Repository navigation
docs: scan #113 — huggingface/tau; optillm #323 resolved (27th fix) - #164
Merged
Merged
Conversation
A contributor's host guard for the readurls approach was merged on 2026-10-10 and the issue closed as completed. Recorded from the merged pull request and the closed issue; the series' own check was not re-run against the merged code, and the post says so. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…n the contributor path) 49 findings at medium+. All 42 dependency rows come from uv.lock (Pillow 12.3.0, anyio 4.13.0, certifi 2026.5.20), which only the contributor install reads; every documented user install resolves the pyproject floors to fixed versions. The four Semgrep hits are a compatibility lint and a maintainer build script. Credits the project-trust gate, the PKCE loopback OAuth callback and the escaped session export. Post-only: nothing met the bar for filing upstream. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Daily run, 2026-10-23.
Scan #113: huggingface/tau at
261662b: 49 findings atmedium+, 0 first-party defects, post-only.uv.lock(Pillow 12.3.0 ×39, anyio 4.13.0 ×2, certifi 2026.5.20 ×1). pip-audit resolved thepyproject.tomlfloors and found zero. Both are right: every documented user install resolves the floors fresh to fixed versions, so the lock reaches onlyuv sync --devcontributors.AGENTS.mdincluded; headless sessions resolve to untrusted), the loopback PKCE OAuth callback, and the escaped HTML session export.tui/widgets.py(Python 3.12 type parameter), and pip-audit did not readuv.lock.run_verdict_check.py --checkand committed tocorpus/verdicts/huggingface-tau.json.Status sweep: optillm#323 was closed as completed by the merged contributor PR #334. It is recorded as the 27th fix in the post, index,
fixed.md, scan log and work-with-me. It was recorded from the merged PR and the closed issue only; the post says it was not re-verified by this series.Files:
docs/scans/huggingface-tau.md(new),docs/index.md,docs/scan-log.md,docs/fixed.md,docs/work-with-me.md,docs/scans/fossasia-voxbento.md(next link),docs/scans/algorithmicsuperintelligence-optillm.md,corpus/verdicts/huggingface-tau.json. 441 tests pass.🤖 Generated with Claude Code