Repository navigation

Stop VEX attesting over yarn PnP, pnpm bundled and deno.lock copies - #1033

Merged

Mikola Lysenko (mikolalysenko) merged 19 commits into

mainfrom

arch-fix/vex-false-attest

Oct 8, 2026

Commits on Oct 6, 2026

Commits on Oct 7, 2026

Merge main into agent/fix-same-lock-unpatched-copy-vex
Claude (claude)
committed
3869e7e
Merge remote-tracking branch 'origin/main' into prfix/940
Mikola Lysenko (mikolalysenko)
committed
4ed7325
Stop vex attesting a hosted pin over a stale yarn PnP install (#519)

Mikola Lysenko (mikolalysenko)
and
Claude (claude)
committed
176327d
Merge remote-tracking branch 'origin/main' into prfix/940
Mikola Lysenko (mikolalysenko)
committed
869c81f
Contest a pnpm ref its lock also bundles (audit B04)

Mikola Lysenko (mikolalysenko)
and
Claude (claude)
committed
a0f253a
Read deno.lock as a contesting lock in VEX discovery (#406)

Mikola Lysenko (mikolalysenko)
and
Claude (claude)
committed
5e5d88d
Document the PnP, pnpm bundled and deno.lock VEX rules

Mikola Lysenko (mikolalysenko)
and
Claude (claude)
committed
7fb32e8
Merge branch 'main' into agent/fix-same-lock-unpatched-copy-vex
Mikola Lysenko (mikolalysenko)
authored
acbac79
Merge remote-tracking branch 'origin/agent/fix-same-lock-unpatched-copy-vex' into arch-fix/vex-false-attest
Mikola Lysenko (mikolalysenko)
committed
b83da9c
Keep pnpm bundled and deno.lock refs live; omit them only from vex

Mikola Lysenko (mikolalysenko)
and
Claude (claude)
committed
9ac96fc
Contest a yarn berry ref beside a registry locator of the same version

Mikola Lysenko (mikolalysenko)
and
Claude (claude)
committed
98d9b0b
Document unattested pnpm bundled and deno.lock refs in CLI_CONTRACT

Mikola Lysenko (mikolalysenko)
and
Claude (claude)
committed
e9a33b8
Merge origin/main into arch-fix/vex-false-attest

Mikola Lysenko (mikolalysenko)
and
Claude (claude)
committed
aeddea4
Merge remote-tracking branch 'origin/main' into prfix2/1033
Mikola Lysenko (mikolalysenko)
committed
314038b

Commits on Oct 8, 2026

Merge remote-tracking branch 'origin/main' into arch-fix/vex-false-attest
Mikola Lysenko (mikolalysenko)
committed
01f9bf0

Navigation Menu

Repository navigation

Stop VEX attesting over yarn PnP, pnpm bundled and deno.lock copies - #1033

Stop VEX attesting over yarn PnP, pnpm bundled and deno.lock copies#1033
Mikola Lysenko (mikolalysenko) merged 19 commits into
mainfrom
arch-fix/vex-false-attest

Commits on Oct 6, 2026

Start fix for #935, #938, #939

Stop VEX attesting beside an unpatched lock copy

Route Gradle digests through utils::digest

Drop quadratic dedup of same-lock copies

Commits on Oct 7, 2026

Merge main into agent/fix-same-lock-unpatched-copy-vex

Merge remote-tracking branch 'origin/main' into prfix/940

Stop vex attesting a hosted pin over a stale yarn PnP install (#519)

Merge remote-tracking branch 'origin/main' into prfix/940

Contest a pnpm ref its lock also bundles (audit B04)

Read deno.lock as a contesting lock in VEX discovery (#406)

Document the PnP, pnpm bundled and deno.lock VEX rules

Merge branch 'main' into agent/fix-same-lock-unpatched-copy-vex

Merge remote-tracking branch 'origin/agent/fix-same-lock-unpatched-copy-vex' into arch-fix/vex-false-attest

Keep pnpm bundled and deno.lock refs live; omit them only from vex

Contest a yarn berry ref beside a registry locator of the same version

Document unattested pnpm bundled and deno.lock refs in CLI_CONTRACT

Merge origin/main into arch-fix/vex-false-attest

Merge remote-tracking branch 'origin/main' into prfix2/1033

Commits on Oct 8, 2026

Merge remote-tracking branch 'origin/main' into arch-fix/vex-false-attest