security: retire resolved findings from 2026-06-19 SARIF files - #685
Merged
Conversation
All seven findings in the full-repo-audit (S001–S007) and the two actionable findings in the lsp-vscode-audit (S006, S007) have been remediated by earlier commits and PRs. Clear them from findings.sarif so the security-audit-sarif.yml workflow re-uploads the files and GitHub code scanning marks the stale alerts as fixed. Fixes resolved per finding: - S001/S002 (symlink traversal, HIGH): os.OpenRoot RESOLVE_BENEATH — PR #670 - S003 (missing recover, MED): per-goroutine defer recover() — PR #670 - S004 (catalog OOM, LOW): 10 000-file cap — PR #670 - S005 (hasSymlinkAncestor, LOW): error return when boundary unknown — PR #670 - S006 (include URL scheme, INFO): explicit strings.Contains check — PR #670 - S007 (githooksync unbounded read, INFO): bytelimit.ReadFileLimited — PR #670 - LSP/VSCode S006 (kinds commands, LOW): isTrusted() guard in kinds.ts - LSP/VSCode S007 (rule-doc provider, LOW): isTrusted() guard in wiring.ts The lsp-vscode-audit S001–S005 entries are positive security-posture confirmations (security-severity: 0.0) and are retained as reference. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013QMx3tTsvn9BiCut4crSCN
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files
☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
…ort.md findings.sarif already had S006/S007 results removed in the previous commit; this keeps findings.json and report.md in sync so a future skill run reading findings.json as a prior-audit baseline does not carry-forward already-fixed findings and re-open the GitHub alerts. Both findings were fixed by PR #670: - S006: isWorkspaceTrusted added to commandPalette when-conditions (package.json:125-130) and isTrusted() guard in kinds.ts:42,58 - S007: isTrusted() guard added to RULE_SCHEME content provider (wiring.ts:915) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013QMx3tTsvn9BiCut4crSCN
All 7 findings from the 2026-06-19 full-repo audit were fixed in PR #670. The companion SARIF results were already cleared; this adds the matching status/fixed_by fields to findings.json so the two files agree on fix state — the same pattern applied for lsp-vscode S006/S007. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013QMx3tTsvn9BiCut4crSCN
jeduden
added
queue
Owner
Author
|
🟢 Merge Queue — picked up This PR is in the queue and will be batched with other Next: No action needed — you'll get another comment when CI starts on the batch. View merge queue run. |
Owner
Author
|
🔵 Merge Queue — CI running Merged into batch branch Next: No action needed — you'll be notified when CI completes. |
jeduden
removed
the
queue:active
Owner
Author
|
✅ Merge Queue — merged This PR landed on Next: Done — nothing more to do here. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
All security findings from the 2026-06-19 full-repo and lsp/vscode audits have been remediated by earlier commits merged via PR #670 and related PRs. This PR updates the two
findings.sariffiles so thesecurity-audit-sarif.ymlworkflow re-uploads them and GitHub code scanning marks the stale alerts as fixed.Dependabot status: All 4 historical Dependabot alerts are already in
fixedstate — no action needed there.Code scanning alerts closed by this PR (stale since the fix was already in
main):<?include?>symlink traversalos.OpenRootRESOLVE_BENEATH (PR #670)<?catalog?>symlink traversalos.OpenRootRESOLVE_BENEATH (PR #670)recover()defer recover()(PR #670)hasSymlinkAncestorunverifiable boundarystrings.Containscheck (PR #670)bytelimit.ReadFileLimited(PR #670)isTrusted()guard inkinds.tsisTrusted()guard inwiring.tsThe lsp-vscode-audit S001–S005 entries (all
security-severity: 0.0) are positive security-posture confirmations and are retained as reference notes.Changes
docs/security/2026-06-19-full-repo-audit/findings.sarif: cleared all 7 results (S001–S007 all fixed)docs/security/2026-06-19-lsp-vscode-audit/findings.sarif: removed S006 and S007 results (fixed); S001–S005 positive notes retainedTest plan
security-audit-sarif.ymlworkflow runs automatically on merge (triggered bydocs/security/*/findings.sarifpath)fixed🤖 Generated with Claude Code
https://claude.ai/code/session_013QMx3tTsvn9BiCut4crSCN
Generated by Claude Code