[sadrbot]

What this PR does

Sadr moved the Semgrep CI image to 1.182.0, the newest release that cleared the 7-day cooldown. Sadr also lifted the cooldown exception on Node 24.22.1, because that release cleared the cooldown on 2026-10-28T10:38Z. Node stays at 24.22.1, the newest release of the newest LTS line before the cooldown cutoff.

Changes

• CI: semgrep/semgrep 1.181.0 → 1.182.0, pinned by digest (.github/workflows/semgrep.yml)
• CI: removed the three # sadr: cooldown exception comments above node-version: 24.22.1 (.github/workflows/conformance.yml)

Supply chain

• cooldown: unchanged (the repo has no package manager and no lockfile)
• pins: semgrep/semgrep:1.182.0@sha256:4a34048c04fef049f71665047f074cffb00cc3d89482f965a5cd151d589237af (digest built 2026-10-20T20:03Z). Every other pin is already the newest that cleared the cooldown: actions/checkout v7.0.1, actions/setup-node v7.1.0, actions/upload-artifact v7.0.2, koreader/kosync:latest (same digest as v2.1.1), and koreader/test-data at c3b5d06, its master head, with no release tags.
• cooldown exceptions: none
• inside the cooldown (already merged): none
• waiting for cooldown: Node 24.22.2 (clears 2026-11-04T18:39Z) | Node 26.13.0, the first LTS release of Node 26 (clears 2026-11-04T16:57Z) | semgrep/semgrep 1.183.0 (clears 2026-11-05T18:33Z)

Security findings

• untriaged: 0 → 0 (Semgrep API and semgrep ci --dry-run)
• open: 3 → 3
• fixed: 0
• false positive: 0
• accepted risk: 0
• other: 0
• suppressions reviewed: 0

Holds

• lifted: cooldown exception Node 24.22.1 (CVE-2026-105481, CVE-2026-105482, CVE-2026-105483, CVE-2026-106069, CVE-2026-106073, CVE-2026-106074, CVE-2026-111497), cleared 2026-10-28T10:38Z (.github/workflows/conformance.yml)

AGENTS.md

• ### Build and test: sh reference-server/run.sh reads KOSYNC_NAME and KOSYNC_PORT, so a second reference server can run beside the default one. The facts PR sadr: AGENTS.md facts 2026-11-01 #7 writes it (sadr: AGENTS.md facts 2026-11-01 #7).

Merging

• auto-merge: all (owner Settings in pid1/.github, upkeep PRs)
• turned on auto-merge (merge)

Needs you

• None.

Verification

• node --check verify.mjs && node --check vectors/check.mjs && node --check coverage.mjs with Node 24.22.1: passed
• node coverage.mjs: OK — spec and verifier agree.
• node vectors/check.mjs --big --koreader koreader-test-data (koreader/test-data at c3b5d06e1ae8ea088bd898b0e7f9da3753d0d86c): 10 passed, 0 failed
• node verify.mjs --help: exit 2, as designed
• sh reference-server/run.sh start (Podman), ciuser2 registered as in the reference job, then node verify.mjs --base-url http://127.0.0.1:8080 --user ciuser1 --password cipass1 --register --strict-accept --second-user ciuser2 --second-password secondpass: RESULT: conformant, exit 0
• semgrep ci --dry-run inside semgrep/semgrep:1.182.0 at the pinned digest, on the branch: exit 0, 3 findings, none blocking
• pins.py check on both workflows and reference-server/run.sh: 13 pins checked, 0 with problems
• semgrep ci --dry-run on the branch: the same 3 findings as on main, all triaged as accepted risk
• gitleaks git on the new commits and on the full history: no leaks found
• The same checks on main before any change: all passed

Run

• 9 minutes, US$1.54

Not done or not checked

• None.

---

Opened by Sadr, a dark factory for software.