You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
#887 contained one useful delta beyond the already-canonicalized #886 tree: a regression that makes the documented simple-path/Cormen authority itself executable.
the production matcher, cycle/distinct-key regression file, dependency-policy text, and existing policy-module cycle tests were byte-identical between the sibling repairs; fix(supply-chain): restore simple-path authority and lock policy text #887 additionally added test_dependency_policy_documents_named_dependency_path_simple_path_authority.
Canonical #867 now points to merge commit 09a27eb7c1e0bd41d07c5db0b88e23fb1d4ab545 with parents f270d3df… and 593b6fe6… and tree exactly equal to #887's reviewed tree (06daf864cc5961961ca810bd59fe916bb6d07964). Exact compare 593b6fe6… → 09a27eb7… reports zero changed files.
Therefore #887 has no remaining unique semantic/file delta outside canonical #867. No #887 checks/reviews/approval transfer; #867 must regenerate exact-current-head evidence on 09a27eb7….
Bolt reapplied a shared (package_key, matched_count) cache on top of the
already-restored simple-path walk. That cache lets one package key satisfy
two owner-chain positions through a cycle. Restore path-local frozenset
prevention, keep the cycle and distinct-key regressions in two test
modules, drop the unauthorized pdfjs-dist Trivy ignore, and record the
unsafe optimization as a rejected change.
Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>
Bolt head bcf22ee replaced the validated frozenset walk with recursive
DFS and deleted the cycle regressions plus the Cormen et al. (2022)
simple-path citation. Restore the locked iterative walk and keep a
policy-text assertion so the next rewrite cannot drop the authority.
Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Landing vehicle for the simple-path restore
Exact head 593b6fe6 is the f270d3df / #886 / #867 restore plus test_dependency_policy_documents_named_dependency_path_simple_path_authority. That policy-text lock is the reason to prefer this tree: it fails on the Bolt-deleted citation and would have blocked bcf22eea from dropping Cormen et al. (2022, Appendix B.4).
The walk is the validated iterative path-local frozenset. Cycle False, distinct keys True, and direct ("alpha", "charlie")True were reproduced. Mark this PR ready for review, then land it. Close #886 and #867 as the same-SHA restore without the policy lock. Do not open another restore PR. Do not merge #867 at any older DFS head.
Still missing on this head: a locked assert that the cyclic fixture still matches ("alpha", "charlie"). Add that next to the existing False cycle case before treating the lock set as complete.
This run cannot approve or merge. Independent review remains with seonghobae. Inherited pdfjs-dist / CVE-2026-16633 stays on #783.
The reason will be displayed to describe this comment to others. Learn more.
Keep as residual policy-text lock only
#867 exact head is now f270d3dfece13ab6d54c260b8b094e9a7335a548, the same restore this draft was opened to replace after bcf22eea. Cycle ("alpha", "alpha", "charlie") is False, distinct keys are True, and direct ("alpha", "charlie") is True on that head. This automation APPROVED #867 for that restore.
This draft's unique remaining value is test_dependency_policy_documents_named_dependency_path_simple_path_authority. That is hardening, not a second landing of the walk.
Next action: do not merge #867 and #887 as two landings. After #867 merges, either fold the policy-text lock onto develop as a follow-up or close this draft as superseded. Inherited pdfjs-dist / CVE-2026-16633 stays with #783.
Preserve the canonical #867 repair while incorporating #887's additional regression that makes the documented simple-path/Cormen authority executable. The resulting tree is exactly #887's reviewed tree; both sibling repair histories remain explicit parents so no unique evidence-bearing delta is discarded.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
Closed as proven superseded by canonical #867
#887 contained one useful delta beyond the already-canonicalized #886 tree: a regression that makes the documented simple-path/Cormen authority itself executable.
Immediately before consolidation:
f270d3dfece13ab6d54c260b8b094e9a7335a548;593b6fe605db4aa95f1890bf9ea7ab2aca973283, both descending frombcf22eea40d2a5a1563e738ad7a508bbd3dae565;test_dependency_policy_documents_named_dependency_path_simple_path_authority.Canonical #867 now points to merge commit
09a27eb7c1e0bd41d07c5db0b88e23fb1d4ab545with parentsf270d3df…and593b6fe6…and tree exactly equal to #887's reviewed tree (06daf864cc5961961ca810bd59fe916bb6d07964). Exact compare593b6fe6… → 09a27eb7…reports zero changed files.Therefore #887 has no remaining unique semantic/file delta outside canonical #867. No #887 checks/reviews/approval transfer; #867 must regenerate exact-current-head evidence on
09a27eb7….