Repository navigation
docs: eighty-third public scan (whiteguo233/OpenBiliClaw) + jcodemunch resolution - #113
Merged
Merged
Conversation
…nding, filed publicly Also records the jcodemunch-mcp resolution: issue #447 closed as completed and PR #519 merged, shipped in v1.108.288 with explicit credit, after the CLA window expired and PR #443 closed unmerged. Sixteenth resolution. Counters on the index and work-with-me page had drifted (79/15 and 71/13); both now reflect the real totals of 83 scans and 16 confirmed fixes. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
elfrost
added a commit
that referenced
this pull request
Oct 23, 2026
docs: scan #113 — huggingface/tau; optillm #323 resolved (27th fix)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Eighty-third public scan: whiteguo233/OpenBiliClaw (2.9k★, MIT) — 373 findings, 1 real.
The finding is that Trivy and pip-audit disagreed: Trivy read
uv.lock(63 advisories, 36 HIGH), pip-audit resolvedpyproject.toml(zero). Both correct — the project ships both as install paths, and the README's one-line installer runsuv sync(the stale pins) while the Docker path regenerates requirements from the pyproject floors (current releases). The reachable pin is Pillow 12.1.1, which decodes attacker-chosen cover images from user-upload CDNs on a background timer. Filed as a public courtesy issue; no PR, because an untested 63-package lockfile regen is worse than an issue that names the file.Also publishes a negative in full:
is_extension_originmatches anychrome-extension://origin and the project's own design doc lists that as a Non-Goal — but it dies four lines later, because a loopback caller sending no Origin is already trusted-local.Also records the sixteenth resolution. jgravelle/jcodemunch-mcp #447 closed as completed, PR #519 merged, shipped in v1.108.288 with explicit credit in the CHANGELOG and release notes. The CLA window expired and PR #443 closed unmerged, so what shipped is the maintainer's own diff — stated plainly by them rather than passed off as a merge. Post and index updated accordingly.
Counters on both the index and the work-with-me page had drifted (79 scans/15 fixes and 71 scans/13 fixes); both now read 83 and 16.
🤖 Generated with Claude Code