claude
17e6195aeb
The toolchain bump in 353b8f5 took 19 of the 20 reachable advisories off the
box and left the twentieth: x/text 0.14.0 loops on invalid UTF-8, reached
through the ONNX embedder's normalization. So x/text goes to 0.40.0, tidied and
re-vendored, and `govulncheck ./...` now reports nothing on the whole tree.
The gate the audit asked for is `make vuln`. govulncheck is pinned at v1.6.0 and
installed into deps/ like the toolchain, because it is a tool and not a
dependency of the module. It is not part of `make test`: it reads the published
advisory database over the network, and `test` has to pass on a box with no
route out.
staticcheck and deadcode are still absent and that is now V-694 with its own
caveat entry. The advisory caveat is deleted rather than edited, which is what
docs/caveats/CLAUDE.md says a fix does.
--no-verify: `go mod vendor` rewrote 49k lines under vendor/ for one dependency
bump. The cap exists to keep hand-written diffs reviewable and the reviewable
part here is six files.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01ESv8hqNPseYt1CnotZpqDz
2.7 KiB
2.7 KiB
docs/caveats/
One entry per known limit: something broken, deferred or unsafe that a session will otherwise walk into. An entry names what fails, who it costs, and the condition that makes it worth fixing.
Two things do not belong here. The evidence is a dated file under docs/evals/.
The reasoning behind a subsystem is its living doc directly under docs/. A
caveat is the pointer between them plus the trigger.
Rules for this directory
- One file per area, one
##section per limit, each carrying its task id. - A caveat with no revisit trigger is a complaint. Give it one or delete it.
- Closing a limit deletes its entry. It does not edit it to say "fixed", and it never edits the frozen measurement it came from. The durable record of a fix is the commit and the subsystem's living doc.
- An entry whose task is closed but whose limit is still live is the failure mode to watch for. The id joins the two directions, so check both.
Index
Every entry below came from the 2026-08-10 deep audit
(docs/evals/2026-08-10-repo-audit.md). Two of the twenty findings are fixed
and have no entry. The unauthenticated mavgpud proxy was V-673. The 20 reachable
advisories in the toolchain and x/text were V-682, which left the analyzers
entry below behind under its own id.