🔒 fix: dead links, contradicting READMEs, and a stale CHANGELOG - #13
Merged
Conversation
dont-be-shy-hulud is not publicly reachable under either owner -- 404 from miccy and from ownctrl. This preset linked to it five times. The worst one was in default.json. Every Renovate PR for a watch-listed package told the reader to "Run ./scripts/detect.sh from dont-be-shy-hulud" and handed them a dead link -- a security instruction that could not be followed, in the one place someone was about to act on it. Replaced that step with checks a reader can actually perform: confirm the affected range against Datadog's IOC list, check the lockfile including transitively, and rotate whatever the package could have reached. The README references now point at the Datadog IOC database, which is public and already cited elsewhere in the file. Footer credits the org that now owns the repo, and the copyright range covers this year's work.
Three things found reviewing the public face of this repo after the transfer. The English README recommended local> throughout while the Czech one used github>. Two files in one repo contradicting each other, and the English one was recommending the form that pays off only once the preset is mirrored -- which it is not. Both now say github>, and the section on local> says when it becomes the right choice instead of implying it already is. The ecosystem table predated nine of the ecosystems this preset now groups, and listed Biome, Oxlint and Vitest as if they were ecosystems rather than packages the trust list names. It now lists the managers actually configured, and says what happens to anything not named. The CHANGELOG had everything under [Unreleased] with v1.0.0 already tagged, and carried a sentence left ungrammatical by an earlier edit. Rewritten with the 1.0.0 entry it should have had, including the known limitations a reader would otherwise discover the hard way.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Carries the dead-link fix that missed the #12 merge, plus what a proper review of the public face turned up.
Dead links (the one that matters)
dont-be-shy-huludreturns 404 under bothmiccyandownctrl. It was referenced five times.The worst was in
default.json: every Renovate PR for a watch-listed package told the reader toRun ./scripts/detect.sh from dont-be-shy-huludand handed them a dead link — a security instruction that could not be followed, in the exact place someone was about to act on it. Replaced with checks that work without it, including credential rotation, which was missing and matters most for Shai-Hulud.The two READMEs contradicted each other
English recommended
local>throughout; Czech usedgithub>. Andlocal>only pays off once the preset is mirrored, which it is not — Codeberg holds an empty private snapshot and GitLab has nothing. Both now usegithub>; thelocal>section says when it becomes right rather than implying it already is.Ecosystem table was stale
It predated nine ecosystems and listed Biome, Oxlint and Vitest as ecosystems — they are packages the trust list names, not managers. Now lists the managers actually configured, and says what happens to anything not named.
CHANGELOG
Everything sat under
[Unreleased]withv1.0.0already tagged, and one sentence was left ungrammatical by an earlier edit. Rewritten with the 1.0.0 entry, including known limitations.Checked
default.json— accuratesocket.dev403s to curl only, bot blocking)./tooling/validate.sh— 5 files, exit 0