Repository navigation
prettier: declare provenance so advisories can be queried at all - #729
Merged
Merged
Conversation
The monitoring-gap alarm fired for six packages after pkgs#721/#723. prettier was one: it shipped with no source_provenance and no CPE, so nothing could reach it and it scanned 0/0/0 — which is indistinguishable from a genuinely clean result. Nothing here is known-vulnerable; the point is that we could not tell either way. GithubRepo rather than a CPE curation, because the evidence points that way. Checked against the prod vulndb: advisory_cpe, product 'prettier' ZERO rows (no CPE exists) advisory_packages, pkg:npm/prettier ZERO rows advisory_packages, pkg:github/... 1 advisory GithubRepo provenance is what resolves to pkg:github/{owner}/{repo} (nickel.rs:183 -> purl.rs:53), which is the identity that actually holds something. Worth recording because it is a trap: `upstream_purl` looks like the obvious lever for an npm package and is not one. It has ZERO consumers in minimal-supply-chain or pkgmgr-rs, so setting it would have looked like a fix while restoring no coverage whatsoever. Safe for version checking, which matters because provenance — unlike a CPE identity entry — does drive the upstream check. prettier's upstream tags are bare semver (3.9.8, 3.9.7, 3.9.6) exactly matching the shape this package already pins, so there is no dev-branch or wrong-series hazard. The sibling half of this fix is in minimal-supply-chain: curated CPE identities for mariadb (1502 advisories, by far the largest gap), xdg-utils (freedesktop + gentoo, unioned) and typescript. tree and which are genuinely unreachable — no CPE, no npm purl, no generic purl, only false friends — and are the only two of the six that belong behind --update-baseline. parse, fmt, imports and standalone-tests pass. The three build-dependent checkers (enumerate-bins, output-types, missing-runtime_deps) SKIP here because the package is not built in this session; this change adds only metadata inside `attrs` and touches no build input, and buildbot runs the full set on the PR. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Contributor
|
Warning Review paused — included plan limit reachedKeep your review moving with free on-demand reviews.
On-demand reviews are free for one more day.
Reviews can continue after your included limit without a manual trigger. An admin must approve usage-based billing. Promotion and pricing detailsOn-demand reviews are free for one more day. After that, they cost $0.25 per reviewed file. Review limit detailsOr wait 54 minutes for your next included review. Limit details: You’ve used the included review currently available. Your 64 included PR review attempts over the past 7 days set your current allowance at 1 review per hour. Review configuration: ⚙️ Run configurationConfiguration used: Repository: gominimal/pkgs/.coderabbit.yaml Review profile: CHILL Plan: Essentials Run ID: 📒 Files selected for processing (1)
Comment |
mitodrummer
approved these changes
Sep 21, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The monitoring-gap alarm fired for six packages after #721/#723 landed. prettier was one: no
source_provenance, no CPE, so nothing could reach it and it scanned 0/0/0 — indistinguishable from genuinely clean. Nothing is known-vulnerable here; the point is we couldn't tell either way.Why GithubRepo and not a CPE curation
Checked against the prod vulndb rather than guessed:
advisory_cpe, productprettieradvisory_packages,pkg:npm/prettieradvisory_packages,pkg:github/prettier/prettierGithubRepoprovenance is what resolves topkg:github/{owner}/{repo}(nickel.rs:183→purl.rs:53), which is the only identity that actually holds anything.A trap worth recording
upstream_purlis not the lever it looks like. For an npm package it's the obvious choice — and it has zero consumers in eitherminimal-supply-chainorpkgmgr-rs. Setting it would have looked like a fix while restoring no coverage whatsoever. I nearly did exactly that.Version-check safety
This matters because provenance — unlike a CPE identity entry — does drive the upstream version check. prettier's upstream tags are bare semver (
3.9.8,3.9.7,3.9.6), exactly the shape this package already pins, so there's no dev-branch or wrong-series hazard.Sibling half
The other half is in minimal-supply-chain (
cpe-identity-agentbox-six): curated CPE identities for mariadb (mariadb:mariadb, 1502 advisories — by far the largest gap), xdg-utils (freedesktop+gentoo, unioned because Gentoo filed its own CVEs for the same scripts) and typescript (microsoft:typescript).tree and which are genuinely unreachable — no CPE, no npm purl, no generic purl, only false friends (
thinkleft:submenu_tree,pixarra:tree_studio,gillesdumas:which_template_file). They're the only two of the six that legitimately belong behind--update-baseline.Checks
parse,fmt,importsandstandalone testspass. The three build-dependent checkers (enumerate bins,output types valid,missing runtime_deps) Skip locally because the package isn't built in that session — this change adds only metadata insideattrsand touches no build input, and buildbot runs the full set here.🤖 Generated with Claude Code