release: sync develop to main (nosemgrep short-id fix)#211
Merged
Conversation
* chore: annotate subprocess.Popen calls with nosemgrep justifications The three subprocess.Popen sites (run_python_code, extract_file_content, model_warmup) all use a static argv ([sys.executable, "-m", <fixed module>]) with shell=False; request data is passed as JSON over stdin, never as a command argument. Add nosemgrep suppressions matching the existing file-traversal annotations so the subprocess-exec rule is consistently silenced for these reviewed call sites. * chore: use short-form rule IDs in nosemgrep suppressions The Frappe Cloud marketplace audit runs the bundled frappe semgrep rules, which match on the short rule IDs (e.g. frappe-subprocess-exec, frappe-security-file-traversal). Our suppressions used the fully-qualified frappe-semgrep-rules.rules.security.* IDs from the CI rule source, which the audit scanner does not match, so the suppressions had no effect there. Rewrite every nosemgrep directive to the bare rule ID so the suppressions are honored by both our CI/pre-commit and the marketplace audit. No code or behavior change. --------- Co-authored-by: Paul Clinton <paul.clinton@promantia.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Merges the post-2.5.0 work on
developintomain.Since v2.5.0, the only change on
developis #209 —chore: fix nosemgrep suppressions to use short-form rule IDs. develop now descends directly from thev2.5.0tag commit with just this onechore:on top.Release impact
None. semantic-release evaluates commits since
v2.5.0and will see only achore:→ no version bump, no new release. This merge keepsmaineven withdevelopand carries the suppression fix forward; the actual marketplace re-audit benefit lands here.Note
develop's history was re-synced onto main's released state before this PR (the 2.5.0 commits existed on develop under pre-rebase SHAs that the v2.5.0 tag didn't cover; left as-is, a merge would have made semantic-release re-cut the 2.5.0 changeset as 2.6.0). After re-sync, develop = main + #209.