|
| 1 | +{ |
| 2 | + "schemaVersion": 1, |
| 3 | + "release": "v0.5.4", |
| 4 | + "evidenceType": "historical_real_world_regression_corpus", |
| 5 | + "limitation": "Minimized cases derived from observed project failures and review noise; they prove only that the named historical conditions remain guarded. They are not a representative vulnerability benchmark or a production precision/recall measurement.", |
| 6 | + "sourceInventory": "docs/adoption/regressions.json", |
| 7 | + "summary": { |
| 8 | + "cases": 5, |
| 9 | + "passed": 5, |
| 10 | + "failed": 0, |
| 11 | + "resolvedRegressions": 4, |
| 12 | + "expectedBenignMatches": 1 |
| 13 | + }, |
| 14 | + "cases": [ |
| 15 | + { |
| 16 | + "id": "v3-summary-object-coercion", |
| 17 | + "title": "The main risk summary rendered JavaScript objects", |
| 18 | + "classification": "resolved_regression", |
| 19 | + "source": { |
| 20 | + "kind": "historical_regression", |
| 21 | + "reference": "docs/adoption/regressions.json#v3-summary-object-coercion", |
| 22 | + "fixedVersion": "0.5.2", |
| 23 | + "fixCommit": "a0cb518da23043e549b84f6f4c9cc39726d7c602" |
| 24 | + }, |
| 25 | + "observedFailure": "A v3 report with risk-domain state totals rendered [object Object] in Markdown and HTML.", |
| 26 | + "protectedContract": "Markdown and HTML risk summaries render numeric state and severity totals.", |
| 27 | + "status": "passed", |
| 28 | + "evidence": { |
| 29 | + "findingCount": 1, |
| 30 | + "markdownNumericSummary": true, |
| 31 | + "htmlNumericSummary": true, |
| 32 | + "objectCoercionObserved": false |
| 33 | + }, |
| 34 | + "remainingBoundary": "Golden rendering tests protect the current fixture shapes; they do not prove every future presentation is understandable." |
| 35 | + }, |
| 36 | + { |
| 37 | + "id": "pnpm-workspace-lockfile-evidence", |
| 38 | + "title": "A pnpm workspace could receive a false confirmed lockfile absence", |
| 39 | + "classification": "resolved_regression", |
| 40 | + "source": { |
| 41 | + "kind": "historical_regression", |
| 42 | + "reference": "docs/adoption/regressions.json#pnpm-workspace-lockfile-evidence", |
| 43 | + "fixedVersion": "0.5.2", |
| 44 | + "fixCommit": "a0cb518da23043e549b84f6f4c9cc39726d7c602" |
| 45 | + }, |
| 46 | + "observedFailure": "A root pnpm-lock.yaml and pnpm-workspace.yaml covering apps/* still allowed a child package.json to be reported as confirmed missing-lockfile evidence.", |
| 47 | + "protectedContract": "A covered pnpm package inherits its workspace lockfile; only proven uncovered manifests may be confirmed.", |
| 48 | + "status": "passed", |
| 49 | + "evidence": { |
| 50 | + "coveredPackage": "apps/web/package.json", |
| 51 | + "coveredPackageFindingCount": 0, |
| 52 | + "outsidePackage": "tools/outside/package.json", |
| 53 | + "outsidePackageState": "confirmed" |
| 54 | + }, |
| 55 | + "remainingBoundary": "The parser supports the documented bounded subset and is not a general YAML evaluator." |
| 56 | + }, |
| 57 | + { |
| 58 | + "id": "nested-template-coverage", |
| 59 | + "title": "Nested JS/TS templates could make a whole file partial", |
| 60 | + "classification": "resolved_regression", |
| 61 | + "source": { |
| 62 | + "kind": "historical_regression", |
| 63 | + "reference": "docs/adoption/regressions.json#nested-template-coverage", |
| 64 | + "fixedVersion": "0.5.2", |
| 65 | + "fixCommit": "a0cb518da23043e549b84f6f4c9cc39726d7c602" |
| 66 | + }, |
| 67 | + "observedFailure": "A nested template such as const html = `${`</b>`}</div>` produced unterminated_string_literal and stopped normal source-rule coverage for that file.", |
| 68 | + "protectedContract": "Nested template literals do not silently remove normal JS/TS source-rule coverage.", |
| 69 | + "status": "passed", |
| 70 | + "evidence": { |
| 71 | + "sourcePath": "src/server.ts", |
| 72 | + "browserSinkCoverage": "completed", |
| 73 | + "incompleteEvidenceFindingCount": 0 |
| 74 | + }, |
| 75 | + "remainingBoundary": "The tokenizer is still bounded and reports unsupported syntax as incomplete evidence rather than silently passing it." |
| 76 | + }, |
| 77 | + { |
| 78 | + "id": "path-rename-retest", |
| 79 | + "title": "A path-only rename could make a retest exit successfully", |
| 80 | + "classification": "resolved_regression", |
| 81 | + "source": { |
| 82 | + "kind": "historical_regression", |
| 83 | + "reference": "docs/adoption/regressions.json#path-rename-retest", |
| 84 | + "fixedVersion": "0.5.2", |
| 85 | + "fixCommit": "a0cb518da23043e549b84f6f4c9cc39726d7c602" |
| 86 | + }, |
| 87 | + "observedFailure": "Renaming a file without removing its condition produced one fixed and one new finding, allowing the compatible baseline gate to exit successfully.", |
| 88 | + "protectedContract": "A unique path-equivalent condition remains unresolved instead of becoming fixed plus new.", |
| 89 | + "status": "passed", |
| 90 | + "evidence": { |
| 91 | + "priorPath": "src/old.js", |
| 92 | + "currentPath": "src/renamed.js", |
| 93 | + "baselineState": "unchanged", |
| 94 | + "reasonCode": "condition_moved", |
| 95 | + "fixedCount": 0, |
| 96 | + "newCount": 0 |
| 97 | + }, |
| 98 | + "remainingBoundary": "condition_moved means an equivalent condition exists elsewhere; it does not prove historical identity or that a git move caused it." |
| 99 | + }, |
| 100 | + { |
| 101 | + "id": "numeric-svg-innerhtml-review", |
| 102 | + "title": "Numeric SVG innerHTML remains a review-visible expected match", |
| 103 | + "classification": "expected_benign_match", |
| 104 | + "source": { |
| 105 | + "kind": "external_review_minimized", |
| 106 | + "reference": "KNOWN_LIMITATIONS.md#recurring-expected-matches", |
| 107 | + "note": "Minimized from an external real-project review; original project content is not included." |
| 108 | + }, |
| 109 | + "observedFailure": "A numeric-only SVG string assembled with innerHTML matched the intentionally broad DOM-sink rule.", |
| 110 | + "protectedContract": "Context-dependent DOM sinks stay visible for human closure and are not silently suppressed.", |
| 111 | + "status": "passed", |
| 112 | + "evidence": { |
| 113 | + "sourcePath": "src/charts.ts", |
| 114 | + "ruleId": "browser-html-injection-sink", |
| 115 | + "evidenceState": "suspected", |
| 116 | + "manualClassification": "expected_benign_match", |
| 117 | + "requiredClosure": "Confirm that every interpolated value remains numeric and no untrusted markup reaches the sink.", |
| 118 | + "suppressionApplied": false |
| 119 | + }, |
| 120 | + "remainingBoundary": "This fixture is benign only because its constructed values are numeric. The detector does not trace arbitrary input or prove other innerHTML assignments safe." |
| 121 | + } |
| 122 | + ] |
| 123 | +} |
0 commit comments