Release/v0.5.0 by devops-thiago · Pull Request #427 · devops-thiago/ThrillhouseBot

devops-thiago · 2026-07-27T00:04:32Z

No description provided.

…lties, seed) (#64) (#389) ## Summary - Adds the remaining OpenAI-standard generation parameters to the per-model config surface from #50: `frequency-penalty`, `presence-penalty`, and `seed` under `thrillhousebot.ai.models.<model>.*` (temperature, top-p, and max-output-tokens already landed with #50). - Wires them through `ChatModelCustomizers` into both the blocking and streaming OpenAI-compatible model builders, applied only when set so untouched knobs keep provider defaults. - Validates penalties in `[-2, 2]` at boot for every model entry and includes the new parameters in the active-model startup log. - Docs: README per-model settings section (examples, `max-output-tokens` vs `output-buffer-tokens` relationship per the issue, `seed` best-effort note), `.env.example` env-var forms, `application.properties` comment/examples. `top-k` stays out of scope (native providers, #30). ## Issue Fixes #64 ## Test plan - [x] `ChatModelCustomizersTest`: penalties + seed applied to both builders; absent values leave builders untouched - [x] `ActiveModelSettingsTest`: per-model resolution and empty fallbacks for the new accessors - [x] `StartupConfigValidatorTest`: out-of-range penalties fail boot naming the key; valid boundary values (±2.0) boot; startup log includes the new params - [x] `./mvnw spotless:check spotbugs:check verify` passes locally

…ary actually posted (#334) (#390) ## Summary Completes #334. The narrow skip from #175 already suppresses the duplicate CI-pending COMMENT review on first reviews, but it keyed on `isFirstReview` alone — it never verified that the PR summary comment (whose *Required CI Checks Status* table carries the same pending/failed list) was actually created. A first review held back solely by CI whose summary post failed (swallowed by `publishSummaryBestEffort`) or was skipped therefore left **no visible surface at all**. - `ReviewPublisher.PostReviewRequest.summaryReposted` → `summaryPosted`: the orchestrator now passes `publishSummary`'s real outcome instead of `forceSummary && summaryPosted`. - `postNoIssuesReview` skips the CI-pending COMMENT only when `summaryPosted` is true — one notification surface per round, never zero. - The `/summary` re-run skip is unchanged in behavior (`summaryPosted && !isFirstReview` implies `forceSummary`). - Findings path untouched: COMMENT/REQUEST_CHANGES reviews with findings post exactly as before. No config knob added, so no README change. ## Issue Fixes #334 ## Test plan - [x] CI-only hold + summary posted → no duplicate COMMENT (`postReviewShouldSkipDuplicateCommentReviewOnFirstReviewWhenOnlyCiPending`, now via `PostReviewRequest(..., summaryPosted=true)`) - [x] CI-only hold + summary NOT posted → COMMENT still posted (new `postReviewShouldStillPostCiPendingCommentOnFirstReviewWhenSummaryDidNotPost`) - [x] Findings present → COMMENT review still carries them (existing suite, unchanged) - [x] `./mvnw verify` passes locally (1590 tests, JaCoCo coverage checks met, Spotless + SpotBugs clean)

## What type of PR is this?  - [ ] 🐛 Bug fix - [ ] ✨ Feature - [x] 📝 Documentation - [ ] 🔧 Refactor - [ ] 🚀 Performance - [ ] ✅ Test - [x] 🔒 Security - [ ] 📦 Dependency update - [x] 🏗️ CI/CD ## Description Closes the v0.3.1 dual-gate gap from #342: ThrillhouseBot's LLM review and static dependency CI are complementary, not substitutes. ### Changes - **CONTRIBUTING.md** — documents the dual-gate merge policy, optional Bugbot as a non-required third signal, and maintainer triage when the gates disagree (including the Jackson GHSA hold pattern from #308). - **dependency-review.yml** — runs on `main` / `develop` / `release/**` (aligned with CI), with comments tying the job to the dual-gate policy. - **Repo ruleset (already applied)** — `dependency-review` added to required status checks on `main-protection` alongside `format`, `test`, `frontend`, `trivy`. Does **not** duplicate ThrillhouseBot's LLM pass or implement linters-in-prompt (#34). ## Related Issues Fixes #342 Related: #34 (linters in LLM context — separate), #308 (Jackson GHSA hold pattern), #113, #318 ## How Has This Been Tested? - [ ] Unit tests - [ ] Integration tests - [x] Manual testing - Confirmed `main-protection` ruleset now requires `dependency-review`. - Reviewed workflow YAML against existing SHA-pinned action versions. - Docs-only / workflow-metadata change — no Java/frontend unit tests required. - CI on this PR: `dependency-review`, `format`, `test`, `frontend`, `trivy`, Sonar, CodeQL, Codecov all green. ## Checklist - [x] My code follows the project's coding standards - [x] I have performed a self-review of my own code - [ ] I have added tests that prove my fix is effective or that my feature works - [x] New and existing unit tests pass locally with my changes - [x] I have updated the documentation accordingly - [x] My changes generate no new warnings or errors ## Screenshots / Logs N/A — docs + workflow metadata only. Dependency Review summary on this PR: no vulnerabilities or license issues found. ## Additional Notes - ThrillhouseBot remains a soft gate (check can be NEUTRAL/skipped); static `dependency-review` is now merge-blocking. - Ruleset change is live on the repo already; merging this PR lands the docs + workflow branch-trigger alignment.

## What type of PR is this?  - [ ] 🐛 Bug fix - [x] ✨ Feature - [x] 📝 Documentation - [ ] 🔧 Refactor - [ ] 🚀 Performance - [x] ✅ Test - [ ] 🔒 Security - [ ] 📦 Dependency update - [ ] 🏗️ CI/CD ## Description Adds `REVIEW_BLOCKING_STRICTNESS` (`thrillhousebot.review.blocking-strictness`) so operators can choose when findings escalate to `REQUEST_CHANGES`: | Mode | Blocks when | |---|---| | `balanced` (default) | CRITICAL/HIGH + HIGH confidence (current v0.x behavior) | | `strict` | any CRITICAL/HIGH (security-team recommendation) | | `lenient` | CRITICAL + HIGH confidence only | Startup validation rejects unknown values (same fail-fast pattern as #27 / reasoning effort). `ReviewState.fromFindings` and `VerdictBuilder` honor the configured mode. README documents the default, security recommendation, verifier interaction, and that inline placement gating remains separate (#105). ## Related Issues Fixes #323 ## How Has This Been Tested? - [x] Unit tests - [ ] Integration tests - [ ] Manual testing - Parameterized `ReviewStateTest` fixtures across all three modes with mixed risk/confidence - Startup validation tests for invalid / case-insensitive modes - `VerdictBuilder` config-constructor coverage for strict mode and unrecognized-mode fallback - `./mvnw spotless:check` and `./mvnw verify` pass locally ## Checklist - [x] My code follows the project's coding standards - [x] I have performed a self-review of my own code - [x] I have added tests that prove my fix is effective or that my feature works - [x] New and existing unit tests pass locally with my changes - [x] I have updated the documentation accordingly - [x] My changes generate no new warnings or errors ## Screenshots / Logs N/A — backend config / verdict logic only. ## Additional Notes #105 (inline vs summary placement) is intentionally not implemented here — this PR only documents the interaction. Verifier demotions still run first; under `strict`, demoted confidence no longer prevents a merge block by design (documented for operators who rely on demotion noise reduction).

#394) ## What type of PR is this?  - [ ] 🐛 Bug fix - [x] ✨ Feature - [x] 📝 Documentation - [ ] 🔧 Refactor - [ ] 🚀 Performance - [x] ✅ Test - [ ] 🔒 Security - [ ] 📦 Dependency update - [ ] 🏗️ CI/CD ## Description Captures maintainer finding feedback as a precursor to cross-review learnings (#38). GitHub Apps do not receive a `reaction` webhook event, so the bot polls 👍 (`+1`) / 👎 (`-1`) on bot finding comments via the Reactions REST API when a human replies on a review thread or during follow-up reviews. Conservative reply heuristics (`not useful`, `false positive`, 👎, etc.) are recorded as well. Persists events in `finding_feedback` (login only — no extra PII), exposes aggregates at `GET /api/dashboard/feedback`, and documents the data model + retention in `docs/FEEDBACK.md`. Does **not** feed preferences into review prompts yet. ## Related Issues Fixes #324 Related: #38 (consumer), #315 (👀 ack — orthogonal, already shipped), #31 (conversational replies) ## How Has This Been Tested? - [x] Unit tests - [x] Integration tests - [ ] Manual testing - `FindingFeedbackServiceTest` — persist, idempotency, summarize, listRecent - `FindingFeedbackCaptureServiceTest` — reaction poll, heuristics, marker gating, error paths - `WebhookControllerTest` — schedules capture on review-thread replies (with and without @mention) - `DashboardResourceTest` — `/api/dashboard/feedback` aggregates - `./mvnw verify` (Spotless, SpotBugs, tests, JaCoCo) locally ## Checklist - [x] My code follows the project's coding standards - [x] I have performed a self-review of my own code - [x] I have added tests that prove my fix is effective or that my feature works - [x] New and existing unit tests pass locally with my changes - [x] I have updated the documentation accordingly - [x] My changes generate no new warnings or errors ## Screenshots / Logs N/A — backend capture path + dashboard JSON API; no UI page in this PR. ## Additional Notes Optional frontend feedback page was deferred; API + docs cover the optional dashboard acceptance criterion.

…tructor claims (#337) (#396) ## Summary - Adds a deterministic `FrameworkFalsePositiveFilter` (`review/`) that drops "missing no-arg/default constructor" findings when the flagged file's own diff shows a constructor annotated `@Inject` (CDI/Quarkus/Jakarta, bare or fully qualified) or `@Autowired` (Spring) — constructor injection needs no no-arg constructor, so the diff refutes the claim outright. Conservative in the same direction as `FindingQuoteValidator`: deleted lines never count as evidence, other files' hunks can't refute, and when the constructor sits outside the diff window the finding passes through unchanged. - Wires the filter into both `FindingPipeline` paths (single-call `refine` and per-batch `processBatch`), right after quote validation, with the summary recounted on drop. - Adds the CDI constructor-injection fact to the reviewer prompt (`PrReviewPrompts.SYSTEM` confidence-calibration section) and as a rejection rule in `FindingVerifierPrompts.SYSTEM`, plus a new "Framework facts" section in `.github/thrillhousebot.md`. Reproduces the #270 dogfood shape: the bot posted **MEDIUM — missing no-arg CDI constructor** on `PrSummaryGenerator` despite a valid `@Inject` constructor. That exact shape is the primary test fixture and is now suppressed deterministically, with the prompt guardrails preventing the claim upstream. ## Issue Fixes #337 ## Test plan - [x] `FrameworkFalsePositiveFilterTest` (20 tests): drops the #270-class claim on an `@Inject` constructor-only bean (annotation above, inline, and with interleaved annotations; claim in title or description); keeps the finding when there is no `@Inject` constructor, when `@Inject` is on a field, when the annotated constructor was deleted, when the evidence is in another file, on constructor *invocations* (`new X(...)`), on non-Java/missing file paths, and on unrelated findings; recounts the summary when dropping. - [x] `FindingPipelineTest`/`ReviewOrchestratorTest` updated for the new pipeline dependency. - [x] `./mvnw verify` passes locally (1608 tests, SpotBugs, JaCoCo gate); new class at 99% instruction coverage with the one previously-missed line now covered.

…n force-push (#336) (#397) ## What type of PR is this? - [x] 🐛 Bug fix ## Description Dogfood on #299 showed that after a force-push removed the code a prior finding targeted, the bot still held the finding open ("unresolved") and the summary kept describing code that no longer existed. This PR adds a stale-finding lifecycle on the inline/model-status path (the deterministic backstop from #118 already checked presence; the model-reported path did not): - **`FollowUpAnalyzer.supersedeVanished`**: before the APPROVE gates run, each model-reported `unresolved` status is re-checked against the current diff via `DiffLineResolver.isFindingPresent` on the finding's persisted `suggestion_old` anchor. If the anchored hunk is gone (file left the diff or the hunk vanished), the status is rewritten to a synthetic `superseded` with an explanatory note — it no longer blocks APPROVE and no longer enters `outstanding`, so it can't force REQUEST_CHANGES either. - Safety: a finding without a file (unplaceable) keeps its hold — "cannot verify" never reads as "gone". Non-`unresolved` and out-of-range statuses pass through untouched. The existing backstop path is unchanged (it already filters by presence). - **Surfacing**: `toStatuses` keeps the synthetic status, and the summary's "Previous Findings Status" table gains a `🗂️ Superseded (targeted code left the diff)` row (only when > 0). - **Summary regeneration**: `ReviewPublisher.publishSummary` now also posts the freshly regenerated summary on a follow-up review when a prior finding was superseded (`ReviewResult.hasSupersededPrevious()`), so the visible summary no longer describes removed code. ## Related Issues Fixes #336 ## How Has This Been Tested? - [x] Unit tests - [ ] Integration tests - [ ] Manual testing - `FollowUpAnalyzerTest`: supersede on vanished file, presence judged by anchor (not just file), null-file / non-unresolved / out-of-range statuses untouched, missing-input pass-through, `toStatuses` keeps `superseded`. - `VerdictBuilderTest` (real `FollowUpAnalyzer`): force-push removes the file → prior unresolved finding is superseded and the review APPROVEs; finding still present in the diff → still holds (REQUEST_CHANGES). - `PrSummaryGeneratorTest`: superseded row rendered only when a finding was superseded. - `ReviewPublisherTest` (new): follow-up with a superseded finding re-posts the summary; plain follow-up does not. - `./mvnw verify` green locally (1600 tests, Spotless, SpotBugs, JaCoCo); no uncovered changed lines. ## Checklist - [x] My code follows the project's coding standards - [x] I have performed a self-review of my own code - [x] I have added tests that prove my fix is effective - [x] New and existing unit tests pass locally with my changes

…pts (#113) (#400) ## Summary Implements the prompt eval/regression corpus from #113: prompt and verifier changes are no longer validated only by the next live PR review — confirmed dogfood outcomes are now pinned as labeled fixtures a suite can replay. - **Labeled corpus** (`src/test/resources/evalcorpus/<case>/case.json` + `diff.txt`): each case pins a real, thread-resolved dogfood outcome. Diffs are reconstructed from the exact commits the bot reviewed (`original_commit_id` of each review comment) and stored in the same `### path (status, +A -D)` + fenced-patch format the pipeline sends to the model. Seeded with: - PR #100 refuted FP — empty-line `IndexOutOfBoundsException` (`expectedVerdicts: [rejected]`) - PR #100 confirmed TP — `\ No newline at end of file` indexing (`[confirmed]`) - PR #84 refuted FP — omitted-lines off-by-one arithmetic (#96/#97) (`[rejected]`) - PR #101 refuted FP — `accountOwner` NPE with caller guard outside the diff (#106/#107) (`[rejected]`) - Two generator-side cases over the PR #100 diff: `must-find` the no-newline bug, `must-not-find` the empty-line IOOBE claim - **Deterministic guard** (`EvalCorpusTest`, runs in every CI build): validates corpus schema, provenance, verdict labels, and diff format — a malformed new case fails at merge time, no AI call. - **Opt-in live suite** (`PromptEvalTest`, JUnit tag `eval`, surefire-excluded by default): verifier cases go through the production `FindingVerificationService.verify` path and classify the outcome (dropped→rejected, lowered→downgraded, unchanged→confirmed); generator cases run `PrReviewer.reviewStream` and keyword-match findings on the target file. LLM nondeterminism is absorbed by majority-over-N sampling (`-Deval.samples`, default 3) plus a tolerated-regression budget (`-Deval.tolerated`, default 0). - **`-Peval` Maven profile** flips the surefire tag filters; CONTRIBUTING documents the workflow and how to add cases from resolved review threads. Bugbot-comparison seeds from the issue's follow-up comment (PRs #305/#307/#308/#333) could not be extracted — those PRs have no inline review data via the API — but the corpus is append-only by design: new cases are a directory drop, no code change. ## Issue Fixes #113 ## Test plan - [x] `EvalCorpusTest` (4 tests) passes and runs in the default build - [x] `./mvnw test -Peval -Dtest=PromptEvalTest` wires up (skips via assumption without a provider key; live run is opt-in by design) - [x] `./mvnw verify` passes locally — 1593 tests, Spotless, SpotBugs, JaCoCo all green - [x] No production code changed; all new files are test-scoped or fixtures

…gger (#110) (#399) ## What type of PR is this? - [ ] 🐛 Bug fix - [x] ✨ Feature - [ ] 📝 Documentation - [ ] 🔧 Refactor - [ ] 🚀 Performance - [ ] ✅ Test - [ ] 🔒 Security - [ ] 📦 Dependency update - [ ] 🏗️ CI/CD ## Description The reviewer judged a change for local correctness but never asked whether a *fix* actually fixes the thing it claims to: a bug-fix PR whose fix is a no-op for the scenario it targets passed silently as long as every changed line was locally valid (dogfood evidence: PR #102 / issue #89, reviewed as "No issues found"). This adds the interim, diff-alone guard proposed in the issue, strengthened with linked-issue text: - **`BugFixContextResolver`** detects a bug-fix PR (PR-template "Bug fix" checkbox checked, or a `Fixes/Closes/Resolves #N` closing reference in the body), extracts up to 3 linked issue numbers, and fetches each issue's title/body best-effort (per-issue 4k-char cap; any fetch failure degrades to the PR description alone, never fails the review). - **`ReviewContextLoader`** carries the rendered linked-issue text in `ReviewContext.linkedIssuesContext`. - **`ReviewPromptAssembler`** injects a new **Bug-Fix Efficacy Check** guidance block (`PrReviewPrompts.BUG_FIX_EFFICACY_REQUEST`) plus the escaped linked-issue text into the trailing-guidance slot, so it rides both the single-call and token-budgeted multi-call paths. The block makes the model: extract the concrete failure trigger, trace it through the changed code, **name the changed line that executes under the trigger**, emit a high-risk "fix does not change behavior for the stated trigger" finding when none does, and hold the verdict at low/medium confidence as a verification request when the deciding code is outside the diff — including calling out tests that mock the trigger away. - **`FindingVerifierPrompts`** gains a matching rule so the skeptical second pass judges efficacy findings on the trigger's path rather than rejecting them because the changed lines are locally valid (with zero generator findings there was previously nothing it could do about this miss class). - New `getIssue` endpoint on `GitHubCommentClient`. Deeper cross-file grounding remains with #55; the execution-oracle complement is #96. ## Issue Fixes #110 ## Test plan - [x] `BugFixContextResolverTest` — checkbox/keyword detection (incl. unchecked boxes and plain `#N` mentions), reference extraction dedup/cap, linked-issue rendering, fetch-failure soft degradation, body truncation - [x] `ReviewPromptAssemblerTest` — section omitted for non-bug-fix PRs, guidance-only when no issue text, escaped issue text appended (spoofed diff-fence markers neutralized) - [x] `./mvnw verify` passes locally (1602+ tests, Spotless, SpotBugs, JaCoCo) - [x] Changed classes at 100% line and branch coverage in the local JaCoCo report

…398) ## Summary - Adds `ReviewSkipReason` enum + `ReviewSkipEmitter`: a single emit point that turns every automatic-review skip into a structured `Automatic review skipped [reason=...]` log line, a `thrillhouse.review.skips` OpenTelemetry counter (attributes: `reason`, `repository`), and an in-memory per-reason count. - Wires every skip path through it: duplicate webhook delivery, `/pause`, trigger-filter gates (draft, ignored/allowed base branch, excluded/required labels — `ReviewTriggerFilter` now returns a structured `Skip(reason, detail)`), the auto-review rate window (both the controller gate and the async re-check in `ReviewDispatcher`), and executor-rejected dispatch. - Dashboard `GET /api/dashboard/summary` now returns `skippedReviewsByReason` counts (per replica, since start). - README gains a `## Troubleshooting` → "PR opened but no review posted" checklist mapping each reason code to its config knob/fix, plus the new metric in the Observability table. ## Issue Fixes #341 ## Test plan - [x] Draft-skip and pause-skip emit the structured event (`WebhookControllerTest`) - [x] Rate-limited, duplicate-delivery, dispatch-rejected, and async dispatcher re-check paths emit; happy path and non-review redeliveries do not - [x] `ReviewSkipEmitterTest` covers per-reason counting and ordering - [x] `DashboardResourceTest` asserts `skippedReviewsByReason` on `/summary` - [x] `./mvnw spotless:check spotbugs:check verify` passes locally (1599 tests) - [x] JaCoCo: no uncovered new lines in changed production files

) ## What type of PR is this?  - [ ] 🐛 Bug fix - [x] ✨ Feature - [x] 📝 Documentation - [ ] 🔧 Refactor - [ ] 🚀 Performance - [x] ✅ Test - [ ] 🔒 Security - [ ] 📦 Dependency update - [ ] 🏗️ CI/CD ## Description Adds configurable CI gating strictness for the APPROVE decision (`thrillhousebot.review.ci-gating` / `REVIEW_CI_GATING`): - **`strict`** (default) — current fail-closed behavior: hold APPROVE while required CI is pending, failing, or unreadable - **`warn`** — APPROVE allowed; summary and check run still note CI uncertainty - **`off`** — skip CI fetch/evaluation entirely (findings-only gate) `CiStatusEvaluator` and `VerdictBuilder` both respect the mode. Invalid values fail at boot. Documented in README + `.env.example` with the safety trade-offs. ## Related Issues Fixes #322 ## How Has This Been Tested? - [x] Unit tests - [ ] Integration tests - [ ] Manual testing - New tests cover strict vs warn vs off on offending/unreadable CI payloads (`VerdictBuilderTest`, `CiStatusEvaluatorTest`, `CiGatingModeTest`, `PrSummaryGeneratorTest`) - Startup validation rejects invalid `REVIEW_CI_GATING` values - `./mvnw spotless:check spotbugs:check verify` passes locally ## Checklist - [x] My code follows the project's coding standards - [x] I have performed a self-review of my own code - [x] I have added tests that prove my fix is effective or that my feature works - [x] New and existing unit tests pass locally with my changes - [x] I have updated the documentation accordingly - [x] My changes generate no new warnings or errors ## Screenshots / Logs N/A — backend config / review-path change; no UI. ## Additional Notes Related context from the ticket: #253/#254 (shipped CI fail-closed fixes), #302 (unknown required-context copy), #59 (future CI-into-prompt work, complementary). Prefer keeping `strict` unless flaky CI or incomplete required-context resolution makes a softer mode necessary.

…us copy (#135) (#395) ## What type of PR is this? - [x] 🚀 Performance - [ ] 🐛 Bug fix - [ ] ✨ Feature - [ ] 📝 Documentation - [ ] 🔧 Refactor - [ ] ✅ Test - [ ] 🔒 Security - [ ] 📦 Dependency update - [ ] 🏗️ CI/CD ## Description The #118 approve backstop (PR #119) left three redundancies on every follow-up review. After the #250 orchestrator split those live in `ReviewContextLoader` / `VerdictBuilder` / `FollowUpAnalyzer`; this PR removes them with no behavior change: **(a) One memoized `DiffLineResolver`.** Built lazily via a supplier on `ReviewContext`, shared by the finding pipeline, approve backstop, and `postReview`. A no-context verdict path that never touches the supplier does not parse patches at all (construction counter asserts this). **(b) Prior AI JSON deserialized once.** `ReviewContextLoader.load` calls `parsePreviousResponses` once and stores `priorAiResponses` on the context. Context formatting, unresolved gating, the backstop, finding-file id maps, and thread matching reuse the parsed objects. **(c) Conditional status merge.** `VerdictBuilder.mergePreviousStatuses` returns the `toStatuses` list unchanged when the backstop is empty — no `ArrayList` wrap/copy on the common path. ## Related Issues Fixes #135 Related: #118 (parent backstop), #74 (reuse-fetched-data pattern), PR #119. ## How Has This Been Tested? - [x] Unit tests - [ ] Integration tests - [ ] Manual testing New / updated coverage: - `ReviewContextLoaderTest$DedupeHotPathLoad` — resolver built once / never when unused; prior responses parsed once at load - `VerdictBuilderTest` — merge identity on empty backstop; no-context path does not touch the resolver supplier - Existing `ReviewOrchestratorTest` / `FollowUpAnalyzerTest` / `FindingPipelineTest` updated for the parse-once APIs Local verification: - `./mvnw spotless:apply` / check ✅ - `./mvnw verify` ✅ — 1595 tests, SpotBugs clean, JaCoCo gate met ## Checklist - [x] My code follows the project's coding standards - [x] I have performed a self-review of my own code - [x] I have added tests that prove my fix is effective or that my feature works - [x] New and existing unit tests pass locally with my changes - [ ] I have updated the documentation accordingly - [x] My changes generate no new warnings or errors ## Additional Notes No behavior change to merged `previousStatuses` ordering, counts, gate, or messages. `ReviewResult` still receives a non-null, copyable status list.

## What type of PR is this? - [ ] 🐛 Bug fix - [x] ✨ Feature - [ ] 📝 Documentation - [ ] 🔧 Refactor - [ ] 🚀 Performance - [x] ✅ Test - [ ] 🔒 Security - [ ] 📦 Dependency update - [ ] 🏗️ CI/CD ## Description Confidence already drove the review verdict but not comment placement, so low-confidence findings still opened inline threads that maintainers had to triage (dogfood: PR #101 NPE false positive at low confidence). This gates inline posting: - **Inline** when `confidence >= MEDIUM`, or when `risk >= HIGH` (severe-but-uncertain stays visible on the diff) - **Summary** otherwise: collapsed **Things to double-check** section with file/line and the existing confidence disclaimer - `ReviewState` / blocking logic unchanged Also surfaces confidence-routed findings in the review body so follow-up reviews (which do not re-post the summary) still carry the signal. ## Related Issues Fixes #105 ## How Has This Been Tested? - [x] Unit tests - [ ] Integration tests - [ ] Manual testing - `Finding.postsInline` / `ReviewResult.keyFindings` + `doubleCheckFindings` - `ReviewPublisher.postInlineComments` excludes low-confidence medium findings and keeps low-confidence high-risk inline - `PrSummaryGenerator` renders **Things to double-check** and keeps those titles out of **Key Findings** - `./mvnw spotless:check spotbugs:check verify` passed locally ## Checklist - [x] My code follows the project's coding standards - [x] I have performed a self-review of my own code - [x] I have added tests that prove my fix is effective or that my feature works - [x] New and existing unit tests pass locally with my changes - [x] I have updated the documentation accordingly - [x] My changes generate no new warnings or errors ## Additional Notes Part of the confidence-capping multiplier for #106/#107/#98 — capping to low now actually moves findings out of the inline stream.

…avior (#111) (#409) ## What type of PR is this? - [ ] 🐛 Bug fix - [x] ✨ Feature - [ ] 📝 Documentation - [ ] 🔧 Refactor - [ ] 🚀 Performance - [x] ✅ Test - [ ] 🔒 Security - [ ] 📦 Dependency update - [ ] 🏗️ CI/CD ## Description A PR's related-tests context can reinforce a false premise: when a new test mocks a collaborator to behave in a way the real collaborator cannot, the green test makes a broken change look *proven*. Dogfood evidence from PR #102 — `WebhookControllerTest` stubbed `dispatch(...)` to throw, but the real `ReviewDispatcher.dispatch()` swallows `RejectedExecutionException` and returns `false`. This adds the interim mock-fidelity guard proposed in #111 (scoped to collaborators already in the provided material; deeper cross-file retrieval remains with #55): - **`PrReviewPrompts`**: new review dimension **8. MOCK FIDELITY**, softened related-tests framing, a self-check exception for unfaithful stubs, and trailing-guidance constant `MOCK_FIDELITY_REQUEST`. - **`ReviewPromptAssembler`**: injects the mock-fidelity block when the PR changes test files (rides single-call and token-budgeted paths via `repoInstructions`). - **`FindingVerifierPrompts`**: matching rule so the skeptical second pass confirms mock-contradiction findings instead of rejecting them because the test is green. - **Eval corpus**: PR #102 generator (`must-find`) and verifier (`confirmed`) cases; `PromptEvalTest` injects the trailing block when the fixture diff changes tests. Sibling of the bug-fix efficacy check (#110 / #399). Execution-oracle complement remains #96. ## Related Issues Fixes #111 ## How Has This Been Tested? - [x] Unit tests - [ ] Integration tests - [ ] Manual testing - `ReviewPromptAssemblerTest` — section omitted without related tests; guidance emitted when test files are listed - `ReviewOrchestratorTest` — injected into `repoInstructions` only when the PR changes tests - `EvalCorpusTest` — new PR #102 corpus cases validate - `./mvnw verify` passes locally (Spotless, tests, SpotBugs, JaCoCo); `ReviewPromptAssembler` at 100% line/branch coverage ## Checklist - [x] My code follows the project's coding standards - [x] I have performed a self-review of my own code - [x] I have added tests that prove my fix is effective or that my feature works - [x] New and existing unit tests pass locally with my changes - [x] I have updated the documentation accordingly (CHANGELOG) - [x] My changes generate no new warnings or errors ## Additional Notes Live prompt eval (`./mvnw test -Peval -Dtest=PromptEvalTest`) is opt-in with a provider key; corpus fixtures are included for that path.

…he diff (#107) (#406) ## What type of PR is this? - [x] 🐛 Bug fix - [x] ✨ Feature ## Description A null-dereference / precondition finding about a **method parameter** can only be judged by seeing the **caller**. Both the generator and the verifier see only the diff, so when a change touches a callee whose guarding caller is unchanged — and therefore absent from the material — the model assumes the worst and posts anyway. **Dogfood evidence — PR #101:** MEDIUM "Potential NullPointerException when accountOwner is null in `installedRepos()`". `accountOwner` is provably non-null via unshown callers `checkAccess`/`evaluateAccess`, yet the finding stated "the caller's contract is not visible in the diff" and posted at low confidence as an inline MEDIUM thread. This PR adds the claim-class guard (same shape as #192 for undefined symbols): - **Generator** (`PrReviewPrompts`): a parameter-nullability / precondition claim is at most confidence `low` unless the calling code is present and shown to pass a violating value; inventing a null at the method boundary does not establish the path. - **Verifier** (`FindingVerifierPrompts`): **rejects** when the parameter's source (caller) is not in the provided material — with the PR #101 `accountOwner` case embedded as an inline regression example. A `rejected` verdict drops the finding before posting. - Deterministic content tests pin both rules so a future prompt edit cannot silently revert them. The existing `evalcorpus/pr101-accountowner-npe-false-positive` case already expects `rejected`. Interim guard ahead of #55 (codebase-aware context). Independent of #105 (confidence-gated posting): the verifier **rejects** rather than merely capping to low. ## Related Issues Fixes #107. ## How Has This Been Tested? - [x] Unit tests - [ ] Integration tests - [ ] Manual testing - `./mvnw spotless:check` - `./mvnw -Dtest=PrReviewPromptsContentTest,AiServicePromptRenderingTest,EvalCorpusTest test` - `./mvnw spotbugs:check` - `./mvnw verify -DskipITs` ## Checklist - [x] My code follows the project's coding standards - [x] I have performed a self-review of my own code - [x] I have added tests that prove my fix is effective or that my feature works - [x] New and existing unit tests pass locally with my changes - [x] I have updated the documentation accordingly - [x] My changes generate no new warnings or errors ## Additional Notes Related: #192 (sibling prompt-rule pattern for undefined symbols), #55 (structural fix that subsumes this once callers are in context), #105 (confidence-gated posting — orthogonal; this rejects rather than caps).

…finding (#116) (#408) ## What type of PR is this? - [ ] 🐛 Bug fix - [x] ✨ Feature - [ ] 📝 Documentation - [ ] 🔧 Refactor - [ ] 🚀 Performance - [x] ✅ Test - [ ] 🔒 Security - [ ] 📦 Dependency update - [ ] 🏗️ CI/CD ## Description Softens the review/verifier precision guard that treated any green in-diff test as disproof of a finding. A passing test may invalidate (generator) or reject (verifier) a finding only when it **demonstrably exercises** the claimed path: 1. it asserts on the path's output / observable effect (not merely that the method ran), and 2. its mocks/stubs put collaborators into the state the claim is about — collaborators on the path are not left unmocked so a default return bypasses it. When that exercise cannot be shown from the provided material, confidence is lowered with an explanation ("a test exists but may not exercise this path") instead of discarding the finding. Dogfood motivation (PR #99 / #95): the approve-path test stayed green because `prClient.getPullRequest` was left unmocked and returned `null`, so the new CI gate was never reached — yet the hard "test passes → finding invalid" rule would have suppressed a true critical-class miss. Also updates the USER `relatedTests` section so related tests are evidence only when they actually exercise the claimed path. ## Related Issues Fixes #116 Sibling of #97, #111 (test/verifier fidelity family); distinct from #111 (absent mock vs unfaithful stub). ## How Has This Been Tested? - [x] Unit tests - [ ] Integration tests - [ ] Manual testing - Added `PrReviewPromptsContentTest` pins for the generator SYSTEM self-check, USER related-tests guidance, and verifier mirror - `./mvnw spotless:check spotbugs:check verify` passed locally ## Checklist - [x] My code follows the project's coding standards - [x] I have performed a self-review of my own code - [x] I have added tests that prove my fix is effective or that my feature works - [x] New and existing unit tests pass locally with my changes - [x] I have updated the documentation accordingly - [x] My changes generate no new warnings or errors ## Additional Notes Prompt-only change (plus content pins + CHANGELOG). Live LLM eval corpus for this recall case can land with #113's corpus once that lands on main; this PR ships the deterministic prompt pins now.

- [ ] 🐛 Bug fix - [ ] ✨ Feature - [ ] 📝 Documentation - [x] 🔧 Refactor - [ ] 🚀 Performance - [x] ✅ Test - [ ] 🔒 Security - [ ] 📦 Dependency update - [ ] 🏗️ CI/CD Addresses SonarCloud rule **java:S9024** on `release/v0.5.0` (9 MAJOR code smells in new code). Migrates nine unit tests from `MockitoAnnotations.openMocks(this)` + manual `new SUT(...)` to `@ExtendWith(MockitoExtension.class)` + `@InjectMocks`. Shared `@BeforeEach` stubs that are not used by every test are marked `lenient()` so Mockito's strict stubbing (enabled by `MockitoExtension`) does not fail tests that take early-exit paths. Touched tests: - `PrDescriptionGeneratorTest` - `AiReviewServiceTest` - `PrLabelerTest` - `ChangelogEntryGeneratorTest` - `MaintainerReplyDispatcherTest` - `CheckRunManagerTest` - `AckReactionServiceTest` - `ManualReviewAuthorizerTest` - `ReviewThreadServiceTest` N/A — SonarCloud findings (`java:S9024`) on project `devops-thiago_ThrillhouseBot`. - [x] Unit tests - [ ] Integration tests - [ ] Manual testing ```bash ./mvnw -Dtest=PrDescriptionGeneratorTest,AiReviewServiceTest,PrLabelerTest,ChangelogEntryGeneratorTest,MaintainerReplyDispatcherTest,CheckRunManagerTest,AckReactionServiceTest,ManualReviewAuthorizerTest,ReviewThreadServiceTest test ``` Result: 150 tests, 0 failures. - [x] My code follows the project's coding standards - [x] I have performed a self-review of my own code - [x] I have added tests that prove my fix is effective or that my feature works - [x] New and existing unit tests pass locally with my changes - [ ] I have updated the documentation accordingly - [x] My changes generate no new warnings or errors N/A PR targets `release/v0.5.0` (not `main`) so the Sonar new-code findings on that branch clear with the release line.

- [ ] 🐛 Bug fix - [ ] ✨ Feature - [x] 📝 Documentation - [ ] 🔧 Refactor - [x] 🚀 Performance - [x] ✅ Test - [ ] 🔒 Security - [ ] 📦 Dependency update - [ ] 🏗️ CI/CD Implements [#386](#386). Pure renames (`status=renamed`, `additions+deletions==0`, blank/null patch) are excluded from `reviewableFiles()` so they never enter `DiffBudgetPlanner` or line-capped diff sections. Rename+edit (non-empty patch) stays reviewable. The summary / diff overview discloses a capped rollup (`N pure renames omitted…`) and pure renames do **not** count toward truncation / APPROVE hold. Also maps GitHub’s `previous_filename` onto `FileDiff` for `old → new` samples in the rollup. Fixes #386 - [x] Unit tests - [ ] Integration tests - [ ] Manual testing ```bash ./mvnw -Dtest=ReviewDiffFormatterTest,DiffBudgetPlannerTest,ReviewContextLoaderTest test ``` 118 tests, 0 failures. Updated `shouldHandleFilesWithZeroChanges` for the new rollup behavior. - [x] My code follows the project's coding standards - [x] I have performed a self-review of my own code - [x] I have added tests that prove my fix is effective or that my feature works - [x] New and existing unit tests pass locally with my changes - [x] I have updated the documentation accordingly - [x] My changes generate no new warnings or errors N/A Targets `release/v0.5.0` (milestone candidate). Signed-off-by: Thiago Gonzaga <thiago.gonzaga@icloud.com>

Bumps [svgo](https://github.com/svg/svgo) from 4.0.1 to 4.0.2. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/svg/svgo/releases">svgo's releases</a>.</em></p> <blockquote> <h2>v4.0.2</h2> <h2>What's Changed</h2> <h3>Security</h3> <ul> <li><a href="https://svgo.dev/docs/plugins/removeScripts/">removeScripts</a>, remove JavaScript URIs case-insensitively and make <code><script></code> handling namespace aware. By <a href="https://github.com/SethFalco"><code>@SethFalco</code></a></li> </ul> <h3>Bug Fixes</h3> <ul> <li><a href="https://svgo.dev/docs/plugins/convertColors/">convertColors</a>, skip case-normalization for CSS custom properties. By <a href="https://github.com/SethFalco"><code>@SethFalco</code></a> in <a href="https://redirect.github.com/svg/svgo/pull/2213">svg/svgo#2213</a></li> <li><a href="https://svgo.dev/docs/plugins/convertPathData/">convertPathData</a>, improve handling of consecutive <code>t</code> commands. By <a href="https://github.com/KTibow"><code>@KTibow</code></a> in <a href="https://redirect.github.com/svg/svgo/pull/2156">svg/svgo#2156</a></li> <li><a href="https://svgo.dev/docs/plugins/convertPathData/">convertPathData</a>, safer handling of paths. By <a href="https://github.com/KTibow"><code>@KTibow</code></a> in <a href="https://redirect.github.com/svg/svgo/issues/2158">svg/svgo#2158</a></li> <li>Improve parsing of negative (or +) arc radii. By <a href="https://github.com/KTibow"><code>@KTibow</code></a> in <a href="https://redirect.github.com/svg/svgo/pull/2205">svg/svgo#2205</a></li> <li>When converting to a data URI, only encode it as a data URI once. By <a href="https://github.com/johnkenny54"><code>@johnkenny54</code></a> in <a href="https://redirect.github.com/svg/svgo/pull/2053">svg/svgo#2053</a></li> </ul> <h3>Performance</h3> <ul> <li><a href="https://svgo.dev/docs/plugins/mergePaths/">mergePaths</a>, speed up child node removal. By <a href="https://github.com/mozzie"><code>@mozzie</code></a> in <a href="https://redirect.github.com/svg/svgo/pull/2216">svg/svgo#2216</a></li> </ul> <h3>Other Changes</h3> <ul> <li><a href="https://svgo.dev/docs/plugins/removeAttributesBySelector/">removeAttributesBySelector</a>, log warning and noop if missing parameters. By <a href="https://github.com/KTibow"><code>@KTibow</code></a> in <a href="https://redirect.github.com/svg/svgo/pull/2215">svg/svgo#2215</a></li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/svg/svgo/commit/b2309cf541aee11634eb653157b0ff86ab326e98"><code>b2309cf</code></a> chore: sync version with api</li> <li><a href="https://github.com/svg/svgo/commit/f529cfccc6c154d6f6eabe276ec637a8c5db6763"><code>f529cfc</code></a> Merge commit from fork</li> <li><a href="https://github.com/svg/svgo/commit/581fe687825740e425012bbdf6491ee4bbc9dc65"><code>581fe68</code></a> performance: speed up mergePath child node removal (<a href="https://redirect.github.com/svg/svgo/issues/2216">#2216</a>)</li> <li><a href="https://github.com/svg/svgo/commit/eb4c8b69d4b589addaf98e56cd17241d4a39ad77"><code>eb4c8b6</code></a> docs(removeAttributesBySelector): properly document and check types (<a href="https://redirect.github.com/svg/svgo/issues/2215">#2215</a>)</li> <li><a href="https://github.com/svg/svgo/commit/6fd58725fc934ab51bc4ed84e7299dc73d72442b"><code>6fd5872</code></a> fix(convertColors): skip convertCase on css custom properties (<a href="https://redirect.github.com/svg/svgo/issues/2213">#2213</a>)</li> <li><a href="https://github.com/svg/svgo/commit/7414f739a44b126750b119d5e22a88db3d4bd9c6"><code>7414f73</code></a> fix: properly parse negative (or +) arc radii (<a href="https://redirect.github.com/svg/svgo/issues/2205">#2205</a>)</li> <li><a href="https://github.com/svg/svgo/commit/a8c19aadc55935e5ce7e3c5ad0a8915fda758f5e"><code>a8c19aa</code></a> fix: only call encodeSVGDatauri once and add test case (<a href="https://redirect.github.com/svg/svgo/issues/2053">#2053</a>)</li> <li><a href="https://github.com/svg/svgo/commit/65548f48e30bf123475ae4ca7ab21220703cb42a"><code>65548f4</code></a> fix(convertPathData): properly handle consecutive t commands (<a href="https://redirect.github.com/svg/svgo/issues/2156">#2156</a>)</li> <li><a href="https://github.com/svg/svgo/commit/a41a7c15b2243b944c5087e56575baa2e6e9fcc1"><code>a41a7c1</code></a> fix(convertPathData): introducing isSafeToRemove (<a href="https://redirect.github.com/svg/svgo/issues/2164">#2164</a>)</li> <li><a href="https://github.com/svg/svgo/commit/38625dd1bd426289f9985ee366132e620f932dcc"><code>38625dd</code></a> test: handle charm icons (<a href="https://redirect.github.com/svg/svgo/issues/2203">#2203</a>)</li> <li>See full diff in <a href="https://github.com/svg/svgo/compare/v4.0.1...v4.0.2">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=svgo&package-manager=npm_and_yarn&previous-version=4.0.1&new-version=4.0.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/devops-thiago/ThrillhouseBot/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps the quarkus group with 2 updates: [io.quarkus.platform:quarkus-bom](https://github.com/quarkusio/quarkus-platform) and [io.quarkus.platform:quarkus-maven-plugin](https://github.com/quarkusio/quarkus-platform). Updates `io.quarkus.platform:quarkus-bom` from 3.37.3 to 3.37.4 <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/quarkusio/quarkus-platform/commit/a621edf4c0b4175458f3bbbe56898459a253c30b"><code>a621edf</code></a> [maven-release-plugin] prepare release 3.37.4</li> <li><a href="https://github.com/quarkusio/quarkus-platform/commit/b132d008940a264e32da8e7b31c3de9fd50b52a2"><code>b132d00</code></a> Merge pull request <a href="https://redirect.github.com/quarkusio/quarkus-platform/issues/2073">#2073</a> from quarkusio/quarkus-3.37.4</li> <li><a href="https://github.com/quarkusio/quarkus-platform/commit/1bfeab9f9567a14fbdef5c0eafe352e79541435c"><code>1bfeab9</code></a> Upgrade to Quarkus 3.37.4</li> <li><a href="https://github.com/quarkusio/quarkus-platform/commit/a7b142b33debe4be440073f386ebc3f796523f23"><code>a7b142b</code></a> Merge pull request <a href="https://redirect.github.com/quarkusio/quarkus-platform/issues/2068">#2068</a> from quarkusio/update-automation/3.37-quarkus-flow-0...</li> <li><a href="https://github.com/quarkusio/quarkus-platform/commit/0120d0cbede114594186905537526bf981f6cd9f"><code>0120d0c</code></a> Update Quarkus Flow to 0.13.0</li> <li><a href="https://github.com/quarkusio/quarkus-platform/commit/8f0f6dfdf1cc7f4e2c7088e8e3cea5fea21d18c3"><code>8f0f6df</code></a> [maven-release-plugin] prepare for next development iteration</li> <li>See full diff in <a href="https://github.com/quarkusio/quarkus-platform/compare/3.37.3...3.37.4">compare view</a></li> </ul> </details> <br /> Updates `io.quarkus.platform:quarkus-maven-plugin` from 3.37.3 to 3.37.4 <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/quarkusio/quarkus-platform/commit/a621edf4c0b4175458f3bbbe56898459a253c30b"><code>a621edf</code></a> [maven-release-plugin] prepare release 3.37.4</li> <li><a href="https://github.com/quarkusio/quarkus-platform/commit/b132d008940a264e32da8e7b31c3de9fd50b52a2"><code>b132d00</code></a> Merge pull request <a href="https://redirect.github.com/quarkusio/quarkus-platform/issues/2073">#2073</a> from quarkusio/quarkus-3.37.4</li> <li><a href="https://github.com/quarkusio/quarkus-platform/commit/1bfeab9f9567a14fbdef5c0eafe352e79541435c"><code>1bfeab9</code></a> Upgrade to Quarkus 3.37.4</li> <li><a href="https://github.com/quarkusio/quarkus-platform/commit/a7b142b33debe4be440073f386ebc3f796523f23"><code>a7b142b</code></a> Merge pull request <a href="https://redirect.github.com/quarkusio/quarkus-platform/issues/2068">#2068</a> from quarkusio/update-automation/3.37-quarkus-flow-0...</li> <li><a href="https://github.com/quarkusio/quarkus-platform/commit/0120d0cbede114594186905537526bf981f6cd9f"><code>0120d0c</code></a> Update Quarkus Flow to 0.13.0</li> <li><a href="https://github.com/quarkusio/quarkus-platform/commit/8f0f6dfdf1cc7f4e2c7088e8e3cea5fea21d18c3"><code>8f0f6df</code></a> [maven-release-plugin] prepare for next development iteration</li> <li>See full diff in <a href="https://github.com/quarkusio/quarkus-platform/compare/3.37.3...3.37.4">compare view</a></li> </ul> </details> <br /> Updates `io.quarkus.platform:quarkus-maven-plugin` from 3.37.3 to 3.37.4 <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/quarkusio/quarkus-platform/commit/a621edf4c0b4175458f3bbbe56898459a253c30b"><code>a621edf</code></a> [maven-release-plugin] prepare release 3.37.4</li> <li><a href="https://github.com/quarkusio/quarkus-platform/commit/b132d008940a264e32da8e7b31c3de9fd50b52a2"><code>b132d00</code></a> Merge pull request <a href="https://redirect.github.com/quarkusio/quarkus-platform/issues/2073">#2073</a> from quarkusio/quarkus-3.37.4</li> <li><a href="https://github.com/quarkusio/quarkus-platform/commit/1bfeab9f9567a14fbdef5c0eafe352e79541435c"><code>1bfeab9</code></a> Upgrade to Quarkus 3.37.4</li> <li><a href="https://github.com/quarkusio/quarkus-platform/commit/a7b142b33debe4be440073f386ebc3f796523f23"><code>a7b142b</code></a> Merge pull request <a href="https://redirect.github.com/quarkusio/quarkus-platform/issues/2068">#2068</a> from quarkusio/update-automation/3.37-quarkus-flow-0...</li> <li><a href="https://github.com/quarkusio/quarkus-platform/commit/0120d0cbede114594186905537526bf981f6cd9f"><code>0120d0c</code></a> Update Quarkus Flow to 0.13.0</li> <li><a href="https://github.com/quarkusio/quarkus-platform/commit/8f0f6dfdf1cc7f4e2c7088e8e3cea5fea21d18c3"><code>8f0f6df</code></a> [maven-release-plugin] prepare for next development iteration</li> <li>See full diff in <a href="https://github.com/quarkusio/quarkus-platform/compare/3.37.3...3.37.4">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…dates (#414) Bumps the npm-minor-patch group in /frontend with 3 updates: [next](https://github.com/vercel/next.js), [react](https://github.com/react/react/tree/HEAD/packages/react) and [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom). Updates `next` from 16.2.10 to 16.2.11 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/vercel/next.js/releases">next's releases</a>.</em></p> <blockquote> <h2>v16.2.11</h2> <p>This release contains security fixes for the following advisories:</p> <p>High:</p> <ul> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-m99w-x7hq-7vfj">Denial of Service in App Router using Server Actions</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-6gpp-xcg3-4w24">Middleware / Proxy bypass in App Router applications using Turbopack and single locale</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-p9j2-gv94-2wf4">Server-Side Request Forgery in rewrites via attacker-controlled destination hostname</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-89xv-2m56-2m9x">Server-Side Request Forgery in Server Actions on custom servers</a></li> </ul> <p>Moderate:</p> <ul> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-68g3-v927-f742">Cache confusion of response bodies for requests with bodies</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-4633-3j49-mh5q">Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-q8wf-6r8g-63ch">Denial of Service in the Image Optimization API using SVGs</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-955p-x3mx-jcvp">Unauthenticated disclosure of internal Server Function endpoints</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-4c39-4ccg-62r3">Unbounded Server Action payload in Edge runtime</a></li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/vercel/next.js/commit/9beca0821cf4606ae33466ed6f4fc75f2887a4da"><code>9beca08</code></a> v16.2.11</li> <li><a href="https://github.com/vercel/next.js/commit/3c48c7af78f2c01691065cb303da1b107a2c8617"><code>3c48c7a</code></a> [16.x] Fix Turbopack middleware matcher with i18n single locale</li> <li><a href="https://github.com/vercel/next.js/commit/ac1eff3f7a7285176396ecc69c3b160a3d6ad1a2"><code>ac1eff3</code></a> [16.x] Improve performance of checking valid MPA form submissions</li> <li><a href="https://github.com/vercel/next.js/commit/9a4651e754f70b12e397694ffc41f44c3ba8cc17"><code>9a4651e</code></a> [16.x] Enforce <code>serverActions.bodySizeLimit</code> for Server Actions in Edge runtime</li> <li><a href="https://github.com/vercel/next.js/commit/b51206321854193208c0805ba42acc49287f942b"><code>b512063</code></a> [16.x] Set correct origin for internal redirects in custom server</li> <li><a href="https://github.com/vercel/next.js/commit/d3033266c6dff23f7be71e19341fe3a8c6e2c599"><code>d303326</code></a> [16.x] Ensure exotic rewrite param values are properly encoded</li> <li><a href="https://github.com/vercel/next.js/commit/73b94872bc343d09494b50394d8c08eb9fc8e56a"><code>73b9487</code></a> [16.x] fix(fetch-cache): key fetch(Request, init) by the effective request</li> <li><a href="https://github.com/vercel/next.js/commit/bf9d17fb30501829f6fd7c0ee8e44e2794565742"><code>bf9d17f</code></a> [16.x] fix(incremental-cache): byte-exact fetch cache key for binary bodies</li> <li><a href="https://github.com/vercel/next.js/commit/fe28768f533582ea8f6ee7d7a7498715927d45f5"><code>fe28768</code></a> [16.x] fix(next/image): improve performance of detectContentType()</li> <li><a href="https://github.com/vercel/next.js/commit/d8afb8d550ac4ac5c106ea1410c3af43eaf1d469"><code>d8afb8d</code></a> [16.x] Performance improvements when decoding React Server function payloads</li> <li>Additional commits viewable in <a href="https://github.com/vercel/next.js/compare/v16.2.10...v16.2.11">compare view</a></li> </ul> </details> <br /> Updates `react` from 19.2.7 to 19.2.8 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/react/react/releases">react's releases</a>.</em></p> <blockquote> <h2>19.2.8 (July 21st, 2026)</h2> <h2>React Server Components</h2> <ul> <li>Performance improvements when decoding (<a href="https://redirect.github.com/facebook/react/pull/37087">#37087</a> by <a href="https://github.com/eps1lon"><code>@eps1lon</code></a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/react/react/commit/1dd4ecbdabf826f527fc9a58c05ea70375b7d170"><code>1dd4ecb</code></a> [FlightReply] Performance improvements when decoding (<a href="https://github.com/react/react/tree/HEAD/packages/react/issues/37087">#37087</a>)</li> <li><a href="https://github.com/react/react/commit/b0d2fdb78bdfae075a7fa02ddcebbf25f90952c2"><code>b0d2fdb</code></a> [19.2.x] Update required references to GitHub repo (<a href="https://github.com/react/react/tree/HEAD/packages/react/issues/36753">#36753</a>)</li> <li>See full diff in <a href="https://github.com/react/react/commits/v19.2.8/packages/react">compare view</a></li> </ul> </details> <br /> Updates `react-dom` from 19.2.7 to 19.2.8 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/react/react/releases">react-dom's releases</a>.</em></p> <blockquote> <h2>19.2.8 (July 21st, 2026)</h2> <h2>React Server Components</h2> <ul> <li>Performance improvements when decoding (<a href="https://redirect.github.com/facebook/react/pull/37087">#37087</a> by <a href="https://github.com/eps1lon"><code>@eps1lon</code></a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/react/react/commit/1dd4ecbdabf826f527fc9a58c05ea70375b7d170"><code>1dd4ecb</code></a> [FlightReply] Performance improvements when decoding (<a href="https://github.com/react/react/tree/HEAD/packages/react-dom/issues/37087">#37087</a>)</li> <li><a href="https://github.com/react/react/commit/b0d2fdb78bdfae075a7fa02ddcebbf25f90952c2"><code>b0d2fdb</code></a> [19.2.x] Update required references to GitHub repo (<a href="https://github.com/react/react/tree/HEAD/packages/react-dom/issues/36753">#36753</a>)</li> <li>See full diff in <a href="https://github.com/react/react/commits/v19.2.8/packages/react-dom">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

#415) Bumps the docs-minor-patch group in /website with 2 updates: [@astrojs/starlight](https://github.com/withastro/starlight/tree/HEAD/packages/starlight) and [astro](https://github.com/withastro/astro/tree/HEAD/packages/astro). Updates `@astrojs/starlight` from 0.41.3 to 0.41.4 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/withastro/starlight/releases">@astrojs/starlight's releases</a>.</em></p> <blockquote> <h2><code>@astrojs/starlight</code><a href="https://github.com/0"><code>@0</code></a>.41.4</h2> <h3>Patch Changes</h3> <ul> <li> <p><a href="https://redirect.github.com/withastro/starlight/pull/3936">#3936</a> <a href="https://github.com/withastro/starlight/commit/712eedd8e0d28329feb361edc392438f37ba2095"><code>712eedd</code></a> Thanks <a href="https://github.com/miichom"><code>@miichom</code></a>! - Fixes support for modifying Zod enums when passing an <a href="https://starlight.astro.build/reference/frontmatter/#extend"><code>extend</code> option</a> to Starlight’s <code>docsSchema()</code></p> </li> <li> <p><a href="https://redirect.github.com/withastro/starlight/pull/4092">#4092</a> <a href="https://github.com/withastro/starlight/commit/0896b91607325b9d8494eb665cd1716a40025a5a"><code>0896b91</code></a> Thanks <a href="https://github.com/delucis"><code>@delucis</code></a>! - Fixes support for links containing a protocol like <code>mailto:</code> in the sidebar</p> </li> <li> <p><a href="https://redirect.github.com/withastro/starlight/pull/4088">#4088</a> <a href="https://github.com/withastro/starlight/commit/4486ba432afe9e206f0b05651de24a9c25bdf6dd"><code>4486ba4</code></a> Thanks <a href="https://github.com/delucis"><code>@delucis</code></a>! - Simplifies Starlight’s client-side sidebar state persistence script slightly</p> </li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/withastro/starlight/blob/main/packages/starlight/CHANGELOG.md">@astrojs/starlight's changelog</a>.</em></p> <blockquote> <h2>0.41.4</h2> <h3>Patch Changes</h3> <ul> <li> <p><a href="https://redirect.github.com/withastro/starlight/pull/3936">#3936</a> <a href="https://github.com/withastro/starlight/commit/712eedd8e0d28329feb361edc392438f37ba2095"><code>712eedd</code></a> Thanks <a href="https://github.com/miichom"><code>@miichom</code></a>! - Fixes support for modifying Zod enums when passing an <a href="https://starlight.astro.build/reference/frontmatter/#extend"><code>extend</code> option</a> to Starlight’s <code>docsSchema()</code></p> </li> <li> <p><a href="https://redirect.github.com/withastro/starlight/pull/4092">#4092</a> <a href="https://github.com/withastro/starlight/commit/0896b91607325b9d8494eb665cd1716a40025a5a"><code>0896b91</code></a> Thanks <a href="https://github.com/delucis"><code>@delucis</code></a>! - Fixes support for links containing a protocol like <code>mailto:</code> in the sidebar</p> </li> <li> <p><a href="https://redirect.github.com/withastro/starlight/pull/4088">#4088</a> <a href="https://github.com/withastro/starlight/commit/4486ba432afe9e206f0b05651de24a9c25bdf6dd"><code>4486ba4</code></a> Thanks <a href="https://github.com/delucis"><code>@delucis</code></a>! - Simplifies Starlight’s client-side sidebar state persistence script slightly</p> </li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/withastro/starlight/commit/ab2792bd38fb90ecbaf54d9956ed6834628a2718"><code>ab2792b</code></a> [ci] release (<a href="https://github.com/withastro/starlight/tree/HEAD/packages/starlight/issues/4090">#4090</a>)</li> <li><a href="https://github.com/withastro/starlight/commit/712eedd8e0d28329feb361edc392438f37ba2095"><code>712eedd</code></a> fix: invalid option error when modifying enums in docsSchema's extend (<a href="https://github.com/withastro/starlight/tree/HEAD/packages/starlight/issues/3936">#3936</a>)</li> <li><a href="https://github.com/withastro/starlight/commit/0896b91607325b9d8494eb665cd1716a40025a5a"><code>0896b91</code></a> Support links with any protocol in sidebars (<a href="https://github.com/withastro/starlight/tree/HEAD/packages/starlight/issues/4092">#4092</a>)</li> <li><a href="https://github.com/withastro/starlight/commit/4486ba432afe9e206f0b05651de24a9c25bdf6dd"><code>4486ba4</code></a> Remove pagehide event from sidebar persistence script (<a href="https://github.com/withastro/starlight/tree/HEAD/packages/starlight/issues/4088">#4088</a>)</li> <li>See full diff in <a href="https://github.com/withastro/starlight/commits/@astrojs/starlight@0.41.4/packages/starlight">compare view</a></li> </ul> </details> <br /> Updates `astro` from 7.1.1 to 7.1.3 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/withastro/astro/releases">astro's releases</a>.</em></p> <blockquote> <h2>astro@7.1.3</h2> <h3>Patch Changes</h3> <ul> <li><a href="https://redirect.github.com/withastro/astro/pull/17427">#17427</a> <a href="https://github.com/withastro/astro/commit/630b382ce3303c350154338e59cb5444c5316764"><code>630b382</code></a> Thanks <a href="https://github.com/astrobot-houston"><code>@astrobot-houston</code></a>! - Fixes image optimization during <code>astro build</code> using too many parallel processes in CPU-limited containers. Builds now respect the container's CPU limit, reducing peak memory usage and avoiding out-of-memory crashes.  </li> </ul> <h2>astro@7.1.2</h2> <h3>Patch Changes</h3> <ul> <li> <p><a href="https://redirect.github.com/withastro/astro/pull/17445">#17445</a> <a href="https://github.com/withastro/astro/commit/a5f7230d1caf41ef1e94f9a6b9f6ee01d332455c"><code>a5f7230</code></a> Thanks <a href="https://github.com/ocavue"><code>@ocavue</code></a>! - Updates dependency <code>cookie</code> to v2. Cookie values made entirely of URL-safe characters are no longer percent-encoded in <code>Set-Cookie</code> headers; encoded values round-trip exactly as before.</p> </li> <li> <p><a href="https://redirect.github.com/withastro/astro/pull/17402">#17402</a> <a href="https://github.com/withastro/astro/commit/a89c137a424b4d7bf97df067bba023eccc2317eb"><code>a89c137</code></a> Thanks <a href="https://github.com/farrosfr"><code>@farrosfr</code></a>! - Fixes a bug where mutated <code>Astro.locals</code> during the request lifecycle are lost and not passed to custom error pages (<code>404.astro</code>/<code>500.astro</code>)</p> </li> <li> <p><a href="https://redirect.github.com/withastro/astro/pull/17405">#17405</a> <a href="https://github.com/withastro/astro/commit/91992ef2ccd9a90fa4270633eb4f5d3b811bf315"><code>91992ef</code></a> Thanks <a href="https://github.com/Araluma"><code>@Araluma</code></a>! - Prevents an unhandled promise rejection from the prefetch <code>fetch</code> fallback. In WebKit (Safari), <code><link rel="prefetch"></code> is unsupported, so prefetch uses the <code>fetch()</code> fallback; on a flaky connection that fetch rejects with <code>TypeError: Load failed</code>, and because the promise was not awaited or caught, it surfaced as an unhandled rejection to the page's global error handlers. The best-effort prefetch now swallows the failure with <code>.catch()</code>.</p> </li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/withastro/astro/blob/main/packages/astro/CHANGELOG.md">astro's changelog</a>.</em></p> <blockquote> <h2>7.1.3</h2> <h3>Patch Changes</h3> <ul> <li><a href="https://redirect.github.com/withastro/astro/pull/17427">#17427</a> <a href="https://github.com/withastro/astro/commit/630b382ce3303c350154338e59cb5444c5316764"><code>630b382</code></a> Thanks <a href="https://github.com/astrobot-houston"><code>@astrobot-houston</code></a>! - Fixes image optimization during <code>astro build</code> using too many parallel processes in CPU-limited containers. Builds now respect the container's CPU limit, reducing peak memory usage and avoiding out-of-memory crashes.  </li> </ul> <h2>7.1.2</h2> <h3>Patch Changes</h3> <ul> <li> <p><a href="https://redirect.github.com/withastro/astro/pull/17445">#17445</a> <a href="https://github.com/withastro/astro/commit/a5f7230d1caf41ef1e94f9a6b9f6ee01d332455c"><code>a5f7230</code></a> Thanks <a href="https://github.com/ocavue"><code>@ocavue</code></a>! - Updates dependency <code>cookie</code> to v2. Cookie values made entirely of URL-safe characters are no longer percent-encoded in <code>Set-Cookie</code> headers; encoded values round-trip exactly as before.</p> </li> <li> <p><a href="https://redirect.github.com/withastro/astro/pull/17402">#17402</a> <a href="https://github.com/withastro/astro/commit/a89c137a424b4d7bf97df067bba023eccc2317eb"><code>a89c137</code></a> Thanks <a href="https://github.com/farrosfr"><code>@farrosfr</code></a>! - Fixes a bug where mutated <code>Astro.locals</code> during the request lifecycle are lost and not passed to custom error pages (<code>404.astro</code>/<code>500.astro</code>)</p> </li> <li> <p><a href="https://redirect.github.com/withastro/astro/pull/17405">#17405</a> <a href="https://github.com/withastro/astro/commit/91992ef2ccd9a90fa4270633eb4f5d3b811bf315"><code>91992ef</code></a> Thanks <a href="https://github.com/Araluma"><code>@Araluma</code></a>! - Prevents an unhandled promise rejection from the prefetch <code>fetch</code> fallback. In WebKit (Safari), <code><link rel="prefetch"></code> is unsupported, so prefetch uses the <code>fetch()</code> fallback; on a flaky connection that fetch rejects with <code>TypeError: Load failed</code>, and because the promise was not awaited or caught, it surfaced as an unhandled rejection to the page's global error handlers. The best-effort prefetch now swallows the failure with <code>.catch()</code>.</p> </li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/withastro/astro/commit/cf9ffc72258b23211eb07f4f38176756812b373d"><code>cf9ffc7</code></a> [ci] release (<a href="https://github.com/withastro/astro/tree/HEAD/packages/astro/issues/17455">#17455</a>)</li> <li><a href="https://github.com/withastro/astro/commit/630b382ce3303c350154338e59cb5444c5316764"><code>630b382</code></a> Use <code>os.availableParallelism()</code> for image optimization queue to fix OOM in CP...</li> <li><a href="https://github.com/withastro/astro/commit/8a7f7e0cece7ce2d7a5d2a104bd8607174ed5d84"><code>8a7f7e0</code></a> [ci] release (<a href="https://github.com/withastro/astro/tree/HEAD/packages/astro/issues/17411">#17411</a>)</li> <li><a href="https://github.com/withastro/astro/commit/ebbd793e859204febcf4e3aa81b95b6826a5c544"><code>ebbd793</code></a> chore(deps): update <code>astro-embed</code> (<a href="https://github.com/withastro/astro/tree/HEAD/packages/astro/issues/17436">#17436</a>)</li> <li><a href="https://github.com/withastro/astro/commit/311e42c77d689e7f7bacb7ea2e000beac6835a37"><code>311e42c</code></a> [ci] format</li> <li><a href="https://github.com/withastro/astro/commit/1d6220225cb9e0aeadabc82db5b2314372aee365"><code>1d62202</code></a> chore(deps): update <code>neotraverse</code> to v1 (<a href="https://github.com/withastro/astro/tree/HEAD/packages/astro/issues/17446">#17446</a>)</li> <li><a href="https://github.com/withastro/astro/commit/a5f7230d1caf41ef1e94f9a6b9f6ee01d332455c"><code>a5f7230</code></a> fix(astro): update <code>cookie</code> to v2 (<a href="https://github.com/withastro/astro/tree/HEAD/packages/astro/issues/17445">#17445</a>)</li> <li><a href="https://github.com/withastro/astro/commit/91992ef2ccd9a90fa4270633eb4f5d3b811bf315"><code>91992ef</code></a> fix(prefetch): swallow fetch-fallback rejection to avoid unhandled 'Load fail...</li> <li><a href="https://github.com/withastro/astro/commit/a89c137a424b4d7bf97df067bba023eccc2317eb"><code>a89c137</code></a> fix(astro): propagate mutated locals to custom error pages (<a href="https://github.com/withastro/astro/tree/HEAD/packages/astro/issues/17402">#17402</a>)</li> <li>See full diff in <a href="https://github.com/withastro/astro/commits/astro@7.1.3/packages/astro">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

… /frontend (#416) Bumps [@testing-library/jest-dom](https://github.com/testing-library/jest-dom) from 6.9.1 to 7.0.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/testing-library/jest-dom/releases">@testing-library/jest-dom's releases</a>.</em></p> <blockquote> <h2>v7.0.0</h2> <h1><a href="https://github.com/testing-library/jest-dom/compare/v6.10.0...v7.0.0">7.0.0</a> (2026-07-20)</h1> <h3>Features</h3> <ul> <li>add toContainAnyBy* and toContainOneBy* query matchers (<a href="https://github.com/testing-library/jest-dom/commit/1e39089d850408a583c83495d00d8aa27078933f">1e39089</a>)</li> </ul> <h3>BREAKING CHANGES</h3> <ul> <li><code>@testing-library/dom</code> is now a required peer dependency. The minimum supported Node.js version is now 22.</li> </ul> <p>Repaired release for <a href="https://redirect.github.com/testing-library/jest-dom/pull/731">testing-library/jest-dom#731</a></p> <h2>v6.10.0</h2> <h1><a href="https://github.com/testing-library/jest-dom/compare/v6.9.1...v6.10.0">6.10.0</a> (2026-07-20)</h1> <h3>Features</h3> <ul> <li>add toContainAnyBy* and toContainOneBy* query matchers (<a href="https://redirect.github.com/testing-library/jest-dom/issues/731">#731</a>) (<a href="https://github.com/testing-library/jest-dom/commit/cae44df901cf8e92e3febc0af6fa667b10be6d6a">cae44df</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/testing-library/jest-dom/commit/1e39089d850408a583c83495d00d8aa27078933f"><code>1e39089</code></a> feat: add toContainAnyBy* and toContainOneBy* query matchers</li> <li><a href="https://github.com/testing-library/jest-dom/commit/cae44df901cf8e92e3febc0af6fa667b10be6d6a"><code>cae44df</code></a> feat: add toContainAnyBy* and toContainOneBy* query matchers (<a href="https://redirect.github.com/testing-library/jest-dom/issues/731">#731</a>)</li> <li><a href="https://github.com/testing-library/jest-dom/commit/55c07ce5f1c489b5b9dc31a770a84d83a1178072"><code>55c07ce</code></a> ci: switch release to npm trusted publishing (<a href="https://redirect.github.com/testing-library/jest-dom/issues/726">#726</a>)</li> <li><a href="https://github.com/testing-library/jest-dom/commit/213256fa8e0aff45e47920a0bc564f708d1f67de"><code>213256f</code></a> docs: move toHaveSelection from the deprecated section (<a href="https://redirect.github.com/testing-library/jest-dom/issues/717">#717</a>)</li> <li>See full diff in <a href="https://github.com/testing-library/jest-dom/compare/v6.9.1...v7.0.0">compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new releaser for <code>@testing-library/jest-dom</code> since your current version.</p> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=@testing-library/jest-dom&package-manager=npm_and_yarn&previous-version=6.9.1&new-version=7.0.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

@ref

Bumps the actions-minor-patch group with 6 updates: | Package | From | To | | --- | --- | --- | | [actions/checkout](https://github.com/actions/checkout) | `7.0.0` | `7.0.1` | | [docker/login-action](https://github.com/docker/login-action) | `4.4.0` | `4.5.0` | | [github/codeql-action/init](https://github.com/github/codeql-action) | `4.37.1` | `4.37.3` | | [github/codeql-action/analyze](https://github.com/github/codeql-action) | `4.37.1` | `4.37.3` | | [ossf/scorecard-action](https://github.com/ossf/scorecard-action) | `2.4.3` | `2.4.4` | | [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) | `4.37.1` | `4.37.3` | Updates `actions/checkout` from 7.0.0 to 7.0.1 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/actions/checkout/releases">actions/checkout's releases</a>.</em></p> <blockquote> <h2>v7.0.1</h2> <h2>What's Changed</h2> <ul> <li>skip running unsafe pr check if input is default by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2518">actions/checkout#2518</a></li> <li>trim only ascii whitespace for branch by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2521">actions/checkout#2521</a></li> <li>escape values passed to --unset by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2530">actions/checkout#2530</a></li> <li>Various dependency updates</li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/checkout/compare/v7...v7.0.1">https://github.com/actions/checkout/compare/v7...v7.0.1</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/actions/checkout/blob/main/CHANGELOG.md">actions/checkout's changelog</a>.</em></p> <blockquote> <h1>Changelog</h1> <h2>v7.0.1</h2> <ul> <li>Skip running unsafe pr check if input is default by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2518">actions/checkout#2518</a></li> <li>Trim only ascii whitespace for branch by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2521">actions/checkout#2521</a></li> <li>Escape values passed to --unset by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2530">actions/checkout#2530</a></li> <li>Various dependency updates</li> </ul> <h2>v7.0.0</h2> <ul> <li>Block checking out fork PR for pull_request_target and workflow_run by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2454">actions/checkout#2454</a></li> <li>Various dependency updates</li> </ul> <h2>v6.0.3</h2> <ul> <li>Fix checkout init for SHA-256 repositories by <a href="https://github.com/yaananth"><code>@yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2439">actions/checkout#2439</a></li> <li>fix: expand merge commit SHA regex and add SHA-256 test cases by <a href="https://github.com/yaananth"><code>@yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout#2414</a></li> </ul> <h2>v6.0.2</h2> <ul> <li>Fix tag handling: preserve annotations and explicit fetch-tags by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2356">actions/checkout#2356</a></li> </ul> <h2>v6.0.1</h2> <ul> <li>Add worktree support for persist-credentials includeIf by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2327">actions/checkout#2327</a></li> </ul> <h2>v6.0.0</h2> <ul> <li>Persist creds to a separate file by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2286">actions/checkout#2286</a></li> <li>Update README to include Node.js 24 support details and requirements by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2248">actions/checkout#2248</a></li> </ul> <h2>v5.0.1</h2> <ul> <li>Port v6 cleanup to v5 by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2301">actions/checkout#2301</a></li> </ul> <h2>v5.0.0</h2> <ul> <li>Update actions checkout to use node 24 by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2226">actions/checkout#2226</a></li> </ul> <h2>v4.3.1</h2> <ul> <li>Port v6 cleanup to v4 by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2305">actions/checkout#2305</a></li> </ul> <h2>v4.3.0</h2> <ul> <li>docs: update README.md by <a href="https://github.com/motss"><code>@motss</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1971">actions/checkout#1971</a></li> <li>Add internal repos for checking out multiple repositories by <a href="https://github.com/mouismail"><code>@mouismail</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1977">actions/checkout#1977</a></li> <li>Documentation update - add recommended permissions to Readme by <a href="https://github.com/benwells"><code>@benwells</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2043">actions/checkout#2043</a></li> <li>Adjust positioning of user email note and permissions heading by <a href="https://github.com/joshmgross"><code>@joshmgross</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2044">actions/checkout#2044</a></li> <li>Update README.md by <a href="https://github.com/nebuk89"><code>@nebuk89</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2194">actions/checkout#2194</a></li> <li>Update CODEOWNERS for actions by <a href="https://github.com/TingluoHuang"><code>@TingluoHuang</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2224">actions/checkout#2224</a></li> <li>Update package dependencies by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2236">actions/checkout#2236</a></li> </ul> <h2>v4.2.2</h2> <ul> <li><code>url-helper.ts</code> now leverages well-known environment variables by <a href="https://github.com/jww3"><code>@jww3</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1941">actions/checkout#1941</a></li> <li>Expand unit test coverage for <code>isGhes</code> by <a href="https://github.com/jww3"><code>@jww3</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1946">actions/checkout#1946</a></li> </ul> <h2>v4.2.1</h2> <ul> <li>Check out other refs/* by commit if provided, fall back to ref by <a href="https://github.com/orhantoy"><code>@orhantoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1924">actions/checkout#1924</a></li> </ul>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/actions/checkout/commit/3d3c42e5aac5ba805825da76410c181273ba90b1"><code>3d3c42e</code></a> prep v7.0.1 release (<a href="https://redirect.github.com/actions/checkout/issues/2531">#2531</a>)</li> <li><a href="https://github.com/actions/checkout/commit/28802689a136bfcdb721715abd713740beecbe07"><code>2880268</code></a> escape values passed to --unset (<a href="https://redirect.github.com/actions/checkout/issues/2530">#2530</a>)</li> <li><a href="https://github.com/actions/checkout/commit/12cd2235efa0937479335606d7c3ac9f6c0973b1"><code>12cd223</code></a> trim only ascii whitespace for branch (<a href="https://redirect.github.com/actions/checkout/issues/2521">#2521</a>)</li> <li><a href="https://github.com/actions/checkout/commit/62661c4e71a304b2823ed026347b8d34c3eac541"><code>62661c4</code></a> skip running unsafe pr check if input is default (<a href="https://redirect.github.com/actions/checkout/issues/2518">#2518</a>)</li> <li><a href="https://github.com/actions/checkout/commit/e8d4307400f9427dba7cb98e488d6ab85f1cec5f"><code>e8d4307</code></a> Bump the minor-actions-dependencies group with 2 updates (<a href="https://redirect.github.com/actions/checkout/issues/2499">#2499</a>)</li> <li><a href="https://github.com/actions/checkout/commit/631c942040754b6e095e929c1677c07e10ed4f87"><code>631c942</code></a> eslint 9 (<a href="https://redirect.github.com/actions/checkout/issues/2474">#2474</a>)</li> <li><a href="https://github.com/actions/checkout/commit/4f1f4aec02e41874fa0262ea8ff5172d7978ad1e"><code>4f1f4ae</code></a> Bump actions/upload-artifact from 4 to 7 (<a href="https://redirect.github.com/actions/checkout/issues/2476">#2476</a>)</li> <li><a href="https://github.com/actions/checkout/commit/ba097532fb203f7e88c9c3c0b899b49469908a92"><code>ba09753</code></a> Bump actions/checkout from 6 to 7 (<a href="https://redirect.github.com/actions/checkout/issues/2488">#2488</a>)</li> <li><a href="https://github.com/actions/checkout/commit/b9e0990d219a03df7633c93f6f005a8fecbcab22"><code>b9e0990</code></a> Bump docker/login-action from 3.3.0 to 4.2.0 (<a href="https://redirect.github.com/actions/checkout/issues/2479">#2479</a>)</li> <li><a href="https://github.com/actions/checkout/commit/e8cb398be4a550817e382abf69e4c12c76fce1f2"><code>e8cb398</code></a> Bump docker/build-push-action from 6.5.0 to 7.2.0 (<a href="https://redirect.github.com/actions/checkout/issues/2478">#2478</a>)</li> <li>Additional commits viewable in <a href="https://github.com/actions/checkout/compare/9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0...3d3c42e5aac5ba805825da76410c181273ba90b1">compare view</a></li> </ul> </details> <br /> Updates `docker/login-action` from 4.4.0 to 4.5.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/docker/login-action/releases">docker/login-action's releases</a>.</em></p> <blockquote> <h2>v4.5.0</h2> <ul> <li><a href="https://github.com/docker/login-action#docker-hub">Docker Hub OIDC</a> login support by <a href="https://github.com/crazy-max"><code>@crazy-max</code></a> in <a href="https://redirect.github.com/docker/login-action/pull/1048">docker/login-action#1048</a></li> <li>Bump <code>@aws-sdk/client-ecr</code> and <code>@aws-sdk/client-ecr-public</code> to 3.1091.0 in <a href="https://redirect.github.com/docker/login-action/pull/1037">docker/login-action#1037</a></li> <li>Bump <code>@docker/actions-toolkit</code> from 0.92.0 to 0.94.0 in <a href="https://redirect.github.com/docker/login-action/pull/1044">docker/login-action#1044</a> <a href="https://redirect.github.com/docker/login-action/pull/1050">docker/login-action#1050</a></li> <li>Bump brace-expansion from 1.1.13 to 1.1.16 in <a href="https://redirect.github.com/docker/login-action/pull/1046">docker/login-action#1046</a></li> <li>Bump js-yaml from 5.2.0 to 5.2.1 in <a href="https://redirect.github.com/docker/login-action/pull/1038">docker/login-action#1038</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/docker/login-action/compare/v4.4.0...v4.5.0">https://github.com/docker/login-action/compare/v4.4.0...v4.5.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/docker/login-action/commit/06fb636fac595d6fb4b28a5dfcb21a6f5091859c"><code>06fb636</code></a> Merge pull request <a href="https://redirect.github.com/docker/login-action/issues/1037">#1037</a> from docker/dependabot/npm_and_yarn/aws-sdk-dependen...</li> <li><a href="https://github.com/docker/login-action/commit/a8bc9539118a762b0e5788b53a50907977cc1b8d"><code>a8bc953</code></a> [dependabot skip] chore: update generated content</li> <li><a href="https://github.com/docker/login-action/commit/f54b9019bf5074f6e3480a3ac4b834f5f4b90aab"><code>f54b901</code></a> build(deps): bump the aws-sdk-dependencies group across 1 directory with 2 up...</li> <li><a href="https://github.com/docker/login-action/commit/77f18f6713512f90ac35aaf21db0d3710f1b85a6"><code>77f18f6</code></a> Merge pull request <a href="https://redirect.github.com/docker/login-action/issues/1049">#1049</a> from docker/dependabot/github_actions/codeql-actions...</li> <li><a href="https://github.com/docker/login-action/commit/ec0bf287fb1e2e051c56b2f6e6a3eed487b9fe52"><code>ec0bf28</code></a> Merge pull request <a href="https://redirect.github.com/docker/login-action/issues/1050">#1050</a> from docker/dependabot/npm_and_yarn/docker/actions-t...</li> <li><a href="https://github.com/docker/login-action/commit/e37171e542c984d6f049d8c0d7b721b547543ac5"><code>e37171e</code></a> [dependabot skip] chore: update generated content</li> <li><a href="https://github.com/docker/login-action/commit/1d3a7174ca4bd9e2b690436a1881f5f7efe4c721"><code>1d3a717</code></a> build(deps): bump <code>@docker/actions-toolkit</code> from 0.93.0 to 0.94.0</li> <li><a href="https://github.com/docker/login-action/commit/a5e9150fe2b6b46ec72b4db4299ca9ee6beb3a8c"><code>a5e9150</code></a> Merge pull request <a href="https://redirect.github.com/docker/login-action/issues/1048">#1048</a> from docker/dockerhub-oidc-support</li> <li><a href="https://github.com/docker/login-action/commit/a482ba436657541c8b1e3d797588d3bfe18528a5"><code>a482ba4</code></a> build(deps): bump the codeql-actions group with 2 updates</li> <li><a href="https://github.com/docker/login-action/commit/9e3d36ea10fc98cc724dfc97ac0940e0e7ef258c"><code>9e3d36e</code></a> chore: update generated content</li> <li>Additional commits viewable in <a href="https://github.com/docker/login-action/compare/af1e73f918a031802d376d3c8bbc3fe56130a9b0...06fb636fac595d6fb4b28a5dfcb21a6f5091859c">compare view</a></li> </ul> </details> <br /> Updates `github/codeql-action/init` from 4.37.1 to 4.37.3 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/releases">github/codeql-action/init's releases</a>.</em></p> <blockquote> <h2>v4.37.3</h2> <p>No user facing changes.</p> <h2>v4.37.2</h2> <ul> <li>The new address format for the <code>config-file</code> input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the <code>remote=</code> prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. <a href="https://redirect.github.com/github/codeql-action/pull/4023">#4023</a></li> <li>The CodeQL Action can now make use of <a href="https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries">configured private registries</a> in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. <a href="https://redirect.github.com/github/codeql-action/pull/4007">#4007</a></li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action/init's changelog</a>.</em></p> <blockquote> <h1>CodeQL Action Changelog</h1> <p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p> <h2>[UNRELEASED]</h2> <p>No user facing changes.</p> <h2>4.37.3 - 22 Jul 2026</h2> <p>No user facing changes.</p> <h2>4.37.2 - 21 Jul 2026</h2> <ul> <li>The new address format for the <code>config-file</code> input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the <code>remote=</code> prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. <a href="https://redirect.github.com/github/codeql-action/pull/4023">#4023</a></li> <li>The CodeQL Action can now make use of <a href="https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries">configured private registries</a> in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. <a href="https://redirect.github.com/github/codeql-action/pull/4007">#4007</a></li> </ul> <h2>4.37.1 - 16 Jul 2026</h2> <ul> <li><em>Upcoming breaking change</em>: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. <a href="https://redirect.github.com/github/codeql-action/pull/3956">#3956</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1">2.26.1</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4019">#4019</a></li> </ul> <h2>4.37.0 - 08 Jul 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0">2.26.0</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3995">#3995</a></li> <li>In addition to the existing input format, the <code>config-file</code> input for the <code>codeql-action/init</code> step will soon support a new <code>[owner/]repo[@ref][:path]</code> format. All components except the repository name are optional. If omitted, <code>owner</code> defaults to the same owner as the repository the analysis is running for, <code>ref</code> to <code>main</code>, and <code>path</code> to <code>.github/codeql-action.yaml</code>. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. <a href="https://redirect.github.com/github/codeql-action/pull/3973">#3973</a></li> </ul> <h2>4.36.3 - 01 Jul 2026</h2> <p>No user facing changes.</p> <h2>4.36.2 - 04 Jun 2026</h2> <ul> <li>Cache CodeQL CLI version information across Actions steps. <a href="https://redirect.github.com/github/codeql-action/pull/3943">#3943</a></li> <li>Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. <a href="https://redirect.github.com/github/codeql-action/pull/3937">#3937</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.6">2.25.6</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3948">#3948</a></li> </ul> <h2>4.36.1 - 02 Jun 2026</h2> <p>No user facing changes.</p> <h2>4.36.0 - 22 May 2026</h2> <ul> <li><em>Breaking change</em>: Bump the minimum required CodeQL bundle version to 2.19.4. <a href="https://redirect.github.com/github/codeql-action/pull/3894">#3894</a></li> <li>Add support for SHA-256 Git object IDs. <a href="https://redirect.github.com/github/codeql-action/pull/3893">#3893</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.5">2.25.5</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3926">#3926</a></li> </ul> <h2>4.35.5 - 15 May 2026</h2> <ul> <li>We have improved how the JavaScript bundles for the CodeQL Action are generated to avoid duplication across bundles and reduce the size of the repository by around 70%. This should have no effect on the runtime behaviour of the CodeQL Action. <a href="https://redirect.github.com/github/codeql-action/pull/3899">#3899</a></li> </ul>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/github/codeql-action/commit/e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81"><code>e4fba86</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4031">#4031</a> from github/update-v4.37.3-72f6a9da0</li> <li><a href="https://github.com/github/codeql-action/commit/fb50ab5d62a274adf3ef3e22cfe750ae87a0ede7"><code>fb50ab5</code></a> Update changelog for v4.37.3</li> <li><a href="https://github.com/github/codeql-action/commit/72f6a9da0def52d9193d6a758f0378b65091f8d1"><code>72f6a9d</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4030">#4030</a> from github/mbg/fix/no-proxy</li> <li><a href="https://github.com/github/codeql-action/commit/3b5ee58597653d9cc6785f3f1277f796d81f3646"><code>3b5ee58</code></a> Use default <code>request</code> options instead of <code>undefined</code></li> <li><a href="https://github.com/github/codeql-action/commit/bfb6be4b5ecd3650f02f530571453e8c64ef0778"><code>bfb6be4</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4028">#4028</a> from github/mergeback/v4.37.2-to-main-e0647621</li> <li><a href="https://github.com/github/codeql-action/commit/526ab84f9858816d9cf5f7b9df4dd5e2235f0eba"><code>526ab84</code></a> Rebuild</li> <li><a href="https://github.com/github/codeql-action/commit/d6217b9b8c14166e4851db94c11155d03bd13c07"><code>d6217b9</code></a> Update changelog and version after v4.37.2</li> <li><a href="https://github.com/github/codeql-action/commit/e0647621c2984b5ed2f768cb892365bf2a616ad1"><code>e064762</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4027">#4027</a> from github/update-v4.37.2-385bcdc5a</li> <li><a href="https://github.com/github/codeql-action/commit/e0faed839190caa67a5cd42f1cc16246028ca3df"><code>e0faed8</code></a> Add a couple of change notes</li> <li><a href="https://github.com/github/codeql-action/commit/73aad0eaa9df172668665a150d17b8bc5a650c20"><code>73aad0e</code></a> Update changelog for v4.37.2</li> <li>Additional commits viewable in <a href="https://github.com/github/codeql-action/compare/7188fc363630916deb702c7fdcf4e481b751f97a...e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81">compare view</a></li> </ul> </details> <br /> Updates `github/codeql-action/analyze` from 4.37.1 to 4.37.3 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/releases">github/codeql-action/analyze's releases</a>.</em></p> <blockquote> <h2>v4.37.3</h2> <p>No user facing changes.</p> <h2>v4.37.2</h2> <ul> <li>The new address format for the <code>config-file</code> input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the <code>remote=</code> prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. <a href="https://redirect.github.com/github/codeql-action/pull/4023">#4023</a></li> <li>The CodeQL Action can now make use of <a href="https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries">configured private registries</a> in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. <a href="https://redirect.github.com/github/codeql-action/pull/4007">#4007</a></li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action/analyze's changelog</a>.</em></p> <blockquote> <h1>CodeQL Action Changelog</h1> <p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p> <h2>[UNRELEASED]</h2> <p>No user facing changes.</p> <h2>4.37.3 - 22 Jul 2026</h2> <p>No user facing changes.</p> <h2>4.37.2 - 21 Jul 2026</h2> <ul> <li>The new address format for the <code>config-file</code> input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the <code>remote=</code> prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. <a href="https://redirect.github.com/github/codeql-action/pull/4023">#4023</a></li> <li>The CodeQL Action can now make use of <a href="https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries">configured private registries</a> in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. <a href="https://redirect.github.com/github/codeql-action/pull/4007">#4007</a></li> </ul> <h2>4.37.1 - 16 Jul 2026</h2> <ul> <li><em>Upcoming breaking change</em>: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. <a href="https://redirect.github.com/github/codeql-action/pull/3956">#3956</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1">2.26.1</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4019">#4019</a></li> </ul> <h2>4.37.0 - 08 Jul 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0">2.26.0</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3995">#3995</a></li> <li>In addition to the existing input format, the <code>config-file</code> input for the <code>codeql-action/init</code> step will soon support a new <code>[owner/]repo[@ref][:path]</code> format. All components except the repository name are optional. If omitted, <code>owner</code> defaults to the same owner as the repository the analysis is running for, <code>ref</code> to <code>main</code>, and <code>path</code> to <code>.github/codeql-action.yaml</code>. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. <a href="https://redirect.github.com/github/codeql-action/pull/3973">#3973</a></li> </ul> <h2>4.36.3 - 01 Jul 2026</h2> <p>No user facing changes.</p> <h2>4.36.2 - 04 Jun 2026</h2> <ul> <li>Cache CodeQL CLI version information across Actions steps. <a href="https://redirect.github.com/github/codeql-action/pull/3943">#3943</a></li> <li>Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. <a href="https://redirect.github.com/github/codeql-action/pull/3937">#3937</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.6">2.25.6</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3948">#3948</a></li> </ul> <h2>4.36.1 - 02 Jun 2026</h2> <p>No user facing changes.</p> <h2>4.36.0 - 22 May 2026</h2> <ul> <li><em>Breaking change</em>: Bump the minimum required CodeQL bundle version to 2.19.4. <a href="https://redirect.github.com/github/codeql-action/pull/3894">#3894</a></li> <li>Add support for SHA-256 Git object IDs. <a href="https://redirect.github.com/github/codeql-action/pull/3893">#3893</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.5">2.25.5</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3926">#3926</a></li> </ul> <h2>4.35.5 - 15 May 2026</h2> <ul> <li>We have improved how the JavaScript bundles for the CodeQL Action are generated to avoid duplication across bundles and reduce the size of the repository by around 70%. This should have no effect on the runtime behaviour of the CodeQL Action. <a href="https://redirect.github.com/github/codeql-action/pull/3899">#3899</a></li> </ul>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/github/codeql-action/commit/e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81"><code>e4fba86</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4031">#4031</a> from github/update-v4.37.3-72f6a9da0</li> <li><a href="https://github.com/github/codeql-action/commit/fb50ab5d62a274adf3ef3e22cfe750ae87a0ede7"><code>fb50ab5</code></a> Update changelog for v4.37.3</li> <li><a href="https://github.com/github/codeql-action/commit/72f6a9da0def52d9193d6a758f0378b65091f8d1"><code>72f6a9d</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4030">#4030</a> from github/mbg/fix/no-proxy</li> <li><a href="https://github.com/github/codeql-action/commit/3b5ee58597653d9cc6785f3f1277f796d81f3646"><code>3b5ee58</code></a> Use default <code>request</code> options instead of <code>undefined</code></li> <li><a href="https://github.com/github/codeql-action/commit/bfb6be4b5ecd3650f02f530571453e8c64ef0778"><code>bfb6be4</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4028">#4028</a> from github/mergeback/v4.37.2-to-main-e0647621</li> <li><a href="https://github.com/github/codeql-action/commit/526ab84f9858816d9cf5f7b9df4dd5e2235f0eba"><code>526ab84</code></a> Rebuild</li> <li><a href="https://github.com/github/codeql-action/commit/d6217b9b8c14166e4851db94c11155d03bd13c07"><code>d6217b9</code></a> Update changelog and version after v4.37.2</li> <li><a href="https://github.com/github/codeql-action/commit/e0647621c2984b5ed2f768cb892365bf2a616ad1"><code>e064762</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4027">#4027</a> from github/update-v4.37.2-385bcdc5a</li> <li><a href="https://github.com/github/codeql-action/commit/e0faed839190caa67a5cd42f1cc16246028ca3df"><code>e0faed8</code></a> Add a couple of change notes</li> <li><a href="https://github.com/github/codeql-action/commit/73aad0eaa9df172668665a150d17b8bc5a650c20"><code>73aad0e</code></a> Update changelog for v4.37.2</li> <li>Additional commits viewable in <a href="https://github.com/github/codeql-action/compare/7188fc363630916deb702c7fdcf4e481b751f97a...e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81">compare view</a></li> </ul> </details> <br /> Updates `ossf/scorecard-action` from 2.4.3 to 2.4.4 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/ossf/scorecard-action/releases">ossf/scorecard-action's releases</a>.</em></p> <blockquote> <h2>v2.4.4</h2> <h2>What's Changed</h2> <p>This update bumps the Scorecard version to the v5.5.0 release. For a complete list of changes, please refer to the <a href="https://github.com/ossf/scorecard/releases/tag/v5.4.0">Scorecard v5.4.0 release notes</a> and the <a href="https://github.com/ossf/scorecard/releases/tag/v5.5.0">Scorecard v5.5.0 release notes</a>.</p> <ul> <li>log POST failures instead of failing entire action by <a href="https://github.com/spencerschrock"><code>@spencerschrock</code></a> in <a href="https://redirect.github.com/ossf/scorecard-action/pull/1625">ossf/scorecard-action#1625</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/ossf/scorecard-action/compare/v2.4.3...v2.4.4">https://github.com/ossf/scorecard-action/compare/v2.4.3...v2.4.4</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/ossf/scorecard-action/commit/2d1146689b8cda280b9bc96326124645441f03bc"><code>2d11466</code></a> Bump action tag for v2.4.4 release (<a href="https://redirect.github.com/ossf/scorecard-action/issues/1688">#1688</a>)</li> <li><a href="https://github.com/ossf/scorecard-action/commit/1bd3285473b114fb77ed934c4ba0aea31aa0f866"><code>1bd3285</code></a> :seedling: Bump the docker-images group across 1 directory with 2 updates (<a href="https://redirect.github.com/ossf/scorecard-action/issues/1">#1</a>...</li> <li><a href="https://github.com/ossf/scorecard-action/commit/913edce4c1ce57261797e2ddcb74e493d9ce9700"><code>913edce</code></a> :seedling: Bump github.com/containerd/containerd from 1.7.32 to 1.7.33 (<a href="https://redirect.github.com/ossf/scorecard-action/issues/1671">#1671</a>)</li> <li><a href="https://github.com/ossf/scorecard-action/commit/0957b8f1c327cafd868bd6bdb7e441c016628783"><code>0957b8f</code></a> :seedling: Bump golang.org/x/net from 0.56.0 to 0.57.0 (<a href="https://redirect.github.com/ossf/scorecard-action/issues/1680">#1680</a>)</li> <li><a href="https://github.com/ossf/scorecard-action/commit/f0061eb3ff8c4d311e47276c8bcc96e96ed5dc32"><code>f0061eb</code></a> :seedling: Bump google.golang.org/grpc from 1.81.1 to 1.82.1 (<a href="https://redirect.github.com/ossf/scorecard-action/issues/1687">#1687</a>)</li> <li><a href="https://github.com/ossf/scorecard-action/commit/20ee7324026c52f8d0c4b372a7bf382a01b72ff9"><code>20ee732</code></a> :seedling: Bump github.com/sigstore/cosign/v2 from 2.6.3 to 2.6.4 (<a href="https://redirect.github.com/ossf/scorecard-action/issues/1685">#1685</a>)</li> <li><a href="https://github.com/ossf/scorecard-action/commit/9f295ef01b1f77f15b1647c790db825d9577a441"><code>9f295ef</code></a> :seedling: Bump the github-actions group with 6 updates (<a href="https://redirect.github.com/ossf/scorecard-action/issues/1686">#1686</a>)</li> <li><a href="https://github.com/ossf/scorecard-action/commit/69bf556cea38c0fbe034b2ce923253eca7c4d651"><code>69bf556</code></a> :seedling: Bump github.com/sigstore/sigstore-go from 1.1.4 to 1.2.0 (<a href="https://redirect.github.com/ossf/scorecard-action/issues/1681">#1681</a>)</li> <li><a href="https://github.com/ossf/scorecard-action/commit/94e8b9600123b21167ebf56077904fc6ca421a95"><code>94e8b96</code></a> :seedling: Bump github.com/sigstore/rekor from 1.5.0 to 1.5.2 (<a href="https://redirect.github.com/ossf/scorecard-action/issues/1673">#1673</a>)</li> <li><a href="https://github.com/ossf/scorecard-action/commit/c7a1b37bbc88c32d53056d9071ce2ba0df381dfb"><code>c7a1b37</code></a> :seedling: Bump github.com/sigstore/fulcio from 1.8.5 to 1.8.6 (<a href="https://redirect.github.com/ossf/scorecard-action/issues/1675">#1675</a>)</li> <li>Additional commits viewable in <a href="https://github.com/ossf/scorecard-action/compare/4eaacf0543bb3f2c246792bd56e8cdeffafb205a...2d1146689b8cda280b9bc96326124645441f03bc">compare view</a></li> </ul> </details> <br /> Updates `github/codeql-action/upload-sarif` from 4.37.1 to 4.37.3 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/releases">github/codeql-action/upload-sarif's releases</a>.</em></p> <blockquote> <h2>v4.37.3</h2> <p>No user facing changes.</p> <h2>v4.37.2</h2> <ul> <li>The new address format for the <code>config-file</code> input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the <code>remote=</code> prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. <a href="https://redirect.github.com/github/codeql-action/pull/4023">#4023</a></li> <li>The CodeQL Action can now make use of <a href="https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries">configured private registries</a> in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. <a href="https://redirect.github.com/github/codeql-action/pull/4007">#4007</a></li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action/upload-sarif's changelog</a>.</em></p> <blockquote> <h1>CodeQL Action Changelog</h1> <p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p> <h2>[UNRELEASED]</h2> <p>No user facing changes.</p> <h2>4.37.3 - 22 Jul 2026</h2> <p>No user facing changes.</p> <h2>4.37.2 - 21 Jul 2026</h2> <ul> <li>The new address format for the <code>config-file</code> input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the <code>remote=</code> prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. <a href="https://redirect.github.com/github/codeql-action/pull/4023">#4023</a></li> <li>The CodeQL Action can now make use of <a href="https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries">configured private registries</a> in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. <a href="https://redirect.github.com/github/codeql-action/pull/4007">#4007</a></li> </ul> <h2>4.37.1 - 16 Jul 2026</h2> <ul> <li><em>Upcoming breaking change</em>: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. <a href="https://redirect.github.com/github/codeql-action/pull/3956">#3956</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1">2.26.1</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4019">#4019</a></li> </ul> <h2>4.37.0 - 08 Jul 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0">2.26.0</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3995">#3995</a></li> <li>In addition to the existing input format, the <code>config-file</code> input for the <code>codeql-action/init</code> step will soon support a new <code>[owner/]repo[@ref][:path]</code> format. All components except the repository name are optional. If omitted, <code>owner</code> defaults to the same owner as the repository the analysis is running for, <code>ref</code> to <code>main</code>, and <code>path</code> to <code>.github/codeql-action.yaml</code>. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. <a href="https://redirect.github.com/github/codeql-action/pull/3973">#3973</a></li> </ul> <h2>4.36.3 - 01 Jul 2026</h2> <p>No user facing changes.</p> <h2>4.36.2 - 04 Jun 2026</h2> <ul> <li>Cache CodeQL CLI version information across Actions steps. <a href="https://redirect.github.com/github/codeql-action/pull/3943">#3943</a></li> <li>Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. <a href="https://redirect.github.com/github/codeql-action/pull/3937">#3937</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.6">2.25.6</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3948">#3948</a></li> </ul> <h2>4.36.1 - 02 Jun 2026</h2> <p>No user facing changes.</p> <h2>4.36.0 - 22 May 2026</h2> <ul> <li><em>Breaking change</em>: Bump the minimum required CodeQL bundle version to 2.19.4. <a href="https://redirect.github.com/github/codeql-action/pull/3894">#3894</a></li> <li>Add support for SHA-256 Git object IDs. <a href="https://redirect.github.com/github/codeql-action/pull/3893">#3893</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.5">2.25.5</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3926">#3926</a></li> </ul> <h2>4.35.5 - 15 May 2026</h2> <ul> <li>We have improved how the JavaScript bundles for the CodeQL Action are generated to avoid duplication across bundles and reduce the size of the repository by around 70%. This should have no effect on the runtime behaviour of the CodeQL Action. <a href="https://redirect.github.com/github/codeql-action/pull/3899">#3899</a></li> </ul>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/github/codeql-action/commit/e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81"><code>e4fba86</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4031">#4031</a> from github/update-v4.37.3-72f6a9da0</li> <li><a href="https://github.com/github/codeql-action/commit/fb50ab5d62a274adf3ef3e22cfe750ae87a0ede7"><code>fb50ab5</code></a> Update changelog for v4.37.3</li> <li><a href="https://github.com/github/codeql-action/commit/72f6a9da0def52d9193d6a758f0378b65091f8d1"><code>72f6a9d</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4030">#4030</a> from github/mbg/fix/no-proxy</li> <li><a href="https://github.com/github/codeql-action/commit/3b5ee58597653d9cc6785f3f1277f796d81f3646"><code>3b5ee58</code></a> Use default <code>request</code> options instead of <code>undefined</code></li> <li><a href="https://github.com/github/codeql-action/commit/bfb6be4b5ecd3650f02f530571453e8c64ef0778"><code>bfb6be4</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4028">#4028</a> from github/mergeback/v4.37.2-to-main-e0647621</li> <li><a href="https://github.com/github/codeql-action/commit/526ab84f9858816d9cf5f7b9df4dd5e2235f0eba"><code>526ab84</code></a> Rebuild</li> <li><a href="https://github.com/github/codeql-action/commit/d6217b9b8c14166e4851db94c11155d03bd13c07"><code>d6217b9</code></a> Update changelog and version after v4.37.2</li> <li><a href="https://github.com/github/codeql-action/commit/e0647621c2984b5ed2f768cb892365bf2a616ad1"><code>e064762</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4027">#4027</a> from github/update-v4.37.2-385bcdc5a</li> <li><a href="https://github.com/github/codeql-action/commit/e0faed839190caa67a5cd42f1cc16246028ca3df"><code>e0faed8</code></a> Add a couple of change notes</li> <li><a href="https://github.com/github/codeql-action/commit/73aad0eaa9df172668665a150d17b8bc5a650c20"><code>73aad0e</code></a> Update changelog for v4.37.2</li> <li>Additional commits viewable in <a href="https://github.com/github/codeql-action/compare/7188fc363630916deb702c7fdcf4e481b751f97a...e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [dompurify](https://github.com/cure53/DOMPurify) from 3.4.11 to 3.4.12. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/cure53/DOMPurify/releases">dompurify's releases</a>.</em></p> <blockquote> <h2>DOMPurify 3.4.12</h2> <ul> <li>Fixed an issue where a hook would not get called for custom elements, thanks <a href="https://github.com/Rikuxx0"><code>@Rikuxx0</code></a></li> <li>Hardened the handling of hooks removing elements, <a href="https://github.com/mkrause-bee360"><code>@mkrause-bee360</code></a></li> <li>Added support for a few new SVG attributes, thanks <a href="https://github.com/cbn-falias"><code>@cbn-falias</code></a> & <a href="https://github.com/Develop-KIM"><code>@Develop-KIM</code></a></li> <li>Hardened the handling of declarative partial updates</li> <li>Updated the documentation is several spots, README, wiki, etc.</li> <li>Bumped several dependencies where possible</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/cure53/DOMPurify/commit/a9ca1e537422319a557a9a2aa61f003b23b4a197"><code>a9ca1e5</code></a> release: 3.4.12 (<a href="https://redirect.github.com/cure53/DOMPurify/issues/1537">#1537</a>)</li> <li>See full diff in <a href="https://github.com/cure53/DOMPurify/compare/3.4.11...3.4.12">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=dompurify&package-manager=npm_and_yarn&previous-version=3.4.11&new-version=3.4.12)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/devops-thiago/ThrillhouseBot/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…test fails" self-check (#97) (#419) ## What type of PR is this? - [x] ✨ Feature ## Description The review and verifier prompts guarded against **fabrication** but not **miscalculation**. The only test-related self-check was the *inverse* of the PR #84 failure — "if a test in this same diff exercises the path you claim is broken, explain why it would still pass". Nothing guarded the opposite direction: a claim that a test *fails*, or a finding resting on exact line-count / array-length arithmetic the model performed by hand. That gap is what produced the #84 miss: a MEDIUM, definitively-worded off-by-one ("Test assertion expects wrong number of omitted lines") pinned to `ReviewDiffFormatterTest.java:194`, against a test that passes as written. `FindingVerifier` is the same modality over the same diff, so it re-did the same `7 - 3 = 4` count and **agreed** instead of catching it — the finding was already labelled "low confidence" and still surfaced as settled fact. This adds the symmetric rule to both prompts: - **`PrReviewPrompts.SYSTEM`** — a new self-check bullet, placed next to its existing mirror image: a claim that a test FAILS, or one resting on line-count / array-length / index arithmetic, is at most confidence `"low"`, must show the arithmetic step by step from values quoted verbatim in the diff, must state that the test may pass as written, and must be phrased as a verification request ("CI will confirm this") — never as settled fact. Without an execution or CI signal, a definitively-worded test-failure claim is invalid. - **`PrReviewPrompts.USER`** — the *Tests changed in this PR* section now covers the reverse claim too. This is where the model reads the test files, and #84's finding was *on* a test file. - **`FindingVerifierPrompts.SYSTEM`** — a new rejection ground plus a severity-calibration cap. The verifier is told explicitly that it *cannot* settle such a claim by recounting, because it shares the author's modality and diff, and it keeps the `7 - 3 = 4` case as a regression example. Hedged claims are downgraded to `"low"`; claims asserted as fact with no execution signal are rejected. The confidence cap has real teeth now that #105 (merged) routes low-confidence findings to the summary instead of posting them inline. Follows the shape established by #107 (reject bullet + calibration sentence) rather than inventing a new prompt structure. No production logic changed — prompt text and its deterministic guards only. ## Related Issues Fixes #97 Groundwork already in place: #113 added the eval corpus case `evalcorpus/pr84-omitted-lines-off-by-one-false-positive` with `expectedVerdicts: ["rejected"]` and a `why` citing this issue — this PR is what makes the prompts produce that verdict. Complements #96 (execution oracle, now unscheduled) and #59 (CI context), either of which would supply the execution signal this rule defers to. ## How Has This Been Tested? - [x] Unit tests Three new tests in `PrReviewPromptsContentTest` (15 total in the class, all green), pinning each half of the guard so a future prompt edit cannot silently revert it: - `generatorPromptCapsExactArithmeticAndTestFailureClaims` - `generatorUserPromptHedgesClaimsThatAnInDiffTestItselfFails` - `verifierPromptRejectsRecountedArithmeticAndTestFailureClaims` Markers are deliberately coarse and single-line, matching the file's stated convention (check intent survives, not exact wording). Local gates, all green: - `./mvnw spotless:apply` + `spotless:check` - `./mvnw verify` — **1783 tests, 0 failures**, SpotBugs clean, JaCoCo gate met The LLM eval that checks the model *acts* on this guidance is the `eval`-tagged `PromptEvalTest`, excluded from the default surefire run by design. ## Checklist - [x] My code follows the project's coding standards - [x] I have performed a self-review of my own code

…idators for their own failure modes (#123) (#420) ## What type of PR is this? - [x] ✨ Feature ## Description When a diff introduces parsing / regex / validation / heuristic code, the pipeline graded it the way it grades a null check — re-reading the added lines for happy-path correctness. It never treated the new code as **a function whose decision boundary must be characterized**. Confirming a defect there requires *inventing an input the diff does not contain by definition*, and both prompts feed only diff text, so the bot's own three review rounds on PR #114 returned "No issues found" while human review found ~10 precision/recall defects in that very code. Three changes: **1. A new conditional section, `PrReviewPrompts.HEURISTIC_FAILURE_MODES_REQUEST`.** It instructs the reviewer to identify each new decision rule, *synthesize* the inputs that probe its edges and name them literally, and report **both** directions — weighting the false negative, since a rule that silently misses looks correct on the page while a false positive is visible on reading. The synthesized input must be labelled as absent from the diff ("input not in the diff: …") so it is never presented as quoted material. Concrete probes are seeded from the shapes in the issue and its comments: a paren-counting regex meeting a lambda, an ASCII whitespace class meeting an NBSP or zero-width joiner, a scope window meeting an occurrence one line outside it, a "starts with" check meeting the token inside a fenced code block (the #160 `/pause` case), and a presence check meeting a present-but-wrong-shape value (the #157 non-numeric `GITHUB_APP_ID` case). **2. `HeuristicCodeDetector`** gates it, following `bugFixEfficacySection`'s precedent — the section is empty unless the diff actually adds such code. Signals: regex construction (Java/JS/Python/Go/ Kotlin), char-level scanning, Unicode/whitespace normalization, a *declared* parse/validate/tokenize member, and window/threshold constants. **3. A verifier exemption in `FindingVerifierPrompts.SYSTEM`.** This is the load-bearing part. A heuristic-limitation finding is *about* an input that cannot appear in the diff, so the existing verbatim-quote and "unverifiable here" rejection grounds would erase the entire class this capability generates. The verifier is now told to judge such findings on the rule's mechanics — trace the quoted rule against the named input — and that inability to execute the rule is not grounds for rejection. **Deliberately out of scope:** executing the synthesized inputs. That is #96 (unscheduled), which the issue notes must be extended to accept synthesized inputs rather than only running the diff's existing tests. This PR delivers generation and reporting, not proof — so findings land at confidence "low"/"medium" as verification requests. ### Precision over recall on the trigger The detector deliberately excludes `substring`, `indexOf`, `trim`, `matches` and `parseInt`. They appear in most diffs, and a trigger that fires on most diffs spends prompt budget on every review without adding an angle. `parse`/`validate`-style names count only as **declarations**: a declaration keyword on the same line, no `=` before the name, and no `.` or word char immediately before it — so neither a bare `parseInt(...)` call nor `private int id = Integer.parseInt(raw)` triggers. Import/package lines are skipped too, so `import java.text.Normalizer;` cannot stand in for normalization logic. Test files are skipped — a regex there is usually a fixture. `shouldNotTriggerOnOrdinaryStringHandling` pins this. ### Note on the hedging demotion The issue lists the `\b(may|might|could...)\b` demotion in `FindingVerificationService` as a force that scrubs these inherently-probabilistic findings, deferring the fix to #105. That turned out not to need changing: the demotion drops a hedged blocking finding to *medium confidence*, not to dropped — it still posts. So no change there, keeping this diff focused. ## Related Issues Fixes #123 Motivating dogfood case: PR #114 / `FindingQuoteValidator`. Recall seeds named in the issue comments: #160 (`/pause` inside a code fence), #157 (non-numeric `GITHUB_APP_ID`) — both good candidates to add to #113's corpus as a follow-up. #63 remains the natural host if this becomes a dedicated agent role. ## How Has This Been Tested? - [x] Unit tests - **`HeuristicCodeDetectorTest`** (13 tests, new) — triggers for each signal class in both directions, including the two recall seeds, test-file exclusion, removed-heuristic code, and a deleted-file hunk. - **`ReviewPromptAssemblerTest`** (+2) — section empty on ordinary string handling, emitted on a new regex. - **`PrReviewPromptsContentTest`** (+2) — anchors on the request text and the verifier exemption. Local gates, all green: - `./mvnw spotless:apply` + `spotless:check` - `./mvnw verify` — **1800 tests, 0 failures**, SpotBugs `BugInstance size is 0`, JaCoCo gate met - JaCoCo on the new class: **fully covered**, 0 missed instructions/branches/lines Coverage-chasing on the last uncovered branch surfaced a real defect, now fixed and pinned by `shouldNotCarryTheTestFileFlagPastADeletedFile`: a deletion emits `+++ /dev/null`, which the header regex does not match, so `inTestFile` carried over from the previous file. All `+++ ` lines are now consumed in one place, which resets the flag and removes a redundant guard. ## Checklist - [x] My code follows the project's coding standards - [x] I have performed a self-review of my own code

…cessaryStubbing (#421) ## What type of PR is this? - [x] ✅ Test ## Description `AckReactionServiceTest.shouldRestoreInterruptFlagWhenInterrupted` intermittently fails CI with Mockito's `UnnecessaryStubbingException`, while passing locally every time. It made PR #420's CI go red for a change that touches only `review/`. ### Root cause The test interrupted the calling thread **before** invoking `addEyes`: ```java doAnswer(inv -> { release.await(5, SECONDS); return null; }) // block the reaction .when(reactionClient).createIssueCommentReaction(...); Thread.currentThread().interrupt(); // ← before the call service.addEyes(...); ``` `addEyes` submits to a **virtual-thread-per-task executor** and then calls `reaction.get(timeout)`. `FutureTask.awaitDone` checks task state first and the interrupt flag second, so with the flag already set and the task still `NEW`, it throws `InterruptedException` on its *first loop iteration* — with no dependency on whether the virtual thread has been scheduled yet. So whether `createIssueCommentReaction` is ever called is a race the test does not control. When the worker loses it, the `doAnswer` stub goes unused and strict stubs fails the run. `tearDown`'s `reactionExecutor.shutdownNow()` can also interrupt the worker before it reaches the client. The blocking stub was added to stop an already-completed task from racing past the interrupted path — it does that, but it cannot make its own invocation happen before the wait ends. This is load-dependent, which is exactly why it reproduces on a CI runner and not on a developer machine. ### Evidence it is a race, not a defect The same commit `0c9dd47` (PR #420) ran the `test` job twice: | Job | Result | |---|---| | 89802238955 | `Tests run: 1803, Failures: 0, Errors: 0` | | 89803263541 (rerun) | `Tests run: 1803, Failures: 0, Errors: 1` — this test, `» UnnecessaryStubbing` | Identical code, identical test set. ### Fix Make the ordering explicit instead of hoping for an interleaving: 1. The stub counts down an `entered` latch, and the test awaits it — so the stub is **always** used, and the wait is **always** genuinely in progress before the interrupt lands. 2. `addEyes` runs on its own named thread, interrupted only after `entered` fires — so `InterruptedException` from `get()` is guaranteed rather than incidental. 3. The flag is read on that thread after `addEyes` returns, via an `AtomicBoolean`. Side benefit: the shared JUnit thread is never interrupted now. The old test relied on `assertTrue(Thread.interrupted())` to both assert *and* clear the flag on the test-runner thread; a future edit that reordered or short-circuited that line would have leaked an interrupt into subsequent tests in the same thread. No production change. `lenient()` was deliberately **not** used — it would have hidden the race rather than removed it, and the stub genuinely should be invoked on this path. ## Related Issues N/A — flake found while working #123 (PR #420). Introduced by the `@InjectMocks` conversion in #410? No: the race predates it. #410 changed SUT construction only; the pre-interrupt ordering is from #346, which added the test. Calling it out because #410 was the last commit to touch the file and is a natural first suspect. ## How Has This Been Tested? - [x] Unit tests - **Mutation-verified non-vacuous**: deleting `Thread.currentThread().interrupt()` from `AckReactionService`'s `catch (InterruptedException)` fails the new test on `"interrupt flag must stay visible on the caller"`. Restored afterwards; no production diff in this PR. (The old test also caught that mutation — `awaitDone` clears the flag via `Thread.interrupted()` before throwing, so the restore was always genuinely required. The old assertion had teeth; only the stub's use was racy.) - **Full suite twice under CPU saturation** (8 busy loops, to mimic a contended runner): `Tests run: 1783, Failures: 0, Errors: 0` both times, no `UnnecessaryStubbing`. - `./mvnw verify` — 1783 tests, SpotBugs `BugInstance size is 0`, JaCoCo gate met. Note: the original flake did **not** reproduce locally in 5 runs even under saturation, so the justification rests on the `FutureTask.awaitDone` mechanics plus the same-commit CI divergence above, not on a local repro. ## Checklist - [x] My code follows the project's coding standards - [x] I have performed a self-review of my own code

…hboard pages (#15, #16) (#422) ## What type of PR is this? - [x] ✅ Test ## Description `costs` and `tokens` had Vitest coverage; `overview` and `sessions` — the two most interactive screens — had none. Adds both, following the `costs/page.test.tsx` pattern (mock `@/lib/api`, drive fixtures from `@/lib/mock-data`). **Two issues, one PR, one commit each.** They are sibling pages, test-only, touch no shared file, and SonarCloud's quality gate is timing out on every PR today — so one CI cycle instead of two. Trivial to split if you'd rather merge them separately. ### `overview/page.test.tsx` (#15) — 6 tests Summary render from `mockSummary`; placeholder state before the API resolves; error + **Retry** and recovery; websocket connection state in the *Live Model Output* heading; a `review.started` event driving the live-review card and activity feed; and the empty-state copy when no events have arrived. `@/hooks/useWebSocket` is mocked with controllable `events`/`connected`, per the issue. ### `sessions/page.test.tsx` (#16) — 8 tests List render; error + **Retry** and recovery; row selection loading detail *and* deep-linking `?id=`; restoring the panel straight from an `?id=` link; ignoring a non-numeric `?id=` without requesting it; the detail-failure message; and pagination both when `total > size` and when it is not. ### Two places the issues' suggested assertions did not match the pages Called out because the issue text would mislead the next reader: 1. **#15 asks for a "loading state"** — the overview page has no `Loading...` block. It uses `useDashboardFetch` with `keepStaleWhileLoading: true`, so the pre-resolve state is an em dash in each of the five cards. The test asserts that instead. (The page also has *two* distinct error states — a hard error and a stale-refresh banner; the test covers the hard one, which is the path the issue describes.) 2. **#16 suggests asserting/clicking the PR title** — the sessions table never renders `prTitle`. Its columns are Repo, PR, Model, Status, Tokens, Cost, Findings, Time, and a **View** button. Rows are identified by `#12` and selection goes through the View button. `window.history.replaceState` is used to set and reset the URL rather than stubbing it, so the deep-link assertions exercise the page's real `URLSearchParams` reads. ## Related Issues Fixes #15 Fixes #16 ## How Has This Been Tested? - [x] Unit tests - `npm run test` — **6 files, 22 tests, all passing** (up from 4 files / 8 tests) - `npm run build` — succeeds; CI runs this too Note for anyone reproducing locally: `npm ci` fails here with `Missing: sharp@ from lock file` on npm 11.17.0 / node 26.5.0, because of how that npm version reconciles the intentional `"overrides": { "sharp": "-" }` in `frontend/package.json` against the lockfile. CI's `npm ci --ignore-scripts` passes, and the entry predates today's dependency bumps (it is on `main` too), so nothing here is broken — but `npm install --no-save --ignore-scripts` is the local workaround. No lockfile change is included in this PR. ## Checklist - [x] My code follows the project's coding standards - [x] I have performed a self-review of my own code

@Jk2006k

) (#424) ## What type of PR is this? - [x] ✅ Test ## Description Scoped to **part (c)** of #136 — the other two parts are already done, which I confirmed against current `main` and [recorded on the issue](#136): | Part | Status | |---|---| | (a) presence edge cases | Done by #139 | | (b) vacuous follow-up assertion | Done by #147, unrecorded — it replaced the test with `shouldPostSummaryOnPersistedButUnreviewedPr`, which overrides the global blank-summary stub and asserts `createComment` **is** called | | (c) end-to-end backstop | **This PR** | Part (b) also can't be done as originally written: #147 is titled *"decouple first-review UX from persistence context"*, so the persistence-aware `isFirstReview` behaviour that (b) wanted a regression guard for was deliberately redesigned. A guard written to the original wording would pin behaviour that was intentionally changed. ### What (c) needed `followUpAnalyzer` is a `@Mock`, and every backstop test stubs `unreportedUnresolvedStatusesFromParsed` to a canned list. That exercises only the gate wiring — backstop list → `previousStatuses` → `hasUnresolved` → COMMENT. The computation the backstop actually depends on (parse prior JSON → presence check → maintainer-reply check → 1-based id mapping) never ran in a `review()` flow. `shouldHoldApproveViaTheRealBackstopComputationThroughReview` closes that. Rather than rebuilding the SUT with a real analyzer — which would have meant duplicating the 14-argument wiring — it follows the idiom already in the file: `ApproveBackstop` keeps a `realAnalyzer` and a `delegateStatusGate()` helper that routes specific methods to real logic. The new `delegateBackstopComputation()` does the same for `parsePreviousResponses` and `unreportedUnresolvedStatusesFromParsed`, with a real diff from `prClient` anchoring the prior finding and a bot-only comment thread so nothing justifies dropping it. ## Related Issues Fixes #136 Taken over from @Jk2006k, who picked it up in June; noted on the issue with the reduced scope. ## How Has This Been Tested? - [x] Unit tests **Mutation-verified.** Stubbing `unreportedUnresolvedStatusesFromParsed` to return no statuses: - the new test **fails** — `expected: <COMMENT> but was: <APPROVE>` - the other **eight** `ApproveBackstop` tests still **pass** That contrast is the point: the existing tests are blind to the real computation breaking, which is exactly what #136(c) reported. Production restored afterwards; no production diff in this PR. Local gates: - `./mvnw spotless:apply` + `verify` — **1805 tests, 0 failures**, SpotBugs `BugInstance size is 0`, JaCoCo gate met ## Checklist - [x] My code follows the project's coding standards - [x] I have performed a self-review of my own code

## What type of PR is this? - [x] 🐛 Bug fix - [ ] ✨ Feature - [x] 📝 Documentation - [x] 🔧 Refactor - [x] 🚀 Performance - [x] ✅ Test - [x] 🔒 Security - [x] 📦 Dependency update - [ ] 🏗️ CI/CD ## Description Audits every change added to `release/v0.5.0` since its branch point and fixes the release-blocking correctness, security, concurrency, configuration, dependency, and test-reliability issues found. Key fixes: - Scope dashboard feedback reads to repositories the authenticated user can access. - Accept feedback only from verified write-capable collaborators on bot-authored finding threads; bound capture concurrency and prioritize newer findings. - Reject mixed-revision reviews after force-pushes; preserve/supersede previous findings correctly across rename+edit, pure rename, and model omission cases. - Refresh only genuine bot summary comments and recognize truncation-prefixed summaries safely. - Reject non-finite numeric configuration, reserve configured output capacity only when budgeting is enabled, and retain evidence-appropriate finding confidence. - Remove source-line contents from INFO logs and clarify pure-rename AI review scope. - Correct `Optional<T>` prompt guidance and execution-backed arithmetic/test-failure confidence guidance. - Detect JS/TS regex literals, function/arrow validators, package-private Java declarations, and multiline regex construction using a bounded, file-reset-aware window. - Require visible expected-domain or contract evidence before confirming synthesized heuristic failures; contract-free probes remain low-confidence verification requests. - Make the sessions page test await resolved API row data instead of an always-present heading. - Require Node 22, pin PostCSS 8.5.23, and pin Sharp 0.35.3 so clean npm 11 installs work without known high-severity advisories. - Add focused regression coverage for every executable production line and branch introduced by the audit. Newly audited after rebasing through `eb69d3a`: - `16daeb0` / #420: adversarial parser/regex/validator review support — fixed detector recall and verifier precision gaps. - `77910ed` / #421: webhook interrupt-race test fix — verified correct; no production, security, or resource-leak regression found. - `58b0cae` / #422: frontend dashboard coverage — fixed the sessions API-resolution race. - `eb69d3a` / #424: real backstop integration coverage — corrected the anchor/thread fixtures and explicitly pinned 1-based status mapping. Coverage remediation: - `74ceb46`: exercises dashboard repository authorization, feedback rejection/saturation, non-finite and output-budget validation, follow-up rename/vanished handling, stale-head nulls, and verdict rename rollups. - `c03685d`: covers the final three branch-partial lines reported by Codecov without changing production behavior. - `89066f8`: makes heuristic regex matching stack-safe with possessive repetition and an explicit regex-literal terminator lookahead, with regression coverage for escaped literals, nested TypeScript arrows, and 100k-character inputs. - Local changed-code intersection against `origin/release/v0.5.0`: 222/222 executable production lines (100%) and 216/216 changed branches (100%). ## Related Issues Follow-up audit for #64, #334, #342, #323, #324, #337, #336, #341, #110, #113, #322, #135, #105, #111, #107, #116, #386, #97, #123, #15, #16, and #136; reviewed the corresponding release PRs #389–#424. ## How Has This Been Tested? - [x] Unit tests - [ ] Integration tests - [ ] Manual testing - `./mvnw spotless:apply` - Focused coverage suite — 295 tests passed - Focused remaining-branch suite — 173 tests passed - `./mvnw verify` — 1,854 tests passed; SpotBugs clean; all JaCoCo checks met - `HeuristicCodeDetector` — 315/315 instructions, 74/74 branches, 74/74 lines, 7/7 methods - `LANG=en_US.UTF-8 npm run test -- --run` in `frontend` — 22 tests passed - `npm run build` in `frontend` — production build passed - `npm run build` in `website` — 56 pages built; all internal links valid - `npm audit` in both npm projects — 0 vulnerabilities - `git diff --check` and IDE diagnostics for all edited files — clean ## Checklist - [x] My code follows the project's coding standards - [x] I have performed a self-review of my own code - [x] I have added tests that prove my fix is effective or that my feature works - [x] New and existing unit tests pass locally with my changes - [x] I have updated the documentation accordingly - [x] My changes generate no new warnings or errors ## Additional Notes The requested `release/0.5.0` ref does not exist, so this PR targets the existing `release/v0.5.0` branch. Repository rulesets were intentionally not changed. The live required-check ruleset currently omits `release/**`, and required check contexts are not source/integration-bound; those repository-security changes require explicit owner confirmation and remain release follow-ups. Other audited follow-ups not included here: GitHub publication body-size budgets, framework-filter false-negative risk, remaining #135 lazy/parse-once opportunities, feedback retention/purge policy, and dispatcher coalescing observability.

…425) ## What type of PR is this? - [x] 📝 Documentation ## Description `[Unreleased]` carried **6 entries for 20 merged issues**. This adds the 13 missing user-facing changes in the existing house style — bold lead-in, issue number, concrete before/after, dogfood example where one exists. **Added** — #123 adversarial failure-mode characterization, #322 CI gating strictness, #323 blocking strictness, #64 model generation parameters. Also adds the missing `(#110)` citation to the existing bug-fix efficacy entry. **Changed** — #105 low-confidence findings routed to the summary, #97 exact-arithmetic / "test fails" cap, #342 dual-gate merge policy (framed as contributor-facing, not operator-facing). **Fixed** — #336 force-push anchor invalidation, #337 framework-idiomatic false positives, #334 duplicate CI-pending comment. **Performance** (new section) — #386 pure renames excluded from budget, #135 backstop hot-path dedupe. **Dependencies** (new section) — the seven bumps merged this cycle. ### What was deliberately left out Per the rule that only pre-0.5 behaviour belongs here, **fixes to code introduced within this cycle are excluded** — they never reached a release, so there is nothing for a user to have experienced: - the flaky `AckReactionServiceTest` interrupt race (#421) - the `@InjectMocks` SUT-construction refactor (#410) - the `java:S5850` regex fix and the coverage follow-up, both squashed into #420 **#136** is also omitted — test hardening with no user-facing behaviour. It is the only merged issue with no entry, and that is intentional. `### Performance` and `### Dependencies` are non-standard Keep-a-Changelog headings, but 0.4.0 already set the precedent by adding `### Dependencies`. ## Related Issues N/A — release preparation for v0.5.0. ## How Has This Been Tested? - [x] Manual testing Verified programmatically that every merged issue is now cited in `[Unreleased]` except the one intentional omission: ``` entries=19 sections: Added Changed Fixed Performance Dependencies uncited: #136 ``` Docs-only change; no code touched. ### Still open for the release (not in this PR) 1. `pom.xml` is `0.4.1-SNAPSHOT` — needs the 0.5.0 bump (PR #208 hardens that flow). 2. `[Unreleased]` needs renaming to `[0.5.0] — <date>` when the release is cut. 3. The 0.4.0 docs should be frozen with `cd website && npm run docs:archive -- <slug>` before 0.5.0 docs go current — archives exist for 0.1.0–0.3.0; worth confirming 0.4.0 was done. ## Checklist - [x] My code follows the project's coding standards - [x] I have performed a self-review of my own code

#426) ## What type of PR is this? - [x] 🏗️ CI/CD ## Description Release preparation for **v0.5.0**, dated **2026-07-26**. 1. **`pom.xml`** — `0.4.1-SNAPSHOT` → `0.5.0` (the only place the version appears). 2. **`CHANGELOG.md`** — `[Unreleased]` becomes `[0.5.0] — 2026-07-26` with a summary paragraph in the 0.4.0 style, and a fresh empty `[Unreleased]` is left above it for the next cycle. 3. **Docs freeze** — the 0.4.0 archive, plus `versions.json` `current.label` → `v0.5.0`. ### The 0.4.0 archive was never taken `versions.json` listed `current: v0.4.0` with archives stopping at **0.3.1**, so 0.4.0 was released without being frozen. That matters for *how* it gets archived now. `archive-docs-version.mjs` expands the `` markers **at archive time**, and README has since gained v0.5.0 options — so running it against the working tree would have produced a directory labelled "v0.4.0" that documents `REVIEW_CI_GATING`, `REVIEW_BLOCKING_STRICTNESS` and the rest. Users clicking *v0.4.0* would get 0.5.0 docs. The snapshot is therefore taken from the **`v0.4.0` tag's** content — README, `docs/`, `CONTRIBUTING.md` and the docs pages restored to the tag, archived, then reverted. Verified by `REVIEW_CI_GATING` returning 0 matches in the archived README content, against 1 in the live one. Ten pages archived under `website/src/content/docs/0.4.0/`, with matching assets and `src/content/versions/0.4.0.json`. One thing that surfaced while doing it: the `v0.4.0` tag contains `docs/REVIEW_EVAL.md`, which has since been deleted on both `main` and `release/v0.5.0`. Restoring the tag temporarily resurrected it and six archived copies; those were removed before committing, and the old 0.1.0–0.3.1 archives are byte-identical to before. The 0.4.0 archive keeps its copy, which is correct — it shipped in 0.4.0. ## Related Issues N/A — release preparation. **Depends on #425** (the changelog gap entries). This branch is stacked on it, so its diff will show those entries until #425 merges. Merge #425 first and this reduces to the release-prep commit alone. ## How Has This Been Tested? - [x] Manual testing - `./mvnw validate` passes on the bumped pom - `versions.json` parses; `current: v0.5.0`, 7 archived versions - Archived pages contain expanded content, not include markers (`AUTO_REVIEW_MIN_INTERVAL` present in the archived configuration page, 0 include markers left) - `git status` confirms the only tracked changes are `pom.xml`, `CHANGELOG.md`, `versions.json` and the new 0.4.0 archive — no edits to existing archives ### Not done here Publishing the GitHub Release itself (which triggers the Pages deploy) — that is the manual step once this and #425 are on `release/v0.5.0`. The 21 milestone issues also still need closing by hand, since `Fixes #N` does not fire on non-default-branch merges. ## Checklist - [x] My code follows the project's coding standards - [x] I have performed a self-review of my own code

github-actions · 2026-07-27T00:04:54Z

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

thrillhousebot · 2026-07-27T00:06:41Z

🤖 ThrillhouseBot PR Summary

What this PR does

Release v0.5.0: introduces maintainer feedback capture, structured skip reasons, bug-fix efficacy check, heuristic code characterization, confidence-based finding routing, configurable CI/blocking strictness, pure rename exclusion, and multiple false-positive mitigations.

Control-Flow Diagram

🔀 Show diagram

sequenceDiagram
    participant Webhook as WebhookController
    participant FFCS as FindingFeedbackCaptureService
    participant GitHub as GitHub REST API
    participant Feedback as FindingFeedbackService
    Webhook->>FFCS: scheduleCaptureOnReviewReply(installId, ...)
    activate FFCS
    FFCS->>GitHub: GET /repos/{owner}/{repo}/pulls/comments/{commentId}
    GitHub-->>FFCS: root comment body
    FFCS->>GitHub: GET .../reactions (content=+1, page=1..)
    GitHub-->>FFCS: reactions list
    FFCS->>Feedback: recordFeedback (idempotent)
    loop until short page
        FFCS->>GitHub: GET .../reactions (page++)
        FFCS->>Feedback: recordFeedback
    end
    opt reply body heuristic
        FFCS->>Feedback: recordFeedback (not_useful)
    end
    deactivate FFCS

Changes Overview

Files changed: 143
Lines added: +13220
Lines removed: -563

Changed Files

File	Change	Summary
`.env.example`	Modified	-
`.github/thrillhousebot.md`	Modified	-
`.github/workflows/ci.yml`	Modified	-
`.github/workflows/codeql.yml`	Modified	-
`.github/workflows/dependency-review.yml`	Modified	-
`.github/workflows/docker-test-image.yml`	Modified	-
`.github/workflows/docs.yml`	Modified	-
`.github/workflows/release.yml`	Modified	-
`.github/workflows/scorecard.yml`	Modified	-
`.github/workflows/security-scan.yml`	Modified	-
`CHANGELOG.md`	Modified	-
`CONTRIBUTING.md`	Modified	-
`README.md`	Modified	Documents new features: find feedback, CI gating, blocking strictness, skip reason troubleshooting, and per-model parameters.
`docs/ARCHITECTURE.md`	Modified	-
`docs/FEEDBACK.md`	Added	-
`frontend/app/(dashboard)/overview/page.test.tsx`	Added	-
`frontend/app/(dashboard)/sessions/page.test.tsx`	Added	-
`frontend/package.json`	Modified	-
`src/main/java/dev/thiagogonzaga/thrillhousebot/config/ActiveModelSettings.java`	Modified	-
`src/main/java/dev/thiagogonzaga/thrillhousebot/config/StartupConfigValidator.java`	Modified	-

…and 123 more file(s).

Risk Assessment

Risk	Count
🔴 Critical	0
🟠 High	0
🟡 Medium	0
🔵 Low	0

No new issues found in this PR, but the review cannot be approved until required CI is confirmed green.

⚠️ Required CI Checks Status

Some required checks are still pending or have failed:

Check	Type	Status	Detail
frontend	check-run	⏳ Pending	-
format	check-run	⏳ Pending	-
trivy	check-run	⏳ Pending	-
test	check-run	⏳ Pending	-
dependency-review	missing	⏳ Pending	-

Automated review by ThrillhouseBot. Reply with /review to re-run.

codecov · 2026-07-27T00:07:35Z

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

…e diff (#427) (#428) ## What type of PR is this? - [x] 🔧 Refactor - [x] ✅ Test ## Description Clears everything #427 (`release/v0.5.0` → `main`) reports. Opened against `release/v0.5.0` rather than pushed to it, so it flows into #427 through the normal path. ### Sonar — 10 findings **`java:S8786` super-linear regex ×2 (`HeuristicCodeDetector`)** — the substantive ones. - `HEURISTIC_DECLARATION` matched `[^(=\r\n]*` and then `(\w+)\s*\(`. The gap and the name class overlap, so on a long line with no `(` the engine re-split at every position. The gap is now atomic and must end on a separator — it cannot consume the name, so there is nothing to backtrack into. A possessive quantifier would have been wrong here: it stops exactly the backtracking the name capture depends on. - `THRESHOLD_CONSTANT` chained three unbounded runs (`[^=]* … \w*(?:ALT)\w* … [^=]*=`). Replaced by `THRESHOLD_DECLARATION`, one run terminated by `=`, with the name tokens checked in code — the same regex/code split `HEURISTIC_NAME_STEMS` already uses in this file. **`java:S135` ×2** — the diff scan loop and `ReviewPublisher.postInlineComments` now branch with `if/else` instead of stacked `continue`s. **`java:S107`** — `scheduleCaptureOnReviewReply` had 8 parameters. It now takes the `ReviewReply` record it *already* constructed internally from three of them, so the call site passes 6. The record became `public` for the `webhook` caller. **`java:S6126` ×5** — diff fixtures converted to text blocks. ### Codecov — three files under threshold, now fully covered All the gaps were in the #386 pure-rename support plus two error paths, and each new test pins real behaviour rather than just touching the line: - `isPureRename` with an absent file/status, and a rename reporting **zero counts but carrying patch text** — that one stays reviewable, so a rename+edit is never silently dropped from the budget - the rollup's fallback when GitHub omits `previous_filename` (no arrow, just the new path) - `withPureRenames` — both the identity return and the merge path, asserting renames append *after* reviewable files - the summary overview **leading** with the rename rollup, which is what stops clamping from dropping the disclosure on large multi-call reviews - `unwrapParallelFailure` preserving a real cause (the null-cause side was already covered) - a bot root comment with **no finding marker** — capture stops before polling reactions ## Related Issues Fixes the failing `codecov/patch` and the Sonar findings on #427. No issue number — release cleanup. ## How Has This Been Tested? - [x] Unit tests - `./mvnw verify` — **1863 tests, 0 failures**, SpotBugs `BugInstance size is 0`, JaCoCo gate met - JaCoCo confirms **fully covered, 0 missed instructions/branches/lines** for all five touched production files: `HeuristicCodeDetector`, `ReviewDiffFormatter`, `FindingPipeline`, `FindingFeedbackCaptureService`, `ReviewPublisher` - The detector's 26-case suite is the guard on the two regex rewrites — behaviour is unchanged, including the `parseInt` exclusion and the test-path/window-constant detection those patterns drive ## Checklist - [x] My code follows the project's coding standards - [x] I have performed a self-review of my own code

thrillhousebot

ThrillhouseBot noted 1 lower-confidence item(s) under Things to double-check in the PR summary (not posted as inline threads):

MEDIUM: Missing documentation for new CI gating and blocking strictness config keys (website/src/content/docs/0.4.0/configuration.md:79)
The PR adds new configuration keys thrillhousebot.review.ci-gating (read via VerdictBuilder as CiGatingMode) and thrillhousebot.review.blocking-strictness (BlockingStrictness). The configuration reference table in website/src/content/docs/0.4.0/configuration.md does not list them. The project's own guidelines (.github/thrillhousebot.md) require "New config keys must be documented" in the configuration docs and .env.example.

…efault patterns (#429) ## What type of PR is this? - [ ] 🐛 Bug fix - [X] ✨ Feature - [ ] 📝 Documentation - [ ] 🔧 Refactor - [ ] 🚀 Performance - [ ] ✅ Test - [ ] 🔒 Security - [ ] 📦 Dependency update - [ ] 🏗️ CI/CD ## Related Issues Closes: #52 ## Checklist - [X] My code follows the project's coding standards - [X] I have performed a self-review of my own code - [X] I have added tests that prove my fix is effective or that my feature works - [X] New and existing unit tests pass locally with my changes - [X] I have updated the documentation accordingly - [X] My changes generate no new warnings or errors

thrillhousebot

ThrillhouseBot found no issues in this PR, but some checks are still pending or failed:

Check test is pending
Check format is pending
Check frontend is pending
Check trivy is pending
Check dependency-review is pending

…validated (#430) ## What type of PR is this? - [x] 📝 Documentation ## Description Five commits landed on `release/v0.5.0` after the `[0.5.0]` section was written. Two of them changed what actually ships, leaving one feature undocumented and three entries describing behaviour that no longer exists. ### #429 was missing, and it changes existing deployments It widens the default `thrillhousebot.review.ignored-files` globs (closes #52) to cover `pnpm-lock.yaml`, `go.sum`, protobuf output, minified bundles and sourcemaps, and the directories `node_modules/`, `dist/`, `build/`, `out/`, `.next/`, `vendor/`, `__pycache__/`, `.venv/`, `bin/`, `obj/`. Filed under **Changed** rather than Added, because it is not additive for anyone already running the bot: the directory globs match by name, so a repository keeping handwritten source under `build/`, `bin/`, `out/` or `vendor/` silently stops having it reviewed on upgrade. The entry says so — the code's own javadoc carries the same warning. ### #423 invalidated three entries The audit commit touched 35 files (+2303/−159) and never touched the changelog: | Entry | Was wrong because | |---|---| | **#97** | Said the arithmetic/test-failure cap was absolute ("at most low confidence"). #423 made it evidence-dependent: with an execution or CI signal in the material, the finding keeps the confidence that evidence justifies | | **#324** | Described feedback capture with no permission model. It now records only verified write-capable collaborators on bot-authored threads, scopes `GET /api/dashboard/feedback` to repos the caller can access, bounds capture concurrency, and no longer logs source-line contents at INFO | | **#123** | Described a Java-shaped detector. It now spans JS/TS regex literals, `function`/arrow validators, package-private Java declarations, and multiline construction over a bounded window — and only confirms a synthesized failure when the expected domain or contract is visible | Also added a Dependencies line for the Node 22 requirement and the PostCSS/Sharp pins, which is what makes a clean `npm ci` resolve without known high-severity advisories. ## Related Issues N/A — release documentation accuracy. ## How Has This Been Tested? - [x] Manual testing Verified against the branch state: - every merged issue is cited except #136 (test hardening, intentional) - no intra-release fix numbers leaked in — #410, #421, #423, #428 all absent - `Fixed` audited entry by entry for pre-0.5.0 scope Prose checked against the house voice rather than written free-hand: bold marks the entry name and nothing else, matching every prior release section (0.4.0 and 0.3.x use no mid-sentence bold at all). Em dash density lands at 11.1 per 1000 words against 12.9 in 0.3.1 and 13.3 in 0.3.0, so it reads consistently with the sections around it. ## Checklist - [x] My code follows the project's coding standards - [x] I have performed a self-review of my own code

thrillhousebot

ThrillhouseBot found no issues in this PR, but some checks are still pending or failed:

Check format is pending
Check dependency-review is pending
Check test is pending
Check trivy is pending
Check frontend is pending

Additionally, No new issues in this revision, but 1 previous finding(s) remain unresolved — fix them, or reply on their review thread (where one exists) with why they are deferred.

## What type of PR is this?  - [x] 🐛 Bug fix - [ ] ✨ Feature - [x] 📝 Documentation - [ ] 🔧 Refactor - [ ] 🚀 Performance - [x] ✅ Test - [ ] 🔒 Security - [ ] 📦 Dependency update - [ ] 🏗️ CI/CD ## Description Fixes two v0.5.0 Bugbot findings introduced by the structured-skip troubleshooting docs (#341) and finding-feedback dashboard filter (#324 / #423): - README troubleshooting checklist used non-existent `WEBHOOK_TRIGGERS_*` env vars. Operators following that guidance would set variables the app never reads (`WEBHOOK_SKIP_DRAFTS`, `WEBHOOK_REQUIRED_LABELS`, `WEBHOOK_EXCLUDED_LABELS`, `WEBHOOK_BASE_BRANCHES`, `WEBHOOK_IGNORED_BASE_BRANCHES` are the mapped names). - `GET /api/dashboard/feedback?repository=` authorized with case-insensitive repository access, then queried feedback with the raw query casing. Rows stored from webhooks (canonical GitHub casing) were missed when the filter casing differed. `FindingFeedbackService.summarize` / `listRecent` now match case-insensitively and return the stored repository key. ## Related Issues N/A — follow-up to #341 / #324 / #423 Bugbot findings on `release/v0.5.0`. ## How Has This Been Tested?  - [x] Unit tests - [ ] Integration tests - [ ] Manual testing - `./mvnw -Dtest=FindingFeedbackServiceTest,DashboardResourceTest test` — passed - New coverage: case-insensitive summarize/listRecent; dashboard feedback query with differing repository casing ## Checklist - [x] My code follows the project's coding standards - [x] I have performed a self-review of my own code - [x] I have added tests that prove my fix is effective or that my feature works - [x] New and existing unit tests pass locally with my changes - [x] I have updated the documentation accordingly - [x] My changes generate no new warnings or errors ## Screenshots / Logs N/A ## Additional Notes Targets `release/v0.5.0` so the cut ships with correct operator docs and feedback filtering.

thrillhousebot

ThrillhouseBot found no issues in this PR, but some checks are still pending or failed:

Check frontend is pending
Check format is pending
Check trivy is pending
Check test is pending
Check dependency-review is pending

Additionally, No new issues in this revision, but 1 previous finding(s) remain unresolved — fix them, or reply on their review thread (where one exists) with why they are deferred.

@matheusandre1

…#432) ## What type of PR is this? - [x] 🏗️ CI/CD ## Description Release notes were assembled from `CHANGELOG.md` alone, so GitHub's generated **New Contributors** section never ran and outside contributors went uncredited. v0.5.0 has one: **@matheusandre1** wrote the wider default ignored-files patterns (#429). ### Workflow `gh release create` gains the generated section — but not via `--generate-notes`. The existing workflow has two paths, and `gh release edit` (the re-run path) has **no** `--generate-notes` flag, so adding it only to `create` would mean any re-run silently overwrites the body and drops the credit. Instead the notes are generated once through the Release Notes API and both paths publish the same `release_body.md`: ```bash cp release_notes.md release_body.md if generated=$(gh api "repos/${GITHUB_REPOSITORY}/releases/generate-notes" \ -f tag_name="$TAG" --jq .body 2>/dev/null) && [ -n "$generated" ]; then printf '\n\n%s\n' "$generated" >> release_body.md else echo "::warning::Could not generate release notes; publishing CHANGELOG notes only" fi ``` Best-effort by design: if generation fails the release still publishes with the curated notes and a warning, rather than failing at the last step of a release. `contents: write` and `GH_TOKEN` are already present on that step, so no permission change. ### `.github/release.yml` (new) Shapes the generated section. Excludes `dependabot` and `github-actions`: seven Dependabot PRs landed in v0.5.0 and would bury the humans in both the PR list and the contributor credit, and the bumps are already summarised under **Dependencies** in the changelog. ## Related Issues N/A — release process. ## How Has This Been Tested? - [x] Manual testing - `.github/release.yml` parses and carries the `changelog` root key GitHub expects - Confirmed `gh release edit` lacks `--generate-notes` (`gh release edit --help`), which is what drove the generate-once approach rather than the one-flag version - Confirmed the step already exports `GH_TOKEN` and the job holds `contents: write`, both required by the `generate-notes` endpoint - Contributors verified from the branch itself: `git shortlog -sne origin/main..origin/release/v0.5.0` → Thiago Gonzaga (28), dependabot (7), Matheus André (1, #429) The generated section itself can only be verified when a release is cut — the failure mode if anything is wrong is a warning plus notes-as-before, not a broken release. ## Checklist - [x] My code follows the project's coding standards - [x] I have performed a self-review of my own code

thrillhousebot

ThrillhouseBot found no issues in this PR, but some checks are still pending or failed:

Check format is pending
Check frontend is pending
Check test is pending
Check trivy is pending
Check dependency-review is pending

Additionally, No new issues in this revision, but 1 previous finding(s) remain unresolved — fix them, or reply on their review thread (where one exists) with why they are deferred.

## What type of PR is this? - [x] 🐛 Bug fix ## Description Found by reading the running test instance's logs. ``` WARN StartupConfigValidator: REVIEW_MAX_INPUT_TOKENS (900000) exceeds the input cap of model 'deepseek-v4-pro' (128000); using 128000. ``` The deployment had set `THRILLHOUSEBOT_AI_MODELS__DEEPSEEK_V4_PRO__MAX_INPUT_TOKENS=1000000`, which looks right and resolves to nothing. The doubled underscores belong to keys that need **quoting** in `application.properties` (`"gpt-5.5"`, because of the dot); a hyphen-only key like `deepseek-v4-pro` is unquoted and takes **single** underscores. So the model stayed on its 128 000 default — **12.8% of the configured 1M context** — and the only signal was a cap warning that never said why the cap was low. In that instance it meant a 143-file diff was batched against a window 8× smaller than intended: 25 sessions, 3.95M tokens, $7.07 in about an hour. ### The fix Startup scans `THRILLHOUSEBOT_AI_MODELS_*` and warns for any variable that matches no configured model: - when the intended model is recognisable (separator-insensitive match), it names the spelling that actually works — `THRILLHOUSEBOT_AI_MODELS_DEEPSEEK_V4_PRO_MAX_INPUT_TOKENS` - otherwise it lists the known models and points at the empty-stub requirement for an unlisted one **Warn, not fail.** A leftover variable for a model no longer in use shouldn't stop a boot, and this is a class of typo where the operator's intent is clear but the cost of a hard failure is a broken deployment. The rule is a pure function (`unmappedModelEnvWarnings`) returning the messages, so it is tested directly. Log-appender capture was the first approach and doesn't work here — Quarkus runs JBoss LogManager, not Logback — and the pure function is the better shape regardless. `.env.example` now explains *why* the two forms differ rather than just listing them, and points at the boot log. ## Related Issues N/A — found in the v0.5.0 test deployment. ## How Has This Been Tested? - [x] Unit tests Six new cases in `StartupConfigValidatorTest.ModelEnvVarMapping`, including the exact variable from the live deployment: - both prefix spellings (`deepseek-v4-pro` → single, `gpt-5.5` → double) - the wrong form on a known model warns **and names the working spelling** - correct forms — hyphen-only and dotted — stay silent - an unknown model warns about the missing stub - unrelated variables (`PATH`, `REVIEW_MAX_INPUT_TOKENS`) are ignored `./mvnw verify` — **1876 tests, 0 failures**, SpotBugs `BugInstance size is 0`, JaCoCo gate met. ### Not fixed here Two other things the same logs turned up, both out of scope for this PR: 1. An unhandled SSE exception escaping to the Vert.x event loop on every streaming review (`MismatchedInputException: No content to map due to end-of-input` via `OpenAiRestApiReaderInterceptor`). Non-fatal — reviews complete and every batch persists — but it logs at ERROR and will trip alerting. Worth its own issue. 2. `deepseek-v4-pro`'s shipped stub is empty, so the conservative 128 000 default applies. Filling in 1M was tempting but wrong: some providers serve V4 Pro at 512K, and a too-high default would over-budget and fail their calls. The operator setting it explicitly is correct. ## Checklist - [x] My code follows the project's coding standards - [x] I have performed a self-review of my own code

thrillhousebot

ThrillhouseBot noted 1 lower-confidence item(s) under Things to double-check in the PR summary (not posted as inline threads):

MEDIUM: test mock contradicts real collaborator behavior (src/test/java/dev/thiagogonzaga/thrillhousebot/webhook/WebhookControllerTest.java:643)
The test shouldForgetDeliveryIdWhenDispatchFails stubs reviewDispatcher.dispatch(...) with doThrow(new RuntimeException("executor saturated")). The real ReviewDispatcher.dispatch() method in this same diff catches RejectedExecutionException internally and returns false – it never throws to its caller for executor saturation. The mock is impossible in production for the stated trigger, so the green test does not prove the forget() rollback path runs when the executor is saturated. The test may still pass because the webhook controller's top-level catch block swallows the stubbed exception, but that path is unrelated to the production flow.

sonarqubecloud · 2026-07-27T02:50:47Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

devops-thiago and others added 30 commits July 17, 2026 13:17

devops-thiago added 3 commits July 26, 2026 21:03

devops-thiago mentioned this pull request Jul 27, 2026

fix(review): clear the Sonar findings and coverage gaps on the release diff (#427) #428

Merged

5 tasks

thrillhousebot Bot reviewed Jul 27, 2026

View reviewed changes

thrillhousebot Bot added enhancement New feature or request java Pull requests that update java code testing Test coverage and test quality labels Jul 27, 2026

thrillhousebot Bot reviewed Jul 27, 2026

View reviewed changes

devops-thiago merged commit 404c248 into main Jul 27, 2026
30 checks passed

devops-thiago deleted the release/v0.5.0 branch July 27, 2026 02:56

devops-thiago deployed to github-pages July 28, 2026 02:02 — with GitHub Actions View deployment

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Release/v0.5.0 - #427

Release/v0.5.0#427
devops-thiago merged 39 commits into
mainfrom
release/v0.5.0

devops-thiago commented Jul 27, 2026

Uh oh!

github-actions Bot commented Jul 27, 2026

Uh oh!

thrillhousebot Bot commented Jul 27, 2026

Uh oh!

codecov Bot commented Jul 27, 2026 •

edited

Loading

Uh oh!

thrillhousebot Bot left a comment

Uh oh!

thrillhousebot Bot left a comment

Uh oh!

thrillhousebot Bot left a comment

Uh oh!

thrillhousebot Bot left a comment

Uh oh!

thrillhousebot Bot left a comment

Uh oh!

thrillhousebot Bot left a comment

Uh oh!

sonarqubecloud Bot commented Jul 27, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

devops-thiago commented Jul 27, 2026

Uh oh!

github-actions Bot commented Jul 27, 2026

Dependency Review

Uh oh!

thrillhousebot Bot commented Jul 27, 2026

🤖 ThrillhouseBot PR Summary

What this PR does

Control-Flow Diagram

Changes Overview

Changed Files

Risk Assessment

⚠️ Required CI Checks Status

Uh oh!

codecov Bot commented Jul 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

thrillhousebot Bot left a comment

Choose a reason for hiding this comment

Uh oh!

thrillhousebot Bot left a comment

Choose a reason for hiding this comment

Uh oh!

thrillhousebot Bot left a comment

Choose a reason for hiding this comment

Uh oh!

thrillhousebot Bot left a comment

Choose a reason for hiding this comment

Uh oh!

thrillhousebot Bot left a comment

Choose a reason for hiding this comment

Uh oh!

thrillhousebot Bot left a comment

Choose a reason for hiding this comment

Uh oh!

sonarqubecloud Bot commented Jul 27, 2026

Quality Gate passed

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

codecov Bot commented Jul 27, 2026 •

edited

Loading