Skip to content

docs(adr): accept ADR-0043; record the CodeQL findings its zod bump surfaced #247

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mbeacom merged 1 commit into from
Sep 29, 2026
Merged

docs(adr): accept ADR-0043; record the CodeQL findings its zod bump surfaced #247

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions MANIFEST.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -74,7 +74,7 @@ hand-written.
<!-- Generated by `bun run emit:manifest`; do not hand-edit. -->

There are 43 records, ids `0001`-`0043`, alongside
`0000-template.md`: 39 accepted, 2 proposed, 2 superseded.
`0000-template.md`: 40 accepted, 1 proposed, 2 superseded.

| Id | Status | Title |
| --- | --- | --- |
Expand Down Expand Up @@ -120,6 +120,6 @@ There are 43 records, ids `0001`-`0043`, alongside
| `0040` | proposed | Keep derived surfaces in lockstep with three mechanisms matched to three classes of drift |
| `0041` | accepted | Regenerate committed artifacts on Dependabot pull requests with default-branch scripts behind a maintainer label |
| `0042` | accepted | Count a gate-change acknowledgment only when an admin or maintainer applied it |
| `0043` | proposed | Publish schema v0.2.0 with RFC 3339 seconds, retain v0.1.0, and validate every record against the current schema |
| `0043` | accepted | Publish schema v0.2.0 with RFC 3339 seconds, retain v0.1.0, and validate every record against the current schema |

<!-- END GENERATED: adr-inventory -->
16 changes: 15 additions & 1 deletion ...ish-schema-v0-2-0-with-rfc-3339-seconds-retain-v0-1-0-and-validate-every-rec.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
schemaVersion: 0.2.0
id: "0043"
title: "Publish schema v0.2.0 with RFC 3339 seconds, retain v0.1.0, and validate every record against the current schema"
status: proposed
status: accepted
date: 2026-09-28
deciders: ["@mbeacom"]
tags: [schema, core, dependencies, hosting]
Expand All @@ -21,6 +21,7 @@ affects:
pattern: "zod"
provenance:
authoredBy: agent-drafted
ratifiedBy: "@mbeacom"
review:
tier: arb
tierReason: >-
Expand Down Expand Up @@ -161,6 +162,19 @@ pressure.
stops serving the pinned bytes.
- Revisit if: a second schema bump needs a rule change that a one-line migration
cannot express.
- **`zod` 4.6's code generator is visible to CodeQL in the Action bundles.** After
#241, `js/bad-code-sanitization` flagged zod's object fast path
(`Doc.compile()`, which builds a parser with `new Function`) in both
`packages/ci/dist/index.js` and `packages/ci/dist/queue-action.js` (alerts 9
and 10). The flagged value is `JSON.stringify` of an object-schema *shape key*.
Every such key is a field name declared in adrkit's own static schemas — no
corpus, PR, or event content becomes one (`z.record` keys do not take this
path) — and the result is only ever placed in a string-literal position in
code run on Node, where the query's `</script>` and U+2028/U+2029 concerns do
not apply. Both are false positives and are dismissed as such, not excluded:
the bundles stay in CodeQL's scope on purpose (`.github/workflows/codeql.yml`),
so a later `zod` that moves these lines may raise them again. Re-check that
shape keys are still static before dismissing a recurrence.

## Action items

Expand Down
Loading