nsaspy/agentProlog
1
0
Fork 0
Code Issues 31 Pull requests 6 Projects Releases Packages Wiki Activity Actions

security: fix CVE-2026-82533 Harness pin #15

Open
nsaspy wants to merge 10 commits from security/cve-2026-82533-harness into master
pull from: security/cve-2026-82533-harness
merge into: nsaspy:master
Conversation 0 Commits 10 Files changed 6 +112 -19
nsaspy commented 2026-09-09 13:48:43 +00:00
Owner
Copy link

Fixes #13
Fixes #14

Security hardening for DeepSeek Harness CVE-2026-82533:

  • upgrade all AgentProlog direct @deepseek-ai/dsh-* pins from vulnerable 0.1.1-rc.2 to fixed 0.1.2-rc.1
  • move the reviewed Harness identity to upstream tag commit a66e4702047846cdaa10c66c9d3df3951f5ea70d
  • add an explicit machine-readable block for the previous vulnerable identity with structured harness_security_blocked
  • add regression tests that reject the vulnerable identity and ensure manifests/lock data do not retain the old package train
  • temporarily let this PR's CI regenerate pnpm-lock.yaml and export it as an artifact; this workflow change will be reverted to frozen-lock mode after the generated lockfile is committed

The final PR will retain pnpm install --frozen-lockfile.

Fixes #13 Fixes #14 Security hardening for DeepSeek Harness CVE-2026-82533: - upgrade all AgentProlog direct `@deepseek-ai/dsh-*` pins from vulnerable `0.1.1-rc.2` to fixed `0.1.2-rc.1` - move the reviewed Harness identity to upstream tag commit `a66e4702047846cdaa10c66c9d3df3951f5ea70d` - add an explicit machine-readable block for the previous vulnerable identity with structured `harness_security_blocked` - add regression tests that reject the vulnerable identity and ensure manifests/lock data do not retain the old package train - temporarily let this PR's CI regenerate `pnpm-lock.yaml` and export it as an artifact; this workflow change will be reverted to frozen-lock mode after the generated lockfile is committed The final PR will retain `pnpm install --frozen-lockfile`.
ci: regenerate fixed Harness lockfile for security branch
Some checks failed
CI / node (pull_request) Failing after 3s
Details
CI / nix (pull_request) Failing after 5s
Details
2b14933463
ci: commit regenerated security lockfile on fix branch
Some checks failed
CI / node (pull_request) Failing after 2s
Details
CI / nix (pull_request) Failing after 3s
Details
7036f23182
Some checks failed
CI / node (pull_request) Failing after 2s
Details
CI / nix (pull_request) Failing after 3s
Details
This pull request has changes conflicting with the target branch.
  • packages/agentprolog/package.json
  • packages/agentprolog/src/compatibility.ts
  • packages/agentprolog/test/fakes.ts
View command line instructions

Manual merge helper

Use this merge commit message when completing the merge manually.

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin security/cve-2026-82533-harness:security/cve-2026-82533-harness
git switch security/cve-2026-82533-harness

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch master
git merge --no-ff security/cve-2026-82533-harness
git switch security/cve-2026-82533-harness
git rebase master
git switch master
git merge --ff-only security/cve-2026-82533-harness
git switch security/cve-2026-82533-harness
git rebase master
git switch master
git merge --no-ff security/cve-2026-82533-harness
git switch master
git merge --squash security/cve-2026-82533-harness
git switch master
git merge --ff-only security/cve-2026-82533-harness
git switch master
git merge security/cve-2026-82533-harness
git push origin master
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
accessibility
Barrier affecting people with disabilities

  
bug
Something isn't working

  
documentation
Improvements or additions to documentation

  
duplicate
This issue or pull request already exists

  
enhancement
New feature or request

  
good first issue
Good for newcomers

  
help wanted
Extra attention is needed

  
invalid
This doesn't seem right

  
question
Further information is requested

  
security

   
testing

   
wontfix
This will not be worked on

No labels
accessibility
bug
documentation
duplicate
enhancement
good first issue
help wanted
invalid
question
security
testing
wontfix
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
nsaspy/agentProlog!15
No description provided.