docs: record the round-17 maintenance run - #57
Merged
Merged
Conversation
Adds §22 and refreshes the header. The round's substance, in short: - The three ReDoS alerts round 16 deliberately left unfixed were measured **before** being fixed. Only one is real and reachable: parseTopicList, `![' + ' '.repeat(n) + 'x'`, 14.8 s at n=4000 (k=2.11, synchronous, so it blocks the whole event loop). A second reachable shape was found while writing the tests: `'['.repeat(n) + ' ]x]'`, 697 ms at n=20000 (k=2.00). parseNodeInfo is quadratic only with a `\n`, which its caller strips; parseSafetyEcho is not reproducible at all. So "3 real, low risk" becomes "1 real / 1 unreachable / 1 not reproducible". - Measured, not argued: the two pumps survive `parseLines()`'s trim, which is why they are reachable from the real entry point. Testing the bare regex would have drawn the wrong conclusion for parseNodeInfo. - Dependabot: 4 → 3. #43 (vitest, dev-only) merged. #42/#45/#46 all raise a declared *floor*, and CI installs the devDependency each PR itself bumps — so green proves "works with the new version", never "the new version is the right floor". Both peers are type-only (zero runtime imports). The live harness provides cordis 4.0.2 / dsh-skill 0.1.5-rc.1, so #42 would put the floor above the deployment. Escalated to issue #56 rather than deferred a third time. - Closes round 16's last open observation: gen 24 landed clean (lifecycleState running, deferDeadline 0, pendingResume false). - Corrects round 16's own snapshot table, which said main had 344 tests while its §21.8 said 347. Measured baseline before any of this round's changes is 347 — the table had captured main before #51 merged. - Security: CodeQL 13 → 10 open (exactly the three ReDoS, no new rules); audits clean; publish surface 9/9 clean with 14 seeded .pyc files and a positive control that removes a guard and shows the .pyc does ship.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds §22 to
dsh-ros2-maintain.mdand refreshes the header. Documentation only — no code changes.The round in one paragraph: the three ReDoS alerts round 16 deliberately left unfixed were measured before being fixed, and only one turned out to be real and reachable, so the round's main contribution is a triage corrected by measurement rather than the fix itself.
Highlights, all with the evidence in the section:
parseTopicListfed![' + ' '.repeat(n) + 'x'blocks the event loop for 14.8 s at n=4000 (k=2.11); a second reachable shape'['.repeat(n) + ' ]x]'costs 697 ms at n=20000 (k=2.00).parseNodeInfois superlinear only with a\n, which its caller strips;parseSafetyEchois not reproducible at all. "3 real, low risk" → 1 real / 1 unreachable / 1 not reproducible.parseLines()'s trim, which is what makes them reachable — and testing the bare regex would have drawn the wrong conclusion forparseNodeInfo..pycplus a positive control that removes a guard and shows the.pycdoes ship.