Repository navigation
TEST ONLY: combined #512 #514 #515 #516 #517 - #518
Draft
nikhil-mittal-165 wants to merge 19 commits into
Draft
nikhil-mittal-165 wants to merge 19 commits into
nikhil-mittal-165 wants to merge 19 commits into
Conversation
Removes all known-vulnerable libraries from the SFGE Java runtime classpath (osv-scanner on dist/java-lib: 84 advisories across 24 artifacts -> 0; 97 JARs -> 35). - Remove unused gremlin-driver (and the netty-all constraint). It was the sole source of Netty and AWS SDK JARs. - Move Gremlin from 4.0.0-beta.1 to stable 3.7.7. Every 4.0 beta bundles Jackson 2.15.2 inside gremlin-shaded. (3.8.2 changes traversal behavior and breaks tests.) - Exclude gremlin-shaded (only used for GraphSON/Gryo/GraphML IO, which SFGE does not use; its bundled Jackson cannot be patched via constraints). Add a minimal JsonProcessingException stand-in because TinkerGraph references the type. - Exclude commons-collections 3.x (no patched release; SFGE uses collections4). - Upgrade log4j to 2.25.5; force patched commons-configuration2, commons-beanutils and snakeyaml; declare commons-lang3 and commons-text explicitly. - Add verifyNoBannedDependencies build check and NoVulnerableBundledLibrariesTest to prevent regressions. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Replace the long-lived NPM_TOKEN with npm Trusted Publishing, ahead of npm's bypass-2fa publish deprecation. - Grant id-token: write on the publish job - Move the publish job to Node 22 and upgrade npm (Trusted Publishing needs Node >= 22.14.0 and npm >= 11.5.1; OIDC dist-tag needs npm >= 11.21.0) - Drop the NPM_TOKEN .npmrc write Requires each published package to have this workflow configured as a trusted publisher on npmjs.com (with "Allow npm dist-tag" enabled) before merging. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Install npm@11 (>= 11.21.0 has OIDC dist-tag support) instead of latest, to stay consistent with the code-analyzer repo, which must stay on npm 11 because npm 12 removed shrinkwrap support. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
…ustom rulesets resolve Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Previously every readFile failure on the results file was reported as "the Flow Scanner did not produce a results file". Now only ENOENT gets that message; any other failure (permissions, directory, etc.) is reported with a new ResultsFileNotReadable message and keeps the original error as the cause. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
…cies copyDependencies only added files to dist/java-lib, so an incremental build after switching branches could keep jars that were removed from the runtime classpath (Netty, AWS, shaded Jackson, etc.) and still pass the banned dependency check. Delete everything except sfge-*.jar first so the packed directory always matches a clean build. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
The workflow installs the moving npm@11 tag. Print the resolved version and fail fast if it is older than 11.21.0 (needed for dist-tag management via OIDC) instead of failing mid-release. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
…a classpath Adding process.cwd() to the PMD classpath re-exposed the scanned repository to the JVM as a source of classes and resources (CWE-427, see #503). Instead, copy only the xml ruleset files that custom rulesets reference (transitively, and never from outside the base folder, including via symlinks) into a staging folder in the working folder and put just that folder last on the classpath. Repo-relative rule refs keep resolving (#2087). Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
…on' into nikhil.mittal/combined-pr-512-514-515-516-517
…hing' into nikhil.mittal/combined-pr-512-514-515-516-517
…tern' into nikhil.mittal/combined-pr-512-514-515-516-517
…' into nikhil.mittal/combined-pr-512-514-515-516-517
…t-cwd-refs' into nikhil.mittal/combined-pr-512-514-515-516-517
|
Git2Gus App is installed but the |
API v68 flows can declare <runInMode>UserMode</runInMode>, which was missing from the RunMode enum, so RunMode[...] raised KeyError and the scan crashed (even for flows with no <ends> element). Add UserMode (treated like DefaultMode, i.e. user context), and make unrecognized runInMode values log a warning and fall back to DefaultMode instead of crashing the whole scan. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
…' into nikhil.mittal/combined-pr-512-514-515-516-517
Contributor
Author
|
Updated with the new #515 commit (9acbd97, 🤖 Generated with Claude Code |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Testing branch only. Do not merge. This combines the open PRs below so they can be tested together. The individual PRs are unchanged and remain the source of truth for review and merge.
copyDependencies)<ends>elements in the Flow engine (+ results-file read error handling)HardcodedIdSalesforce ID patternAll five branches merged into
devwith no conflicts.Verified locally on this branch: PMD engine suite (151 tests), Flow wrapper tests (10), and the Flow Python unit tests for the ID and
<ends>changes. Not covered here: the manual validation items listed in each PR's self-review (packed CLI runs, Java 11/LTS, Windows, live npm publish).🤖 Generated with Claude Code