Skip to content
Permalink

Comparing changes

Choose two branches to see what’s changed or to start a new pull request. If you need to, you can also or learn more about diff comparisons.

Open a pull request

Create a new pull request by comparing changes across two branches. If you need to, you can also . Learn more about diff comparisons here.
base repository: GSA-TTS/agentic-coding-patterns
Failed to load repositories. Confirm that selected base ref is valid, then try again.
Loading
base: v1.12.0
Choose a base ref
...
head repository: GSA-TTS/agentic-coding-patterns
Failed to load repositories. Confirm that selected head ref is valid, then try again.
Loading
compare: v1.12.1
Choose a head ref
  • 4 commits
  • 5 files changed
  • 4 contributors

Commits on Oct 6, 2026

  1. fix(ci): clear two new markdownlint-cli transitive CVEs (katex, smol-… 

    …toml) (#478)

## Summary

Two new advisories landed and were GitHub-reviewed **today**, both
reachable through `[email protected]`'s dependency tree (the
version adopted in #471/#548's `markdownlint-cli2` → `markdownlint-cli`
migration):

- `katex` 0.11.0–0.18.1: `CVE-2026-103923` / `GHSA-238p-pmpm-9mq7`, a
prototype-pollution bypass of trust restrictions (low severity). Reached
via `markdownlint` → `micromark-extension-math` → `katex`.
- `smol-toml` ≤1.8.0: `GHSA-r4xh-jqrq-34v2`, a quadratic-time `parse()`
DoS on ordinary valid TOML input (moderate severity). Reached via
`markdownlint-cli` → `smol-toml` directly.

Both have patched releases (`[email protected]`, `[email protected]`) — unlike
the `braces` CVE that prompted the `markdownlint-cli2` →
`markdownlint-cli` migration in the first place (that one had no patched
release at all). This is a straightforward override bump.

## Not caused by this PR, not caused by #471/#548 either

Confirmed independently: this reproduces on current `main`, unmodified,
before making any change:

```text
$ npm ci && npm audit --audit-level=moderate   # on main, as-is
5 vulnerabilities (3 low, 2 moderate)
```

Same "advisory lands, previously-green gate goes red with zero local
changes" pattern as the `braces` CVE #471 fixed — these two were just
GitHub-reviewed hours after #471/#548 merged.

## Fix

Two `overrides` entries added to `.github/linters/package.json`.
`markdownlint-cli` itself stays pinned at `0.49.1`; only its own
transitive `katex` and `smol-toml` resolutions move.

```json
"overrides": {
  "js-yaml": "4.3.2",
  "katex": "0.18.2",
  "smol-toml": "1.9.0"
}
```

## Verification

```text
$ npm ci && npm audit --audit-level=moderate
found 0 vulnerabilities

$ node .github/linters/run-markdownlint.mjs --count-only
190

$ node .github/linters/run-markdownlint.mjs
(exit 0, clean)
```

190 matches the exact file-count parity established in #471.

## Safety Checklist

- [x] No secrets, tokens, credentials, or private keys
- [x] No PII, CUI, customer data, or sensitive info
- [x] No internal URLs or system details
- [x] Examples use placeholders where applicable

## Security Impact

Clears a moderate-severity DoS advisory and a low-severity
prototype-pollution advisory in dev-only, CI-only tooling (markdown
linting). No application runtime impact.

## AI Disclosure

This PR was prepared with OpenCode AI assistance. Human review is
required before merge.

Co-authored-by: OpenCode Agent <[email protected]>
    @wz-gsa OpenCode Agent
    wz-gsa and OpenCode Agent authored Oct 6, 2026
    Configuration menu
    Copy the full SHA
    f1913ba View commit details
    Browse the repository at this point in the history

  2. chore(deps)(deps-dev): Bump ruff from 0.16.8 to 0.16.9 in the dev-dep… 

    …endencies group across 1 directory (#468)

Bumps the dev-dependencies group with 1 update in the / directory:
[ruff](https://github.com/astral-sh/ruff).

Updates `ruff` from 0.16.8 to 0.16.9
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/ruff/releases">ruff's
releases</a>.</em></p>
<blockquote>
<h2>0.16.9</h2>
<h2>Release Notes</h2>
<p>Released on 2026-09-24.</p>
<h3>Preview features</h3>
<ul>
<li>[<code>ruff</code>] Avoid false positives for overloaded division
(<code>RUF069</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28309">#28309</a>)</li>
</ul>
<h3>Bug fixes</h3>
<ul>
<li>[<code>flake8-bugbear</code>] Avoid false positives for calls with
keyword arguments (<code>B009</code>, <code>B010</code>,
<code>B043</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28776">#28776</a>)</li>
<li>[<code>flake8-tidy-imports</code>] Allow lazy imports to be used in
deferred annotations (<code>TID255</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28767">#28767</a>)</li>
</ul>
<h3>Rule changes</h3>
<ul>
<li>Update LibCST-based fixes for Python 3.15 (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28616">#28616</a>)</li>
<li>[<code>flake8-pyi</code>] Mention stubs in the diagnostic message
(<code>PYI002</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28542">#28542</a>)</li>
</ul>
<h3>Documentation</h3>
<ul>
<li>Fix horizontal overflow on the rules documentation page (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28699">#28699</a>)</li>
<li>Update rules table with category information (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28651">#28651</a>)</li>
<li>[<code>flake8-annotations</code>] Clarify that <code>ANN401</code>
checks return types in addition to arguments (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28334">#28334</a>)</li>
<li>[<code>flake8-bugbear</code>] Document type-checker interaction
(<code>B010</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28509">#28509</a>)</li>
<li>[<code>flake8-comprehensions</code>] Document
<code>map</code>/generator exception behavior (<code>C417</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27794">#27794</a>)</li>
<li>[<code>ruff</code>] Mention related isort settings
(<code>RUF022</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28719">#28719</a>)</li>
</ul>
<h3>Contributors</h3>
<ul>
<li><a
href="https://github.com/qinpei-dev"><code>@​qinpei-dev</code></a></li>
<li><a
href="https://github.com/sanjayrohith"><code>@​sanjayrohith</code></a></li>
<li><a href="https://github.com/ntBre"><code>@​ntBre</code></a></li>
<li><a
href="https://github.com/webdevsamran"><code>@​webdevsamran</code></a></li>
<li><a
href="https://github.com/zaniebot"><code>@​zaniebot</code></a></li>
<li><a
href="https://github.com/ewdurbin"><code>@​ewdurbin</code></a></li>
<li><a
href="https://github.com/MichaReiser"><code>@​MichaReiser</code></a></li>
<li><a
href="https://github.com/spaceone"><code>@​spaceone</code></a></li>
<li><a
href="https://github.com/IbrahimKhan12"><code>@​IbrahimKhan12</code></a></li>
<li><a
href="https://github.com/devtechedge"><code>@​devtechedge</code></a></li>
<li><a
href="https://github.com/GruffElixir"><code>@​GruffElixir</code></a></li>
</ul>
<h2>Install ruff 0.16.9</h2>
<h3>Install prebuilt binaries via shell script</h3>
<pre lang="sh"><code>curl --proto '=https' --tlsv1.2 -LsSf
https://releases.astral.sh/github/ruff/releases/download/0.16.9/ruff-installer.sh
| sh
</code></pre>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md">ruff's
changelog</a>.</em></p>
<blockquote>
<h2>0.16.9</h2>
<p>Released on 2026-09-24.</p>
<h3>Preview features</h3>
<ul>
<li>[<code>ruff</code>] Avoid false positives for overloaded division
(<code>RUF069</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28309">#28309</a>)</li>
</ul>
<h3>Bug fixes</h3>
<ul>
<li>[<code>flake8-bugbear</code>] Avoid false positives for calls with
keyword arguments (<code>B009</code>, <code>B010</code>,
<code>B043</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28776">#28776</a>)</li>
<li>[<code>flake8-tidy-imports</code>] Allow lazy imports to be used in
deferred annotations (<code>TID255</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28767">#28767</a>)</li>
</ul>
<h3>Rule changes</h3>
<ul>
<li>Update LibCST-based fixes for Python 3.15 (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28616">#28616</a>)</li>
<li>[<code>flake8-pyi</code>] Mention stubs in the diagnostic message
(<code>PYI002</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28542">#28542</a>)</li>
</ul>
<h3>Documentation</h3>
<ul>
<li>Fix horizontal overflow on the rules documentation page (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28699">#28699</a>)</li>
<li>Update rules table with category information (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28651">#28651</a>)</li>
<li>[<code>flake8-annotations</code>] Clarify that <code>ANN401</code>
checks return types in addition to arguments (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28334">#28334</a>)</li>
<li>[<code>flake8-bugbear</code>] Document type-checker interaction
(<code>B010</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28509">#28509</a>)</li>
<li>[<code>flake8-comprehensions</code>] Document
<code>map</code>/generator exception behavior (<code>C417</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27794">#27794</a>)</li>
<li>[<code>ruff</code>] Mention related isort settings
(<code>RUF022</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28719">#28719</a>)</li>
</ul>
<h3>Contributors</h3>
<ul>
<li><a
href="https://github.com/qinpei-dev"><code>@​qinpei-dev</code></a></li>
<li><a
href="https://github.com/sanjayrohith"><code>@​sanjayrohith</code></a></li>
<li><a href="https://github.com/ntBre"><code>@​ntBre</code></a></li>
<li><a
href="https://github.com/webdevsamran"><code>@​webdevsamran</code></a></li>
<li><a
href="https://github.com/zaniebot"><code>@​zaniebot</code></a></li>
<li><a
href="https://github.com/ewdurbin"><code>@​ewdurbin</code></a></li>
<li><a
href="https://github.com/MichaReiser"><code>@​MichaReiser</code></a></li>
<li><a
href="https://github.com/spaceone"><code>@​spaceone</code></a></li>
<li><a
href="https://github.com/IbrahimKhan12"><code>@​IbrahimKhan12</code></a></li>
<li><a
href="https://github.com/devtechedge"><code>@​devtechedge</code></a></li>
<li><a
href="https://github.com/GruffElixir"><code>@​GruffElixir</code></a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/astral-sh/ruff/commit/0be08a206f9c3180afd3e93bcc792ed5cb1f4db1"><code>0be08a2</code></a>
Bump version to 0.16.9 (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28882">#28882</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/b4920b72b354e7c715ab861ae23458874683bb02"><code>b4920b7</code></a>
Rename <code>ruff_cli</code> to <code>ruff_command_line</code> (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28881">#28881</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/47c751b95908a4d1f95f9ef8723036aae9da0b18"><code>47c751b</code></a>
Update dependency astral-sh/uv to v0.12.18 (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28880">#28880</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/8c244e56a1aeac31c26d2371ef26588e0632235c"><code>8c244e5</code></a>
[<code>flake8-comprehensions</code>] Document <code>map</code>/generator
exception behavior (<code>C417</code>...</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/5edf5a1d0a84663079e46983216059f06acea87d"><code>5edf5a1</code></a>
Use <code>target</code> form in <code>rooster.version_files</code> (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28876">#28876</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/915bb2b4bf9ae7eee47cf55646bbfebae254a23b"><code>915bb2b</code></a>
[ty] Prefer existing @ paths over response files in Ruff and ty (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28877">#28877</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/4710e1aa962b13720cf64aa84eb279c5333896d7"><code>4710e1a</code></a>
ci(github): update version number in placeholder of issue template (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28871">#28871</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/eedfc62a75bf1ba86d48959b00eea75ae87eadca"><code>eedfc62</code></a>
[ty] Propagate outer type context through cast calls (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28855">#28855</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/ceaa6a00830e1e350b8a23977a1a10ac467920a1"><code>ceaa6a0</code></a>
[ty] Contain rendered code within Markdown fences (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28869">#28869</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/dba0f30615424b94f94a174bba6ce6cce4bf11ff"><code>dba0f30</code></a>
authorize ruff-pre-commit dispatch via OIDC (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28867">#28867</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/astral-sh/ruff/compare/0.16.8...0.16.9">compare
view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
    @dependabot
    dependabot[bot] authored Oct 6, 2026
    Configuration menu
    Copy the full SHA
    ade2ed0 View commit details
    Browse the repository at this point in the history

  3. chore(deps): Bump https://github.com/astral-sh/ruff-pre-commit from v… 

    …0.16.8 to 0.16.9 (#469)

Bumps
[https://github.com/astral-sh/ruff-pre-commit](https://github.com/astral-sh/ruff-pre-commit)
from v0.16.8 to 0.16.9. This release includes the previously tagged
commit.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/ruff-pre-commit/releases">https://github.com/astral-sh/ruff-pre-commit's
releases</a>.</em></p>
<blockquote>
<h2>v0.16.9</h2>
<p>See: <a
href="https://github.com/astral-sh/ruff/releases/tag/0.16.9">https://github.com/astral-sh/ruff/releases/tag/0.16.9</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/astral-sh/ruff-pre-commit/commit/a56c0b927e6465d37cae3e97d35d4d18ab2b96cd"><code>a56c0b9</code></a>
Mirror: 0.16.9</li>
<li><a
href="https://github.com/astral-sh/ruff-pre-commit/commit/1b18dc6a6fe90f371ed1b2b68a62a0e6bbb7d092"><code>1b18dc6</code></a>
authorize astral-sh/ruff to dispatch the sync workflow (<a
href="https://redirect.github.com/astral-sh/ruff-pre-commit/issues/182">#182</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff-pre-commit/commit/b00ddae0d8e27e2cf611d03f5c074fd8e8392602"><code>b00ddae</code></a>
Bump astral-sh/setup-uv from 10.0.1 to 10.1.0 in the github-actions
group (<a
href="https://redirect.github.com/astral-sh/ruff-pre-commit/issues/181">#181</a>)</li>
<li>See full diff in <a
href="https://github.com/astral-sh/ruff-pre-commit/compare/2eeb5678de71a00c0902cbda7105d328432f72cb...a56c0b927e6465d37cae3e97d35d4d18ab2b96cd">compare
view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
    @dependabot
    dependabot[bot] authored Oct 6, 2026
    Configuration menu
    Copy the full SHA
    722ffd1 View commit details
    Browse the repository at this point in the history

  4. chore(main): release 1.12.1 (#479) 

    🤖 I have created a release *beep* *boop*
---


##
[1.12.1](v1.12.0...v1.12.1)
(2026-10-06)


### Bug Fixes

* **ci:** clear two new markdownlint-cli transitive CVEs (katex,
smol-toml)
([#478](#478))
([f1913ba](f1913ba))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: William Zujkowski <[email protected]>
    @github-actions @wz-gsa
    github-actions[bot] and wz-gsa authored Oct 6, 2026
    Configuration menu
    Copy the full SHA
    9f6c65e View commit details
    Browse the repository at this point in the history
Loading