Maintenance: adversarial audit remediation wave - #18
Merged
Merged
Conversation
…put bounds, failure-path fixes, infra truth 24 findings survived the refute pass; this lands the surgical fixes: - filter: bounded DP glob matcher (ReDoS-proof, parity-tested 408 asserts), eager pattern validation ([z-a] now 400 not silent empty/no-op delete), reject [] and chained brackets, no ''→0 coercion - bounds: vector elements rejected beyond Float32 range; /upsert data<=1M chars + metadata serialized-size cap (amplification fix) - read paths: fetch/delete ids route through validateId(); /range throws instead of silently truncating past ~1M keys - runtime: Bun.serve idleTimeout derived >= requestTimeout; watchdog preserves unhealthySince on failed reinit (next-tick retry per docstring); FT.INFO verification failures fail loud instead of caching unverified dimension; embedding deadline armed through body consumption; embedMany chunked (256 items / 250k chars) preserving order - infra: --frozen-lockfile in test.yml(2)/compat.yml(1)/maintenance.yml(2); biome schema 2.5.10; runtime image drops dev-inclusive node_modules (~94MB) Refuted during audit: default-namespace 'global wipe' and colon-ID aliasing (v:: prefix arithmetic), string relational operators (exact Upstash parity), health liveness/readiness split. Filed as issues: #13 zombie mutations, #14 query response budget, #15 watchdog slow-ping semantics, #16 rename race, #17 upsert allocation chunking.
…s partial ESM mocks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Output of a full runbook deep-audit pass (6 mutually-blind finders → 29 one-skeptic-per-finding refutations → synthesis).
Adjudication: 5 refuted, 24 confirmed (several with corrected magnitudes). This PR lands 19 surgical fixes across filter correctness, input bounds, read-path consistency, runtime failure paths, and CI/image hygiene — each with unit coverage (444 tests now, was 383). Design-level survivors filed as #13–#17 with full mechanism + fix direction.
Highlights
[z-a]) now 400 instead of silently empty queries and silent no-op deletes behind 200 OK/upsertdata/metadata caps close a persistent GB-scale query amplification vectornullidleTimeout≥ request timeout (10s-vs-30s contract break reproduced empirically)Deliberately unchanged: compose
exposeposture is by design for Coolify-style platforms (1bb3880) — docs now state this plainly with an override snippet for direct host access.