From dfb80cdf85efbdc1022ca74b8cbd3cc519489e61 Mon Sep 17 00:00:00 2001 From: KDR Date: Tue, 4 Aug 2026 22:17:25 -0700 Subject: [PATCH 1/2] build(deps-dev): bump postcss to 8.5.25 + brace-expansion to 5.0.9 in /vscode MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - postcss 8.5.19 -> 8.5.25: attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset (GHSA follow-up fix) - brace-expansion 5.0.8 -> 5.0.9: DoS via unbounded intermediate arrays Lockfile-only, within existing semver ranges (via @vscode/vsce -> minimatch and tsup/vite -> postcss). vscode npm audit: 0 vulnerabilities. NOT addressed (upstream-blocked): root brace-expansion 5.0.7 + undici 8.5.0 are pinned inside @earendil-works/pi-coding-agent's npm-shrinkwrap.json — overrides/audit fix are silently ignored for shrinkwrapped subtrees, and even pi-coding-agent 0.83.0 still declares undici 8.5.0 exactly. Needs an upstream pi release + a reviewed pin bump. --- vscode/package-lock.json | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/vscode/package-lock.json b/vscode/package-lock.json index b34849a9..4ed3afa2 100644 --- a/vscode/package-lock.json +++ b/vscode/package-lock.json @@ -2554,9 +2554,9 @@ "license": "BSD-2-Clause" }, "node_modules/brace-expansion": { - "version": "5.0.8", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.8.tgz", - "integrity": "sha512-JZyDyq3D4AUifKTPOB7DELf6XsB3WdPuNxCtob1vFXPsSXhdAiHBWJ/tJ8HAc9aH84BK+5JFZLNkJKx3G9kzQg==", + "version": "5.0.9", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz", + "integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==", "dev": true, "license": "MIT", "dependencies": { @@ -4958,9 +4958,9 @@ } }, "node_modules/postcss": { - "version": "8.5.19", - "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.19.tgz", - "integrity": "sha512-Mz8SaolMd8nB+G13WkORcxQKHZ/NE4xXevtkJHVuG+guo9/wYKlIMTKAqGdEmYOXR2ijPjTYNHssizdaVSUNdQ==", + "version": "8.5.25", + "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.25.tgz", + "integrity": "sha512-DTPx3RWSSnWyzLxQnlH0rJP+EW5ekl16ZU4/psbIhA0e53kJfdgaN5vKM+xP7yJtXVu+nfdVFmlgFDEKAe4Pyw==", "dev": true, "funding": [ { @@ -4978,7 +4978,7 @@ ], "license": "MIT", "dependencies": { - "nanoid": "^3.3.12", + "nanoid": "^3.3.16", "picocolors": "^1.1.1", "source-map-js": "^1.2.1" }, From 836b3fbd82f3fe4a33e7c5b59604eac0596558ca Mon Sep 17 00:00:00 2001 From: KDR Date: Tue, 4 Aug 2026 22:17:25 -0700 Subject: [PATCH 2/2] test(index): deterministic abort point for the add --all backpressure test MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The 100ms wall-clock abort raced wave 0's child processes under suite load: landing mid-spawn surfaces node's generic AbortError (reason demoted to cause) instead of signal.reason, and wave-0 membership may not be written yet — failing both assertions intermittently (bit this run and PR #149's CI). Abort once the wave-0 member is visibly written, when the run is provably inside the 60s between-wave settle sleep whose abort path rejects with the reason. Bail out early if the run settles first so a real failure surfaces through assert.rejects instead of an unhandled rejection + poll-to-deadline. --- test/unit/face-index.test.ts | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/test/unit/face-index.test.ts b/test/unit/face-index.test.ts index 1f3aa19e..1b2ed8d9 100644 --- a/test/unit/face-index.test.ts +++ b/test/unit/face-index.test.ts @@ -2135,7 +2135,19 @@ test("aborting during add --all backpressure stops before the next wave", async input: "add", rest: [], opts: { all: true, to: "col_abort", batch: 1 }, case: openCase(cdir), profile, signal: controller.signal, }); - setTimeout(() => controller.abort(new Error("test abort")), 100); + // Abort only once wave 0's membership is visibly written: the run is then + // guaranteed to be inside the 60s between-wave settle sleep, whose abort + // path rejects with signal.reason. A wall-clock timer races the wave-0 + // child processes under suite load — the abort can land mid-spawn, where + // node throws its own generic AbortError (reason demoted to `cause`). + let runSettled = false; + void run.catch(() => {}).finally(() => { runSettled = true; }); + const deadline = Date.now() + 30_000; + while (!runSettled && (findIndex(openCase(cdir), "col_abort")?.members.length ?? 0) < 1) { + assert.ok(Date.now() < deadline, "wave 0 never registered its member"); + await new Promise((r) => setTimeout(r, 10)); + } + controller.abort(new Error("test abort")); await assert.rejects(run, /test abort/); assert.equal(findIndex(openCase(cdir), "col_abort")!.members.length, 1, "second wave was never submitted"); } finally {