mirror of
https://github.com/onyx-dot-app/onyx.git
synced 2026-10-21 11:00:28 -05:00
claude[bot]andClaude
b5ba31c965
<!-- claude-slack-attribution -->
_Requested by **Nikolas Garza** · [Slack
thread](https://onyx-company.slack.com/archives/C0C5SMAM4TT/p1792538621965719?thread_ts=1792538621.965719&cid=C0C5SMAM4TT)_
## Description
Before: The CVE audit reported every open Dependabot alert, even when
the alert named a manifest that is not in the checkout. For example,
issue #16345 cited alert #1369 for `loadtest/uv.lock`, which does not
exist on main. The certifi and pillow fixes were already in `uv.lock`,
but the finding came back on each run.
After: The audit drops a Dependabot alert when its manifest path is not
a file in the checkout. An alert with no manifest path stays, and so
does every alert if the repo root cannot be found.
What it does: stops stale Dependabot alerts from becoming audit findings
and tracking issues.
How: `auditDependabot` calls the new `dropMissingManifests` after
parsing the alerts. It resolves each manifest path against the git root.
Table-driven tests cover the filter, and one test runs `auditDependabot`
with a fake `gh`. Existing test fixtures now create the `pyproject.toml`
their alert cites.
## Not done
- Installed-version check: the tool has no lockfile reader that returns
the installed version of an arbitrary package. The OSV scan only reports
vulnerable packages. I did not add a new parser. An alert for a manifest
that exists, with a fix already installed, still shows until Dependabot
closes it.
- "Also failed on this run" replies: `PlanAnnouncement` only knows the
advisory-to-thread map. It has no record of earlier replies, and the
existing tests expect the reply on each failing run. Skipping it needs
new persistent state, so I made no change.
## How Has This Been Tested?
`go build ./... && go vet ./... && go test ./...` in `tools/ods` all
pass. `pre-commit` is not installed in this environment, so it did not
run.
Linear: none. No Linear link in this PR.
## Additional Options
- [ ] [Optional] Please cherry-pick this PR to the latest release
version.
---
_Generated by [Claude
Code](https://claude.ai/code/session_01E2K27DFf4J3iAGXYpe4xtR)_
<!-- This is an auto-generated description by cubic. -->
---
## Summary by cubic
Stops the CVE audit from turning stale Dependabot alerts into findings
and tracking issues when the alert's manifest no longer exists in the
checkout.
- The audit drops alerts whose manifest path is not a file in the git
root; alerts without a manifest path, and all alerts when the repo root
cannot be found, are kept.
- No installed-version check was added: an alert for a manifest that
exists still shows even when the fix is already installed.
<sup>Written for commit e9f75ffadc.
Summary will update on new commits.</sup>
<a
href="https://cubic.dev/pr/onyx-dot-app/onyx/pull/16358?utm_source=github"
target="_blank" rel="noopener noreferrer"
data-no-image-dialog="true"><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source
media="(prefers-color-scheme: light)"
srcset="https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img
alt="View guided diff"
src="https://www.cubic.dev/buttons/review-in-cubic-light.svg"></picture></a>
<a
href="https://www.cubic.dev/action/auto-fix/pr/onyx-dot-app/onyx/16358?returnTo=https%3A%2F%2Fgithub.com%2Fonyx-dot-app%2Fonyx%2Fpull%2F16358&source=description"
target="_blank" rel="noopener noreferrer"
data-no-image-dialog="true"><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://www.cubic.dev/buttons/turn-on-auto-fix-dark.svg"><source
media="(prefers-color-scheme: light)"
srcset="https://www.cubic.dev/buttons/turn-on-auto-fix-light.svg"><img
alt="Turn on auto-fix"
src="https://www.cubic.dev/buttons/turn-on-auto-fix-light.svg"></picture></a>
<!-- End of auto-generated description by cubic. -->
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
<!-- coderabbit-ai-generated:v1 -->
## Summary by CodeRabbit
* **Bug Fixes**
* Removed dependency audit findings associated with manifest files that
are missing from the checked-out repository.
* Continued retaining findings without manifest paths and findings when
the repository location cannot be determined.
* **Tests**
* Added coverage for missing, nested, directory-based, and manifest-free
dependency findings.
* Updated audit scenarios to include Python project manifest fixtures.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: Claude <noreply@anthropic.com>
