Skip to content

Fix CodeQL findings in browser and coverage test helpers - #5449

Merged
kojiwakayama merged 1 commit into
mainfrom
fix/security-alert-remediation
Nov 4, 2026
Merged

kojiwakayama merged 1 commit into
mainfrom
fix/security-alert-remediation

Conversation

@kwakayama

Copy link
Copy Markdown
Contributor

The browser helper imports a Playwright Response type under the same name as the DOM constructor used to read process stderr. Alias the Playwright type so static analysis can distinguish the two. The native coverage fixtures now derive their paths from import.meta.url inside fixed JavaScript source, instead of interpolating serialized paths and group data into generated code.

Addresses CodeQL alerts 459, 458, and 457. Alert closure requires a successful scan after this reaches the default branch.

Validation on pinned Deno 2.9.7:

  • Focused Playwright helper and native executor coverage tests: 4 tests, 11 steps passed.
  • Changed helpers and tests typecheck; formatting, lint and diff checks pass.
  • codex review --base origin/main: no actionable regressions. The review environment used an older Deno; the pinned typecheck was performed separately.

The fast-uri Dependabot repair is carried in #5410, which already owns the proxy lockfile and generated package inventory.

Copy link
Copy Markdown
Contributor Author

@codex review

@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Oct 29, 2026 •

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review ✅ Completed 2026-11-04T20:48:10.628421Z 73938a6 Manual request
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@chatgpt-codex-connector

Copy link
Copy Markdown

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

@github-actions

Copy link
Copy Markdown

📦 Client bundle boundary

Entrypoint Modules Source size Server leaks
src/index.client.ts 65 362 KiB ✅ 0
src/react/components/Head.tsx 5 74 KiB ✅ 0
src/react/router/index.tsx 5 74 KiB ✅ 0
src/react/context/index.tsx 5 74 KiB ✅ 0
src/react/fonts/index.ts 6 81 KiB ✅ 0
src/react/components/ui/index.ts 111 717 KiB ✅ 0
src/react/components/ui/adapter/contract.ts 1 18 KiB ✅ 0
src/react/components/ui/icons/index.ts 3 17 KiB ✅ 0
src/chat/index.ts 305 2044 KiB ✅ 0
src/chat/ag-ui.ts 61 457 KiB ✅ 0
src/chat/protocol.ts 1 11 KiB ✅ 0
src/chat/types.ts 45 242 KiB ✅ 0
src/chat/message-prep.ts 68 517 KiB ✅ 0
src/markdown/index.ts 6 30 KiB ✅ 0
src/mdx/index.ts 2 2 KiB ✅ 0
src/agent/identity-contracts.ts 1 2 KiB ✅ 0
src/schemas/index.ts 42 216 KiB ✅ 0
src/platform/env.ts 5 53 KiB ✅ 0
src/workflow/claude-code/react/index.ts 9 91 KiB ✅ 0
src/events/index.ts 31 567 KiB ✅ 0
src/events/ag-ui/public.ts 30 561 KiB ✅ 0
src/run-events/index.ts 53 317 KiB ✅ 0

A server module in a client graph aborts hydration in the browser. New leaks fail CI; known leaks are tracked in scripts/lint/client-bundle-baseline.json to burn down.

@codecov

codecov Bot commented Oct 30, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

@kojiwakayama

Copy link
Copy Markdown
Contributor

@codex review

@chatgpt-codex-connector

Copy link
Copy Markdown

Codex Review: Didn't find any major issues. You're on a roll.

Reviewed commit: 73938a6760

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

@kojiwakayama
kojiwakayama marked this pull request as ready for review November 4, 2026 20:46
@kojiwakayama
kojiwakayama self-requested a review as a code owner November 4, 2026 20:46
@kojiwakayama
kojiwakayama added this pull request to the merge queue Nov 4, 2026
@github-actions

github-actions Bot commented Nov 4, 2026

Copy link
Copy Markdown

@codex review

@chatgpt-codex-connector

Copy link
Copy Markdown

Codex Review: Didn't find any major issues. Chef's kiss.

Reviewed commit: 73938a6760

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

@github-actions
github-actions Bot removed this pull request from the merge queue due to a manual request Nov 4, 2026
@kojiwakayama
kojiwakayama added this pull request to the merge queue Nov 4, 2026
@sonarqubecloud

sonarqubecloud Bot commented Nov 4, 2026

Copy link
Copy Markdown

Merged via the queue into main with commit 57e1d07 Nov 4, 2026
444 checks passed
@kojiwakayama
kojiwakayama deleted the fix/security-alert-remediation branch November 4, 2026 22:04
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants