Kjell Tore Guttormsen
ff4d8e8a31
Three TDD-first fixes surviving the B8 roadmap bucket (v8.0.0-plan.local.md Phase 1, items 1-3; item 4 JAR hardening scoped out at review): - supply-chain-recheck.mjs parseYarnLock: ported the hook's per-entry parser (pre-install-supply-chain.mjs) so Berry's `version: x` format (unquoted) is recognized alongside Classic's `version "x"` — Berry lockfiles previously yielded zero deps, silently missing pinned compromised packages. - supply-chain-recheck.mjs parsePackageLock: lockfileVersion-1 fallback now recurses nested `dependencies`, mirroring the hook's walk() — a transitive, non-hoisted compromised copy below the top level was previously invisible. - content-extractor.mjs stripInjection: attribution moved from a global `Set<label>` to `Set<label::lineIndex>`. The old check silenced the unstripped flag for ANY occurrence of a label once ANY occurrence had been line-redacted, so a second, cross-line-only encoded occurrence of the same label survived into sanitized output without being flagged. Full suite 2019/2019 (one known-flaky timing test confirmed green in isolation).
20 lines
428 B
Text
20 lines
428 B
Text
# This file is generated by running "yarn install" inside your project.
|
|
# yarn lockfile v6
|
|
|
|
__metadata:
|
|
version: 8
|
|
cacheKey: 10
|
|
|
|
"event-stream@npm:^3.3.6":
|
|
version: 3.3.6
|
|
resolution: "event-stream@npm:3.3.6"
|
|
checksum: 0123456789abcdef
|
|
languageName: node
|
|
linkType: hard
|
|
|
|
"lodash@npm:^4.17.21":
|
|
version: 4.17.21
|
|
resolution: "lodash@npm:4.17.21"
|
|
checksum: fedcba9876543210
|
|
languageName: node
|
|
linkType: hard
|