity (SRI) hash. A compromised
CDN, BGP hijack, or man-in-the-middle attack could serve malicious JavaScript. ...
🤖 AI Security Remediation
🟢 Auto-merge eligible — will merge after CI passes.
📊 Analysis
- Severity: MEDIUM
- Confidence: 85%
- Auto-fix allowed: True
📝 Summary
The application uses the subprocess ...
ai-remediation
severity-medium
The recursive serve path carried the 5 holiday features frozen from the last history row → future holidays invisible.
They re deterministic functions of the forecast date, exactly like the calendar features ...
Builds on the sleep-until-window scheduling (already on main) to make the autofill reliable despite GitHub s flaky
scheduler, and adds a substantial test pass on the previously-untested internals. Review ...