james/carol
james/carol
1
1
Fork 0
Code Issues 44 Pull requests 7 Projects Releases 25 Packages 1 Wiki Activity Actions

chore(security): ignore CVE-2026-12151 in Next.js bundled undici #240

Merged
james merged 1 commit from trivyignore-next-undici into main 2026-06-23 13:13:32 +00:00
Conversation 1 Commits 1 Files changed 1 +24
james commented 2026-06-23 12:40:01 +00:00
Owner
Copy link
No description provided.
chore(security): ignore CVE-2026-12151 in Next.js bundled undici
All checks were successful
Commits / Conventional Commits (pull_request) Successful in 8s
Details
PR / OSV-Scanner (pull_request) Successful in 1m49s
Details
PR / Client (web export smoke) (pull_request) Successful in 2m7s
Details
PR / Lint (pull_request) Successful in 2m11s
Details
PR / Static analysis (pull_request) Successful in 2m13s
Details
PR / pnpm audit (pull_request) Successful in 2m22s
Details
PR / OpenAPI (pull_request) Successful in 2m46s
Details
PR / Package age policy (soft) (pull_request) Successful in 34s
Details
PR / Typecheck (pull_request) Successful in 2m54s
Details
Secrets / gitleaks (pull_request) Successful in 47s
Details
PR / Test (sqlite) (pull_request) Successful in 3m5s
Details
PR / Build (pull_request) Successful in 3m10s
Details
PR / Test (postgres) (pull_request) Successful in 3m10s
Details
PR / Coverage (soft) (pull_request) Successful in 1m20s
Details
PR / Trivy (image) (pull_request) Successful in 1m49s
Details
0c8fedb4c5
 
Next.js 16.2.9 bundles undici 6.21.0 inside
next/dist/compiled/edge-runtime/index.js. The vendored copy is not
in pnpm-lock and cannot be bumped without upgrading Next.js; 16.2.9
is the latest stable.

Carol has zero Edge routes — proxy.ts is Node-only and no route
under apps/api/app/ declares runtime = 'edge', so the bundled
edge-runtime/index.js ships on disk but is never loaded at
runtime. Mirrors the picomatch precedent already in .trivyignore.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
forgejo-actions commented 2026-06-23 12:43:20 +00:00
Copy link

📊 Test coverage

Patch coverage: no testable lines changed.

Overall (app/, lib/, db/, excluding UI per ADR-0019):

Metric Value Soft target
Lines 83.0% ✅ ≥ 50%
Branches 75.9% ✅ ≥ 75%
Functions 91.3% informational

Soft thresholds per ADR-0019. Coverage is informational and does not block merge.

<!-- coverage-comment --> ## 📊 Test coverage **Patch coverage:** no testable lines changed. **Overall** (`app/`, `lib/`, `db/`, excluding UI per ADR-0019): | Metric | Value | Soft target | |---|---|---| | Lines | 83.0% ✅ | ≥ 50% | | Branches | 75.9% ✅ | ≥ 75% | | Functions | 91.3% | informational | Soft thresholds per [ADR-0019](docs/adr/0019-coverage-soft-targets.md). Coverage is informational and does not block merge.
james merged commit 542dfd6d9e into main 2026-06-23 13:13:32 +00:00
james deleted branch trivyignore-next-undici 2026-06-23 13:13:32 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
area:auth
Authentication and authorization

  
area:ci
Forgejo Actions, build, test, security, release

  
area:db
Database abstraction, migrations, persistence

  
area:infra
Containerization, deployment, foundational tooling

  
area:native
React Native app (Android + Linux Flatpak)

  
area:pwa
PWA / web frontend

  
area:service
Backend service, API routes, persistence

  
epic
High-level tracker; links several feature tickets

  
feature
A user-facing feature

  
foundation
Foundational work that other tickets build on

No labels
area:auth
area:ci
area:db
area:infra
area:native
area:pwa
area:service
epic
feature
foundation
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
2 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
james/carol!240
No description provided.