chore(deps): bump github/codeql-action from 3.36.1 to 4.36.1#4
Open
dependabot[bot] wants to merge 12 commits into
Open
chore(deps): bump github/codeql-action from 3.36.1 to 4.36.1#4dependabot[bot] wants to merge 12 commits into
dependabot[bot] wants to merge 12 commits into
Conversation
feat: agent-native StreamNet CLI foundation + v0.1 vertical slice
dependabot
Bot
added
dependencies
- README: fix CI badge org (eduardoborjas → aedneth), add release badge, add Demo section with sample terminal output, add Roadmap table (v0.1.0-v1.0.0), add Contributing section, fix install URL org - CHANGELOG: restructure to proper Keep a Changelog format — move all content from [Unreleased] to [0.1.0] 2026-06-02 (includes CI fixes), add empty [Unreleased], fix footer link org to aedneth - package.json + src/commands/manifest.ts + CONTRIBUTING.md + .github/ISSUE_TEMPLATE/config.yml: replace all eduardoborjas → aedneth Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
P0 — agent-mode contract:
- output.ts: make emit/emitError/emitEnvelope return Promise<void> with
awaitable stdout writes (writeLine helper); process.exit() no longer
races the OS pipe buffer flush on any command
- build.ts: await context.output.emit/emitError before process.exit()
- cli.ts: add exitOverride() + configureOutput({writeErr:()=>{}}) so
Commander usage errors (missing arg, unknown option) map to exit 2
with an ok:false USAGE envelope in --json mode instead of exit 1 + no envelope
P1 — functional bugs:
- cli.ts: fix --no-input flag (Commander stores under opts.input, not
opts.noInput); remove bogus false default on negated option
- cli.ts + registry/types.ts: add configPath to CommandContext so
config set --config <path> writes to the user-specified file, not
the default location
- cli.ts + config/paths.ts: import configFile and resolve configPath
in makeContext; commands/config.ts: use ctx.configPath in saveConfig
- core/torrent/engine.ts: replace fake StreamNetTimeoutError class with
real StreamNetError(TORRENT_UNPLAYABLE); fix Aborted and file-not-found
rejects — all now properly instanceof StreamNetError
- util/http.ts: re-throw StreamNetError at start of catch so HTTP errors
from fail() are not re-wrapped as "Network error: StreamNetError: ..."
- commands/stream.ts: wrap post-startStream body in try/finally so
info.destroy() always runs even when spawnVlc/waitForVlc throws
- core/indexers/aggregate.ts: return {results, succeededCount, failedCount}
instead of bare array
- commands/search.ts: fail(NETWORK) when all indexers reject instead of
NO_RESULTS (agents retry differently on network vs no-results)
- registry/build.ts: coerce ZodNumber flag values from string (Commander
always delivers strings for non-boolean flags); fail USAGE on NaN
- test/agent-mode.test.ts: raise doctor test timeout to 15s (makes a
live network call that can take 3-5s on loaded runners)
- test/indexers.test.ts: update to destructure AggregateResult
P2 — security:
- config/store.ts: guard setConfigValue key segments against
__proto__ / constructor / prototype prototype-pollution walk
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Portable three-layer knowledge graph integration: SessionStart/PostToolUse/ UserPromptSubmit/Stop/PreToolUse hooks, graphify graph (auto-updates on commit), decisions + bugs ADRs committed, runtime artifacts gitignored. No-ops gracefully without local CKIS vault — external contributors unaffected. Registered in Dev Brain (~/Documents/Dev Brain/); graph-report auto-synced to CKIS 02-projects/<slug>/graph-report.md on each commit. Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
- Add .npmrc: ignore-scripts=true, registry pin, save-exact=true - Patch GHSA-5xrq-8626-4rwp: vitest → ^4.1.8 (critical — arbitrary file read/exec) - Pin all GitHub Actions to commit SHAs (not mutable tags) - Add --ignore-scripts to all npm ci / pnpm install steps in CI - Add explicit native module whitelist with npm_config_ignore_scripts=false rebuild - Add npm audit --audit-level=high gate to all CI and release workflows - Add permissions: {} (deny-all default) with per-job minimum grants - Add persist-credentials: false to all checkout steps - Add weekly security-audit.yml workflow (runs every Monday 09:00 UTC) - Add SECURITY.md with supply chain security policy and vulnerability disclosure Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
…-credentials: false Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
Implements the OpenSubtitles/VLSub subtitle pipeline and full-download mode
toward v1.0.0, and fixes a pre-existing flag-parsing bug surfaced during the audit.
Added
- core/subtitles/hash.ts: OpenSubtitles "moviehash" (size + first/last 64 KiB
checksum), reading only the two windows (cheap on multi-GB files).
- core/subtitles/opensubtitles.ts: REST v1 client — hash + text search with
ranked results (hash match > language preference > download count) and
download-link resolution. Api-Key from config, never hardcoded.
- core/subtitles/fetch.ts: orchestrates hash -> search -> download -> write
`<name>.<lang>.srt` beside the video, with a title-query fallback.
- commands/subs.ts: `streamnet subs <file>` (--lang, --query).
- commands/download.ts + engine.downloadTorrent(): full download to the
configured dir with progress, auto subtitle fetch for non-MKV files.
- stream/play: non-MKV streams best-effort fetch subtitles by title and pass
--sub-file to VLC; never fail the stream on a subtitle error.
- doctor: download-dir write check + warn-only OpenSubtitles key check
(warnings don't flip allOk/exit code).
Fixed
- Flag arity (P0): optional/default-wrapped Zod flags were classified as
boolean, so `--container`, `--quality`, `--indexer`, `--sub-lang`, `--query`,
`--out` swallowed no value ("too many arguments") and numeric coercion was
skipped on optional numbers. build.ts now unwraps Optional/Default/Nullable
to the underlying type. Regression test in test/flag-arity.test.ts.
Tests: 49 passing (was 38). tsc/lint/build green. Subtitle and download paths
fully mocked — no live network or torrents in tests.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Bump package.json 0.1.0 -> 1.0.0 and align docs for the first stable release: promote CHANGELOG [Unreleased] -> [1.0.0], reframe README roadmap (1.0.0 shipped; MCP/resolvers/binaries moved to post-1.0). Harden the two agent-mode subprocess tests with an explicit 15s timeout so Node startup under parallel load no longer trips the 5s default (was failing the release gate). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The "Rebuild native WebTorrent dependencies" step uses `2>/dev/null`, which on windows-latest runs under pwsh and is parsed as Out-File to `D:\dev\null`, failing the step (the `|| true` can't rescue a parse-time error). Pin the step to `shell: bash` (Git Bash is preinstalled on Windows runners) in both ci.yml and release.yml so it behaves identically across all three OSes. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
release: streamnet-cli v1.0.0 — full stream pipeline, subtitles, download
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.36.1 to 4.36.1. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@d77b13a...87557b9) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: '4' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
changed the title
dependabot
Bot
force-pushed
the
dependabot/github_actions/github/codeql-action-4
branch
from
4104937 to
d22a274
Compare
Author
|
A newer version of github/codeql-action exists, but since this PR has been edited by someone other than Dependabot I haven't updated it. You'll get a PR for the updated version as normal once this PR is merged. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps github/codeql-action from 3.36.1 to 4.36.1.
Release notes
Sourced from github/codeql-action's releases.
... (truncated)
Changelog
Sourced from github/codeql-action's changelog.
... (truncated)
Commits
7211b7cMerge pull request #3927 from github/update-v4.36.0-ebc2d9e2b7740f2fUpdate changelog for v4.36.0ebc2d9eMerge pull request #3926 from github/update-bundle/codeql-bundle-v2.25.5d1f74b7Add changelog note2dc40ceUpdate default bundle to codeql-bundle-v2.25.58449852Merge pull request #3910 from github/henrymercer/repo-size-diff-check72ac23cUpdate excluded required check list14c1509Rebuild89c58e6Rebuilda0a8d16Bump ruby/setup-ruby