chore: bump the signetry-core pin to v0.7.0 - #14
Merged
Conversation
v0.7.0 shipped Kotlin detection, Go SSRF, Go/Java path traversal, PHP XXE, the Aider executor and the SSRF precision fixes. These references still installed v0.6.0, so anything following them got an engine several rules behind. CHANGELOG entries are deliberately left at v0.6.0 — they record what a past release pinned and are not live install instructions.
Contributor
Signetry Reviewer — 🟡 Needs human reviewA human should decide — the required check is unknown. Deterministic gates (the authority)
FindingsNo issues found by the deterministic scanners. MergeA human should review and merge.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Stale
signetry-corepin — these references still installed v0.6.0, so anyone following them got an engine several rules behind.v0.7.0 shipped Kotlin detection (
.ktwasn't scanned at all before), Go SSRF, Go/Java path traversal, PHP XXE, the Aider executor, and the SSRF precision fixes.Why this was missed the first time
When the reviewer fix rolled out, I bumped the
signetry-corepins insideSignetry/plugins— butcodex,cursor,precommitandclaude-codeare separate split-out repos with their own copies, andcoreitself pins its own version in several places. Those didn't get touched.Found by sweeping every repo for live
core@v0.6.0references rather than assuming the earlier rollout had been complete. 9 repos, 23 files.CHANGELOG deliberately untouched
CHANGELOG.mdentries still sayv0.6.0on purpose — they record what a past release pinned. Rewriting them would falsify history, which is the same mistake I made and reverted earlier in this sweep.Verified, not assumed
Every changed non-markdown file was re-parsed after the edit:
bash -non the shell hooks, guards and git hookspython3 -c "import yaml"on the action/pre-commit YAMLtomllibonconfig.tomlast.parseonmcp_server.pyactionlinton the workflowruby -con the Homebrew formula, plus confirming the pinnedrevision:actually resolves to tagv0.7.0(0d39eb34…) rather than trusting the tag string aloneEach repo also re-greps to zero remaining live
core@v0.6.0references.