Release
v3.7.2
breakwaterHotfix completing the 3.7.1 line. Discovery now holds the version-filtered invariant at the source boundary, so every reader of advisory data is covered, including override reclamation; cross-source fixed-version reconciliation works again for lines the sources describe differently; the GitLab report source retries transient failures; and a merge request produced with reduced coverage says so.
Highlights
- 01
Version-filtered discovery for every source
A finding leaves discovery only when a resolved component is at an affected version. The GitLab report re-lists a coordinate until its next pipeline scan, so after an upgrade fixed a cohort the merge request still highlighted every already-fixed advisory as residual, and a redundant Argus override could never be reclaimed because its CVE stayed present in the cleanup probe. Gating at the boundary fixes both at once, with case-insensitive coordinate matching so nothing still vulnerable is dropped.
- 02
Cross-source reconciliation restored
The report source carries no introduced boundary, so a higher in-line fix it stated was being silently ignored. A stated fix now attaches to the base line its version belongs to: parallel lines keep their own fix and highest-wins holds for a single line. A fix that fits no line is reported, not dropped.
- 03
Reduced coverage is visible on the merge request
When an optional advisory source such as the GitLab vulnerability report could not be read, the merge request now says so and why, instead of reading as complete. The report source also retries transient failures with the same backoff publishing uses, while a 403 still surfaces at once.
- 04
Nine findings from a whole-codebase adversarial review, closed
A cache path traversal through advisory identifiers, credential-bearing cross-origin redirects, a cleanup that could delete a developer's own dependencyManagement pin, a merge that dropped coordinates, npm fixless advisories reported as fixed, residuals cleared across packages, a merged merge request vetoing a needed fix forever, an uncancellable OSV wait, and aggregate merge requests missing their major-upgrade warning. Each verified, three reproduced, all fixed with tests.
Full notes
Added
- REG-221 runs the GitLab report source through an upgrade, the final pass and cleanup.
- REG-222 pins the reduced-coverage note on a published merge request.
Fixed
- Discovery gates every merged finding against the resolved graph at the source boundary (vulnerability.FilterAffecting), fixing the inflated residual list and blocked stale-override reclamation with a coordinate-keyed source (ADR-052, ADR-033).
- Fixed-version reconciliation attaches a stated fix to the base line its version belongs to, so a fabricated introduced boundary no longer silently disables cross-source highest-wins; an out-of-line fix is reported (ADR-052).
- The GitLab report source retries 5xx, 429 and transport errors with bounded context-aware backoff; 4xx is never retried (ADR-052).
- A merge request produced while an optional advisory source failed names the source and reason; unchanged when every source answered (ADR-052, ADR-033).
- Advisory identifiers are validated and cache files are contained and hashed; an identifier can no longer name a file outside the cache.
- Both HTTP clients refuse cross-origin redirects so credentials stay on the configured host.
- Cleanup never counts a marker-only reclaim as a removed dependency, and edits that overlap are skipped; a developer's pin cannot be deleted.
- The advisory merge keeps every coordinate any reporter states.
- npm carries an advisory its upgrade does not clear as a residual.
- Resolved advisories are tracked per coordinate so a fix on one package does not hide a residual on another.
- A merged merge request vetoes publication only while the target branch still carries the remediation.
- OSV Retry-After is capped and the OSV client honours run cancellation.
- Aggregate merge requests warn about major updates and carry the breaking-change label.