Mads LorentzenandClaude Fable 5.1 83c788d779 fix(guards): refuse a .npmrc beside a portal manifest, like bunfig.toml ...

Bun reads .npmrc too, so a registry line beside a borrowed portal's
manifest fetches every dependency from a server the portal's author
picked - the same door bunfig.toml opens, which the installer and guard
check 3 already refuse. Both now reject either file. The #718 integration
test, which pointed Bun at its offline registry through a .npmrc, passes
the registry through NPM_CONFIG_REGISTRY instead; it still proves the
hook stays off, because the hooked package only exists on that server.

Follows GHSA-wq7j-x5jq-pjrw; this case is ours, not the report's. Guard
tests for the workspaces and bunfig.toml refusals, which the previous
commit added without them, come along.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

2026-10-27 16:14:35 +01:00

..

check_framework_version.py

fix(framework-version): distinguish marker changes from YAML formatting (#578)

2026-10-18 07:36:13 +02:00

check_upstream_updates.py

chore: point every in-tree reference at ai-job-search-dev/ai-job-search (#776)

2026-10-26 14:19:53 +01:00

convert_salary_excel.py

fix(salary): never take a qualified salary header as the company column (#700)

2026-10-21 07:12:41 +02:00

fetch_page.py

fix(fetch-page): check robots policy before each redirect (#680)

2026-10-21 07:06:40 +02:00

install_portal_clis.py

fix(guards): refuse a .npmrc beside a portal manifest, like bunfig.toml

2026-10-27 16:14:35 +01:00

job_key.py

fix(job-key): report a non-string url in --audit instead of a traceback (#634)

2026-10-19 19:30:01 +02:00

lint_skills.py

fix(lint): report malformed settings shapes without crashing (#146)

2026-07-13 20:45:22 +02:00

page_decode.py

fix(tools): decode saved non-UTF-8 pages by their declared charset (#690)

2026-10-20 08:28:58 +02:00

posting_guard.py

fix(posting_guard): count invisible characters inside hidden HTML and clean the hidden-block excerpts

2026-10-27 16:07:33 +01:00

rank_state.py

fix(rank): reject an unknown veto verdict instead of shortlisting the job (#640)

2026-10-21 07:27:21 +02:00

README_SALARY_TOOL.md

fix(salary): validate category shape and add --validate preflight (#156)

2026-07-15 07:53:01 +02:00

robots_check.py

fix(robots_check): match wildcard rules in linear time and hand curl only http(s) URLs (#779)

2026-10-27 16:11:08 +01:00

scrape_state.py

perf(scrape): filter duplicates before detail fetches and keep history out of context (#710)

2026-10-21 07:29:11 +02:00

security_guards.py

fix(guards): refuse a .npmrc beside a portal manifest, like bunfig.toml

2026-10-27 16:14:35 +01:00

upstream_triage.py

fix(upstream-triage): distinguish subject hints from patch matches (#569)

2026-10-21 07:21:40 +02:00

verify_layout.py

fix(verify-layout): walk PATH candidates for pdftotext supporting -bbox (#655) (#668)

2026-10-19 20:07:50 +02:00

verify_pdf.py

fix(tools): confine verify_pdf --dump-text and drop the bare pdftotext allowance

2026-10-27 16:07:33 +01:00