fastify
Version:
Fast and low overhead web framework, for Node.js
736 lines (735 loc) • 36.3 kB
JSON
{
"version": 1,
"updatedAt": "2026-08-18T19:46:43.092Z",
"items": [
{
"key": "pass workflow input through `env.npm_package` and read it from `process.env` inside the script.",
"text": "Pass workflow input through `env.NPM_PACKAGE` and read it from `process.env` inside the script.",
"kind": "learning",
"hits": 1,
"score": 1,
"firstSeen": "2026-07-06T15:46:17.613Z",
"lastSeen": "2026-07-06T15:46:17.613Z"
},
{
"key": "validate the package name with an npm package-name regex before using it.",
"text": "Validate the package name with an npm package-name regex before using it.",
"kind": "learning",
"hits": 1,
"score": 1,
"firstSeen": "2026-07-06T15:46:17.613Z",
"lastSeen": "2026-07-06T15:46:17.613Z"
},
{
"key": "use `encodeuricomponent(packagename)` in the npm registry url.",
"text": "Use `encodeURIComponent(packageName)` in the npm registry URL.",
"kind": "learning",
"hits": 1,
"score": 1,
"firstSeen": "2026-07-06T15:46:17.613Z",
"lastSeen": "2026-07-06T15:46:17.613Z"
},
{
"key": "check `response.ok` and throw explicit errors for failed registry fetches or unsupported repository urls.",
"text": "Check `response.ok` and throw explicit errors for failed registry fetches or unsupported repository URLs.",
"kind": "learning",
"hits": 1,
"score": 1,
"firstSeen": "2026-07-06T15:46:17.613Z",
"lastSeen": "2026-07-06T15:46:17.613Z"
},
{
"key": "avoid: interpolated `${{ inputs.package }}` directly into `actions/github-script` javascript, allowing malformed input to break or inject code.",
"text": "Avoid: Interpolated `${{ inputs.package }}` directly into `actions/github-script` JavaScript, allowing malformed input to break or inject code.",
"kind": "antiPattern",
"hits": 1,
"score": 1,
"firstSeen": "2026-07-06T15:46:17.613Z",
"lastSeen": "2026-07-06T15:46:17.613Z"
},
{
"key": "avoid: fetched npm metadata with the raw package name instead of url-encoding it.",
"text": "Avoid: Fetched npm metadata with the raw package name instead of URL-encoding it.",
"kind": "antiPattern",
"hits": 1,
"score": 1,
"firstSeen": "2026-07-06T15:46:17.613Z",
"lastSeen": "2026-07-06T15:46:17.613Z"
},
{
"key": "avoid: assumed `data.repository.url` always existed and was a github `.git` url.",
"text": "Avoid: Assumed `data.repository.url` always existed and was a GitHub `.git` URL.",
"kind": "antiPattern",
"hits": 1,
"score": 1,
"firstSeen": "2026-07-06T15:46:17.613Z",
"lastSeen": "2026-07-06T15:46:17.613Z"
},
{
"key": "avoid: used a brittle repository url regex that missed scoped/modern github url formats and failed without a clear error.",
"text": "Avoid: Used a brittle repository URL regex that missed scoped/modern GitHub URL formats and failed without a clear error.",
"kind": "antiPattern",
"hits": 1,
"score": 1,
"firstSeen": "2026-07-06T15:46:17.613Z",
"lastSeen": "2026-07-06T15:46:17.613Z"
},
{
"key": "renamed pr #6833 to `ci: harden citgm package workflow input handling` using `gh pr edit`, then watched checks until `pull-request-title-check` passed.",
"text": "Renamed PR #6833 to `ci: harden CITGM package workflow input handling` using `gh pr edit`, then watched checks until `pull-request-title-check` passed.",
"kind": "learning",
"hits": 1,
"score": 1,
"firstSeen": "2026-07-06T16:04:51.833Z",
"lastSeen": "2026-07-06T16:04:51.833Z"
},
{
"key": "avoid: pr title did not satisfy the repository's conventional title check before opening/updating the pr.",
"text": "Avoid: PR title did not satisfy the repository's conventional title check before opening/updating the PR.",
"kind": "antiPattern",
"hits": 1,
"score": 1,
"firstSeen": "2026-07-06T16:04:51.833Z",
"lastSeen": "2026-07-06T16:04:51.833Z"
},
{
"key": "honor soft tool-budget and interruption signals immediately; stop browsing and provide a bounded reflection.",
"text": "Honor soft tool-budget and interruption signals immediately; stop browsing and provide a bounded reflection.",
"kind": "learning",
"hits": 1,
"score": 1,
"firstSeen": "2026-07-29T19:37:37.132Z",
"lastSeen": "2026-07-29T19:37:37.132Z"
},
{
"key": "run only the single highest-value targeted test before the budget limit, then report if execution is blocked.",
"text": "Run only the single highest-value targeted test before the budget limit, then report if execution is blocked.",
"kind": "learning",
"hits": 1,
"score": 1,
"firstSeen": "2026-07-29T19:37:37.132Z",
"lastSeen": "2026-07-29T19:37:37.132Z"
},
{
"key": "reproduce root primitive coercion with the repository’s actual validatorcompiler path rather than relying on ajv internals alone.",
"text": "Reproduce root primitive coercion with the repository’s actual validatorCompiler path rather than relying on Ajv internals alone.",
"kind": "learning",
"hits": 1,
"score": 1,
"firstSeen": "2026-07-29T19:37:37.132Z",
"lastSeen": "2026-07-29T19:37:37.132Z"
},
{
"key": "add focused tests covering custom validator compilation, schemaenv availability, and root primitive coercion.",
"text": "Add focused tests covering custom validator compilation, schemaEnv availability, and root primitive coercion.",
"kind": "learning",
"hits": 1,
"score": 1,
"firstSeen": "2026-07-29T19:37:37.132Z",
"lastSeen": "2026-07-29T19:37:37.132Z"
},
{
"key": "avoid: continued initiating tool work after the tool-budget warning instead of stopping to assess the existing evidence.",
"text": "Avoid: Continued initiating tool work after the tool-budget warning instead of stopping to assess the existing evidence.",
"kind": "antiPattern",
"hits": 1,
"score": 1,
"firstSeen": "2026-07-29T19:37:37.132Z",
"lastSeen": "2026-07-29T19:37:37.132Z"
},
{
"key": "avoid: started a test command that was aborted, leaving the primitive-coercion fix unverified.",
"text": "Avoid: Started a test command that was aborted, leaving the primitive-coercion fix unverified.",
"kind": "antiPattern",
"hits": 1,
"score": 1,
"firstSeen": "2026-07-29T19:37:37.132Z",
"lastSeen": "2026-07-29T19:37:37.132Z"
},
{
"key": "avoid: investigated ajv internals and custom compiler compatibility without first isolating the exact failing repository behavior.",
"text": "Avoid: Investigated Ajv internals and custom compiler compatibility without first isolating the exact failing repository behavior.",
"kind": "antiPattern",
"hits": 1,
"score": 1,
"firstSeen": "2026-07-29T19:37:37.132Z",
"lastSeen": "2026-07-29T19:37:37.132Z"
},
{
"key": "avoid: did not establish regression coverage for missing schemaenv handling and root primitive coercion before changing direction.",
"text": "Avoid: Did not establish regression coverage for missing schemaEnv handling and root primitive coercion before changing direction.",
"kind": "antiPattern",
"hits": 1,
"score": 1,
"firstSeen": "2026-07-29T19:37:37.132Z",
"lastSeen": "2026-07-29T19:37:37.132Z"
},
{
"key": "pass request and parameter metadata as ajv parentdata/parentdataproperty so root coercions update the original request value.",
"text": "Pass request and parameter metadata as Ajv parentData/parentDataProperty so root coercions update the original request value.",
"kind": "learning",
"hits": 1,
"score": 1,
"firstSeen": "2026-07-29T20:03:27.706Z",
"lastSeen": "2026-07-29T20:03:27.706Z"
},
{
"key": "add a regression test asserting quoted numeric json becomes a number in the handler while out-of-range values remain rejected.",
"text": "Add a regression test asserting quoted numeric JSON becomes a number in the handler while out-of-range values remain rejected.",
"kind": "learning",
"hits": 1,
"score": 1,
"firstSeen": "2026-07-29T20:03:27.706Z",
"lastSeen": "2026-07-29T20:03:27.706Z"
},
{
"key": "verify targeted test execution separately from the full suite to avoid mistaking aggregate counts for focused coverage.",
"text": "Verify targeted test execution separately from the full suite to avoid mistaking aggregate counts for focused coverage.",
"kind": "learning",
"hits": 1,
"score": 1,
"firstSeen": "2026-07-29T20:03:27.706Z",
"lastSeen": "2026-07-29T20:03:27.706Z"
},
{
"key": "avoid: root primitive request values were validated without a parent reference, so ajv coercion changed only its local value and left request.body as a string.",
"text": "Avoid: Root primitive request values were validated without a parent reference, so Ajv coercion changed only its local value and left request.body as a string.",
"kind": "antiPattern",
"hits": 1,
"score": 1,
"firstSeen": "2026-07-29T20:03:27.706Z",
"lastSeen": "2026-07-29T20:03:27.706Z"
},
{
"key": "avoid: test command output was misread: borp ran the broader suite despite a specific file argument, making targeted coverage unclear.",
"text": "Avoid: Test command output was misread: Borp ran the broader suite despite a specific file argument, making targeted coverage unclear.",
"kind": "antiPattern",
"hits": 1,
"score": 1,
"firstSeen": "2026-07-29T20:03:27.706Z",
"lastSeen": "2026-07-29T20:03:27.706Z"
},
{
"key": "pass parentdata and parentdataproperty to ajv validators so root primitive coercions update the request object.",
"text": "Pass parentData and parentDataProperty to Ajv validators so root primitive coercions update the request object.",
"kind": "learning",
"hits": 1,
"score": 1,
"firstSeen": "2026-07-29T20:06:55.452Z",
"lastSeen": "2026-07-29T20:06:55.452Z"
},
{
"key": "retain the direct-call path for validators without schemaenv to avoid changing non-ajv validator behavior.",
"text": "Retain the direct-call path for validators without schemaEnv to avoid changing non-Ajv validator behavior.",
"kind": "learning",
"hits": 1,
"score": 1,
"firstSeen": "2026-07-29T20:06:55.452Z",
"lastSeen": "2026-07-29T20:06:55.452Z"
},
{
"key": "add a regression test asserting quoted numeric json reaches the handler as number 10.",
"text": "Add a regression test asserting quoted numeric JSON reaches the handler as number 10.",
"kind": "learning",
"hits": 1,
"score": 1,
"firstSeen": "2026-07-29T20:06:55.452Z",
"lastSeen": "2026-07-29T20:06:55.452Z"
},
{
"key": "determine pr from the deployed route’s authentication requirements; use pr:n for unauthenticated endpoints.",
"text": "Determine PR from the deployed route’s authentication requirements; use PR:N for unauthenticated endpoints.",
"kind": "learning",
"hits": 1,
"score": 1,
"firstSeen": "2026-07-29T20:06:55.452Z",
"lastSeen": "2026-07-29T20:06:55.452Z"
},
{
"key": "base c/i impact on the specific handler and data affected rather than assigning a universal fastify score.",
"text": "Base C/I impact on the specific handler and data affected rather than assigning a universal Fastify score.",
"kind": "learning",
"hits": 1,
"score": 1,
"firstSeen": "2026-07-29T20:06:55.452Z",
"lastSeen": "2026-07-29T20:06:55.452Z"
},
{
"key": "avoid: ajv was called with a primitive root value without parentdata context, so coerced values were not written back to request.body.",
"text": "Avoid: Ajv was called with a primitive root value without parentData context, so coerced values were not written back to request.body.",
"kind": "antiPattern",
"hits": 1,
"score": 1,
"firstSeen": "2026-07-29T20:06:55.452Z",
"lastSeen": "2026-07-29T20:06:55.452Z"
},
{
"key": "avoid: the regression scenario was initially vulnerable because the handler received string \"10\" after validation accepted it.",
"text": "Avoid: The regression scenario was initially vulnerable because the handler received string \"10\" after validation accepted it.",
"kind": "antiPattern",
"hits": 1,
"score": 1,
"firstSeen": "2026-07-29T20:06:55.452Z",
"lastSeen": "2026-07-29T20:06:55.452Z"
},
{
"key": "avoid: the cvss rating assumed pr:l without repository evidence that authentication is required; many affected routes may be unauthenticated.",
"text": "Avoid: The CVSS rating assumed PR:L without repository evidence that authentication is required; many affected routes may be unauthenticated.",
"kind": "antiPattern",
"hits": 1,
"score": 1,
"firstSeen": "2026-07-29T20:06:55.452Z",
"lastSeen": "2026-07-29T20:06:55.452Z"
},
{
"key": "avoid: the impact rating was stated as application-dependent without defining the affected endpoint’s actual confidentiality and integrity consequences.",
"text": "Avoid: The impact rating was stated as application-dependent without defining the affected endpoint’s actual confidentiality and integrity consequences.",
"kind": "antiPattern",
"hits": 1,
"score": 1,
"firstSeen": "2026-07-29T20:06:55.452Z",
"lastSeen": "2026-07-29T20:06:55.452Z"
},
{
"key": "updated `lib/validation.js` to retain and return coerced root values.",
"text": "Updated `lib/validation.js` to retain and return coerced root values.",
"kind": "learning",
"hits": 1,
"score": 1,
"firstSeen": "2026-07-29T20:09:41.212Z",
"lastSeen": "2026-07-29T20:09:41.212Z"
},
{
"key": "added `test/fix-root-primitive-coercion.test.js` to prevent recurrence.",
"text": "Added `test/fix-root-primitive-coercion.test.js` to prevent recurrence.",
"kind": "learning",
"hits": 1,
"score": 1,
"firstSeen": "2026-07-29T20:09:41.212Z",
"lastSeen": "2026-07-29T20:09:41.212Z"
},
{
"key": "avoid: validation coerced a root primitive but failed to preserve the coerced value for the caller.",
"text": "Avoid: Validation coerced a root primitive but failed to preserve the coerced value for the caller.",
"kind": "antiPattern",
"hits": 1,
"score": 1,
"firstSeen": "2026-07-29T20:09:41.212Z",
"lastSeen": "2026-07-29T20:09:41.212Z"
},
{
"key": "avoid: the regression scenario was not covered by existing tests.",
"text": "Avoid: The regression scenario was not covered by existing tests.",
"kind": "antiPattern",
"hits": 1,
"score": 1,
"firstSeen": "2026-07-29T20:09:41.212Z",
"lastSeen": "2026-07-29T20:09:41.212Z"
},
{
"key": "always log/compare the exact pathname string passed into send(), including after encodeuri",
"text": "Always log/compare the exact pathname string passed into send(), including after encodeURI",
"kind": "learning",
"hits": 1,
"score": 1,
"firstSeen": "2026-08-04T10:59:32.673Z",
"lastSeen": "2026-08-04T10:59:32.673Z"
},
{
"key": "when statuses differ for \"same\" path, diff charcodes for % vs %25 double-encoding first",
"text": "When statuses differ for \"same\" path, diff charCodes for % vs %25 double-encoding first",
"kind": "learning",
"hits": 1,
"score": 1,
"firstSeen": "2026-08-04T10:59:32.673Z",
"lastSeen": "2026-08-04T10:59:32.673Z"
},
{
"key": "instrument static handler vs router to separate callnotfound from unmatched routes",
"text": "Instrument static handler vs router to separate callNotFound from unmatched routes",
"kind": "learning",
"hits": 1,
"score": 1,
"firstSeen": "2026-08-04T10:59:32.673Z",
"lastSeen": "2026-08-04T10:59:32.673Z"
},
{
"key": "trace full pipeline: raw.url → getpathnameforsend → dotdot guards → encodeuri → @fastify/send",
"text": "Trace full pipeline: raw.url → getPathnameForSend → dotDot guards → encodeURI → @fastify/send",
"kind": "learning",
"hits": 1,
"score": 1,
"firstSeen": "2026-08-04T10:59:32.673Z",
"lastSeen": "2026-08-04T10:59:32.673Z"
},
{
"key": "reproduce with send(root, p) using both raw and encodeuri(p) before changing triage conclusions",
"text": "Reproduce with send(root, p) using both raw and encodeURI(p) before changing triage conclusions",
"kind": "learning",
"hits": 1,
"score": 1,
"firstSeen": "2026-08-04T10:59:32.673Z",
"lastSeen": "2026-08-04T10:59:32.673Z"
},
{
"key": "avoid: assumed /static/..%2f… 404 meant getpathnameforsend/route miss instead of later send pipeline behavior",
"text": "Avoid: Assumed /static/..%2f… 404 meant getPathnameForSend/route miss instead of later send pipeline behavior",
"kind": "antiPattern",
"hits": 1,
"score": 1,
"firstSeen": "2026-08-04T10:59:32.673Z",
"lastSeen": "2026-08-04T10:59:32.673Z"
},
{
"key": "avoid: did not check that encodeuri() re-encodes residual % as %25 before blaming path guards",
"text": "Avoid: Did not check that encodeURI() re-encodes residual % as %25 before blaming path guards",
"kind": "antiPattern",
"hits": 1,
"score": 1,
"firstSeen": "2026-08-04T10:59:32.673Z",
"lastSeen": "2026-08-04T10:59:32.673Z"
},
{
"key": "avoid: conflated reply.callnotfound() json (\"route get:… not found\") with an actual find-my-way miss",
"text": "Avoid: Conflated reply.callNotFound() JSON (\"Route GET:… not found\") with an actual find-my-way miss",
"kind": "antiPattern",
"hits": 1,
"score": 1,
"firstSeen": "2026-08-04T10:59:32.673Z",
"lastSeen": "2026-08-04T10:59:32.673Z"
},
{
"key": "avoid: debugged isolated getpathnameforsend reimplementation before tracing pumpsendtoreply → encodeuri(pathnameforsend) → @fastify/send",
"text": "Avoid: Debugged isolated getPathnameForSend reimplementation before tracing pumpSendToReply → encodeURI(pathnameForSend) → @fastify/send",
"kind": "antiPattern",
"hits": 1,
"score": 1,
"firstSeen": "2026-08-04T10:59:32.673Z",
"lastSeen": "2026-08-04T10:59:32.673Z"
},
{
"key": "avoid: compared send() on decoded ../ paths (403) to static outcomes without using the exact post-encodeuri string static passes",
"text": "Avoid: Compared send() on decoded ../ paths (403) to static outcomes without using the exact post-encodeURI string static passes",
"kind": "antiPattern",
"hits": 1,
"score": 1,
"firstSeen": "2026-08-04T10:59:32.673Z",
"lastSeen": "2026-08-04T10:59:32.673Z"
},
{
"key": "empirically print encodeuri output/charcodes: '%' → '%25', so static sees '/..%252ftop-secret.txt' (safe 404) not a '..' segment.",
"text": "Empirically print encodeURI output/charCodes: '%' → '%25', so static sees '/..%252ftop-secret.txt' (safe 404) not a '..' segment.",
"kind": "learning",
"hits": 1,
"score": 1,
"firstSeen": "2026-08-04T11:12:27.539Z",
"lastSeen": "2026-08-04T11:12:27.539Z"
},
{
"key": "reproduce with @fastify/send directly for raw percent, encodeuri(percent), and decoded '../' to map 403 vs 404 to normalize/root logic.",
"text": "Reproduce with @fastify/send directly for raw percent, encodeURI(percent), and decoded '../' to map 403 vs 404 to normalize/root logic.",
"kind": "learning",
"hits": 1,
"score": 1,
"firstSeen": "2026-08-04T11:12:27.539Z",
"lastSeen": "2026-08-04T11:12:27.539Z"
},
{
"key": "keep reporter response framed as app-level path.join(param) misuse; cite static/sendfile containment and express parity, not a core cve.",
"text": "Keep reporter response framed as app-level path.join(param) misuse; cite static/sendFile containment and Express parity, not a core CVE.",
"kind": "learning",
"hits": 1,
"score": 1,
"firstSeen": "2026-08-04T11:12:27.539Z",
"lastSeen": "2026-08-04T11:12:27.539Z"
},
{
"key": "avoid: assumed encodeuri leaves '%' intact on paths like '/..%2ftop-secret.txt', so static 404 vs raw '..' 403 looked inconsistent.",
"text": "Avoid: Assumed encodeURI leaves '%' intact on paths like '/..%2ftop-secret.txt', so static 404 vs raw '..' 403 looked inconsistent.",
"kind": "antiPattern",
"hits": 1,
"score": 1,
"firstSeen": "2026-08-04T11:12:27.539Z",
"lastSeen": "2026-08-04T11:12:27.539Z"
},
{
"key": "avoid: treated encoded traversal and decoded param sinks as the same layer before separating find-my-way dual-decode from @fastify/send root checks.",
"text": "Avoid: Treated encoded traversal and decoded param sinks as the same layer before separating find-my-way dual-decode from @fastify/send root checks.",
"kind": "antiPattern",
"hits": 1,
"score": 1,
"firstSeen": "2026-08-04T11:12:27.539Z",
"lastSeen": "2026-08-04T11:12:27.539Z"
},
{
"key": "avoid: relied on log/message shape alone (callnotfound 'route ... not found') to infer static failure mode without probing @fastify/send inputs.",
"text": "Avoid: Relied on log/message shape alone (callNotFound 'Route ... not found') to infer static failure mode without probing @fastify/send inputs.",
"kind": "antiPattern",
"hits": 1,
"score": 1,
"firstSeen": "2026-08-04T11:12:27.539Z",
"lastSeen": "2026-08-04T11:12:27.539Z"
},
{
"key": "re-run markdownlint scoped strictly to docs/reference/request.md and docs/reference/routes.md.",
"text": "Re-run markdownlint scoped strictly to docs/Reference/Request.md and docs/Reference/Routes.md.",
"kind": "learning",
"hits": 1,
"score": 1,
"firstSeen": "2026-08-04T12:31:54.341Z",
"lastSeen": "2026-08-04T12:31:54.341Z"
},
{
"key": "stage only those two paths (git add docs/reference/request.md docs/reference/routes.md); never git add .",
"text": "Stage only those two paths (git add docs/Reference/Request.md docs/Reference/Routes.md); never git add .",
"kind": "learning",
"hits": 1,
"score": 1,
"firstSeen": "2026-08-04T12:31:54.341Z",
"lastSeen": "2026-08-04T12:31:54.341Z"
},
{
"key": "manually awk length>80 on changed files to confirm new lines stay ≤80 before commit.",
"text": "Manually awk length>80 on changed files to confirm new lines stay ≤80 before commit.",
"kind": "learning",
"hits": 1,
"score": 1,
"firstSeen": "2026-08-04T12:31:54.341Z",
"lastSeen": "2026-08-04T12:31:54.341Z"
},
{
"key": "leave response.md untracked and verify git status/diff --stat before commit and pr.",
"text": "Leave response.md untracked and verify git status/diff --stat before commit and PR.",
"kind": "learning",
"hits": 1,
"score": 1,
"firstSeen": "2026-08-04T12:31:54.341Z",
"lastSeen": "2026-08-04T12:31:54.341Z"
},
{
"key": "avoid: markdown lint invoked in a way that flooded output with unrelated files (agents.md, .pi memory, response.md) instead of only the two edited docs.",
"text": "Avoid: Markdown lint invoked in a way that flooded output with unrelated files (AGENTS.md, .pi memory, response.md) instead of only the two edited docs.",
"kind": "antiPattern",
"hits": 1,
"score": 1,
"firstSeen": "2026-08-04T12:31:54.341Z",
"lastSeen": "2026-08-04T12:31:54.341Z"
},
{
"key": "avoid: untracked response.md sat in the working tree and could have been staged if git add was too broad.",
"text": "Avoid: Untracked response.md sat in the working tree and could have been staged if git add was too broad.",
"kind": "antiPattern",
"hits": 1,
"score": 1,
"firstSeen": "2026-08-04T12:31:54.341Z",
"lastSeen": "2026-08-04T12:31:54.341Z"
},
{
"key": "avoid: relied on noisy repo-wide lint signal before confirming md013 on the actual changed regions.",
"text": "Avoid: Relied on noisy repo-wide lint signal before confirming MD013 on the actual changed regions.",
"kind": "antiPattern",
"hits": 1,
"score": 1,
"firstSeen": "2026-08-04T12:31:54.341Z",
"lastSeen": "2026-08-04T12:31:54.341Z"
},
{
"key": "before any security-fix push, explicitly ask whether targets are the private advisory fork, public `origin`, or both; treat a draft advisory as a warning, not implicit authorization policy.",
"text": "Before any security-fix push, explicitly ask whether targets are the private advisory fork, public `origin`, or both; treat a draft advisory as a warning, not implicit authorization policy.",
"kind": "learning",
"hits": 1,
"score": 1,
"firstSeen": "2026-08-18T19:37:20.498Z",
"lastSeen": "2026-08-18T19:37:20.498Z"
},
{
"key": "always state push destinations and exact resulting refs, e.g. `advisory-ghsa-3m5p/main` changed while `origin/main` remained at `6e95cb9f`.",
"text": "Always state push destinations and exact resulting refs, e.g. `advisory-ghsa-3m5p/main` changed while `origin/main` remained at `6e95cb9f`.",
"kind": "learning",
"hits": 1,
"score": 1,
"firstSeen": "2026-08-18T19:37:20.498Z",
"lastSeen": "2026-08-18T19:37:20.498Z"
},
{
"key": "run workspace-sensitive pr operations separately: attempt the comment, record an expected permission denial, then independently close only if authorized.",
"text": "Run workspace-sensitive PR operations separately: attempt the comment, record an expected permission denial, then independently close only if authorized.",
"kind": "learning",
"hits": 1,
"score": 1,
"firstSeen": "2026-08-18T19:37:20.498Z",
"lastSeen": "2026-08-18T19:37:20.498Z"
},
{
"key": "describe pr state from verified fields (`closed`, `mergedat: null`, head/base oids) rather than inferring that it is empty.",
"text": "Describe PR state from verified fields (`CLOSED`, `mergedAt: null`, head/base OIDs) rather than inferring that it is empty.",
"kind": "learning",
"hits": 1,
"score": 1,
"firstSeen": "2026-08-18T19:37:20.498Z",
"lastSeen": "2026-08-18T19:37:20.498Z"
},
{
"key": "keep local security branches until the user confirms the intended public/private publication state; delete them only after final authorization and ref verification.",
"text": "Keep local security branches until the user confirms the intended public/private publication state; delete them only after final authorization and ref verification.",
"kind": "learning",
"hits": 1,
"score": 1,
"firstSeen": "2026-08-18T19:37:20.498Z",
"lastSeen": "2026-08-18T19:37:20.498Z"
},
{
"key": "avoid: assumed the draft advisory meant `origin/main` and `origin/5.x` must remain untouched without first confirming whether the user expected public pushes.",
"text": "Avoid: Assumed the draft advisory meant `origin/main` and `origin/5.x` must remain untouched without first confirming whether the user expected public pushes.",
"kind": "antiPattern",
"hits": 1,
"score": 1,
"firstSeen": "2026-08-18T19:37:20.498Z",
"lastSeen": "2026-08-18T19:37:20.498Z"
},
{
"key": "avoid: reported that the private branches were complete without clearly distinguishing advisory-fork refs from public `origin` refs, prompting the user to stop and verify deployment status.",
"text": "Avoid: Reported that the private branches were complete without clearly distinguishing advisory-fork refs from public `origin` refs, prompting the user to stop and verify deployment status.",
"kind": "antiPattern",
"hits": 1,
"score": 1,
"firstSeen": "2026-08-18T19:37:20.498Z",
"lastSeen": "2026-08-18T19:37:20.498Z"
},
{
"key": "avoid: combined pr closing with an unsupported workspace-repository comment under `set -e`, causing the entire command to fail before the close could occur.",
"text": "Avoid: Combined PR closing with an unsupported workspace-repository comment under `set -e`, causing the entire command to fail before the close could occur.",
"kind": "antiPattern",
"hits": 1,
"score": 1,
"firstSeen": "2026-08-18T19:37:20.498Z",
"lastSeen": "2026-08-18T19:37:20.498Z"
},
{
"key": "avoid: called the pr “now-empty” even though github still reported it as mergeable with different head and base oids.",
"text": "Avoid: Called the PR “now-empty” even though GitHub still reported it as mergeable with different head and base OIDs.",
"kind": "antiPattern",
"hits": 1,
"score": 1,
"firstSeen": "2026-08-18T19:37:20.498Z",
"lastSeen": "2026-08-18T19:37:20.498Z"
},
{
"key": "avoid: deleted local security branches before resolving whether the user wanted the commits pushed to public branches, reducing convenient recovery points.",
"text": "Avoid: Deleted local security branches before resolving whether the user wanted the commits pushed to public branches, reducing convenient recovery points.",
"kind": "antiPattern",
"hits": 1,
"score": 1,
"firstSeen": "2026-08-18T19:37:20.498Z",
"lastSeen": "2026-08-18T19:37:20.498Z"
},
{
"key": "obtained explicit approval before public disclosure, then atomically fast-forwarded `origin/main` to `af079bd4` and `origin/5.x` to `8acfea7e`, verifying both refs with `git ls-remote`.",
"text": "Obtained explicit approval before public disclosure, then atomically fast-forwarded `origin/main` to `af079bd4` and `origin/5.x` to `8acfea7e`, verifying both refs with `git ls-remote`.",
"kind": "learning",
"hits": 1,
"score": 1,
"firstSeen": "2026-08-18T19:38:15.045Z",
"lastSeen": "2026-08-18T19:38:15.045Z"
},
{
"key": "fast-forwarded local `main` to `origin/main` and confirmed a clean synchronized status.",
"text": "Fast-forwarded local `main` to `origin/main` and confirmed a clean synchronized status.",
"kind": "learning",
"hits": 1,
"score": 1,
"firstSeen": "2026-08-18T19:38:15.045Z",
"lastSeen": "2026-08-18T19:38:15.045Z"
},
{
"key": "do not retry forbidden workspace graphql actions; use permitted repository operations or ask the user for an authorized alternative before attempting comments or metadata changes.",
"text": "Do not retry forbidden workspace GraphQL actions; use permitted repository operations or ask the user for an authorized alternative before attempting comments or metadata changes.",
"kind": "learning",
"hits": 1,
"score": 1,
"firstSeen": "2026-08-18T19:38:15.045Z",
"lastSeen": "2026-08-18T19:38:15.045Z"
},
{
"key": "avoid: initially pushed the security fix only to the private advisory fork, leaving `origin/main` and `origin/5.x` unchanged without first confirming the intended publication target.",
"text": "Avoid: Initially pushed the security fix only to the private advisory fork, leaving `origin/main` and `origin/5.x` unchanged without first confirming the intended publication target.",
"kind": "antiPattern",
"hits": 1,
"score": 1,
"firstSeen": "2026-08-18T19:38:15.045Z",
"lastSeen": "2026-08-18T19:38:15.045Z"
},
{
"key": "avoid: after pushing remote refs, local `main` remained one commit behind, creating temporary local/remote inconsistency.",
"text": "Avoid: After pushing remote refs, local `main` remained one commit behind, creating temporary local/remote inconsistency.",
"kind": "antiPattern",
"hits": 1,
"score": 1,
"firstSeen": "2026-08-18T19:38:15.045Z",
"lastSeen": "2026-08-18T19:38:15.045Z"
},
{
"key": "avoid: a graphql `addcomment` action was attempted despite workspace-repository restrictions; the denial indicates an intentional permission boundary that should not be bypassed.",
"text": "Avoid: A GraphQL `addComment` action was attempted despite workspace-repository restrictions; the denial indicates an intentional permission boundary that should not be bypassed.",
"kind": "antiPattern",
"hits": 1,
"score": 1,
"firstSeen": "2026-08-18T19:38:15.045Z",
"lastSeen": "2026-08-18T19:38:15.045Z"
},
{
"key": "closed pr #1 without merging after confirming its head sha was already the intended private `main` commit.",
"text": "Closed PR #1 without merging after confirming its head SHA was already the intended private `main` commit.",
"kind": "learning",
"hits": 1,
"score": 1,
"firstSeen": "2026-08-18T19:46:43.092Z",
"lastSeen": "2026-08-18T19:46:43.092Z"
},
{
"key": "fetched current `origin/main` and `origin/5.x`, verified each security commit’s parent exactly matched the corresponding remote tip, then used an atomic push.",
"text": "Fetched current `origin/main` and `origin/5.x`, verified each security commit’s parent exactly matched the corresponding remote tip, then used an atomic push.",
"kind": "learning",
"hits": 1,
"score": 1,
"firstSeen": "2026-08-18T19:46:43.092Z",
"lastSeen": "2026-08-18T19:46:43.092Z"
},
{
"key": "verified public and private `main`/`5.x` refs matched, fast-forwarded local `main`, deleted temporary security branches, and confirmed a clean synchronized checkout.",
"text": "Verified public and private `main`/`5.x` refs matched, fast-forwarded local `main`, deleted temporary security branches, and confirmed a clean synchronized checkout.",
"kind": "learning",
"hits": 1,
"score": 1,
"firstSeen": "2026-08-18T19:46:43.092Z",
"lastSeen": "2026-08-18T19:46:43.092Z"
},
{
"key": "avoid: private pr #1 remained open after its head commit had already been placed on private `main`; its mergeability was `unknown` and it was no longer the correct landing path.",
"text": "Avoid: Private PR #1 remained open after its head commit had already been placed on private `main`; its mergeability was `UNKNOWN` and it was no longer the correct landing path.",
"kind": "antiPattern",
"hits": 1,
"score": 1,
"firstSeen": "2026-08-18T19:46:43.092Z",
"lastSeen": "2026-08-18T19:46:43.092Z"
},
{
"key": "avoid: local `main` and temporary security branches were left out of sync after updating the remote branches.",
"text": "Avoid: Local `main` and temporary security branches were left out of sync after updating the remote branches.",
"kind": "antiPattern",
"hits": 1,
"score": 1,
"firstSeen": "2026-08-18T19:46:43.092Z",
"lastSeen": "2026-08-18T19:46:43.092Z"
},
{
"key": "avoid: direct public branch updates bypassed the repository’s pull-request-only rules, so ancestry and target refs required explicit validation to avoid unsafe rewrites.",
"text": "Avoid: Direct public branch updates bypassed the repository’s pull-request-only rules, so ancestry and target refs required explicit validation to avoid unsafe rewrites.",
"kind": "antiPattern",
"hits": 1,
"score": 1,
"firstSeen": "2026-08-18T19:46:43.092Z",
"lastSeen": "2026-08-18T19:46:43.092Z"
}
]
}