Skip to content

Condense vulnerability remediation PR body#8

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ulziibay-kernel merged 1 commit into from
Jun 1, 2026
Merged

Condense vulnerability remediation PR body #8

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 20 additions & 0 deletions scripts/test_vuln_remediation.py
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -303,5 +303,25 @@ def test_socket_post_plan_confirmation_succeeds_when_fix_disappears(self) -> Non
self.assertTrue(result["ok"], result)


class PrBodyTests(unittest.TestCase):
def test_pr_body_summarizes_batch_limited_deferred_items(self) -> None:
body = vr.render_pr_body(
{
"deferred": [
{"id": "GHSA-one", "package": "next", "reason": "Deferred to keep this remediation PR limited to 1 fix(es)."},
{"id": "GHSA-two", "package": "next", "reason": "Deferred to keep this remediation PR limited to 1 fix(es)."},
{"package": "entities", "reason": "Non-CVE alert is not handled by dependency remediation."},
]
},
{"fixed": [{"id": "GHSA-fixed", "package": "next", "old_version": "1.0.0", "new_version": "1.0.1"}], "reverted": []},
{"confirmed": [{"id": "GHSA-fixed"}]},
)

self.assertIn("Deferred by batch limit: 2 advisories", body)
self.assertNotIn("| GHSA-one | next | Deferred to keep this remediation PR limited", body)
self.assertIn("<details>", body)
self.assertIn("entities", body)


if __name__ == "__main__":
unittest.main()
40 changes: 31 additions & 9 deletions scripts/vuln_remediation.py
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -550,18 +550,40 @@ def render_pr_body(triage: dict[str, Any], fix_result: dict[str, Any], confirmat
if not fix_result.get("fixed"):
lines.append("| (none) | | | | | | |")

deferred = triage.get("deferred") or fix_result.get("reverted") or []
unconfirmed = fix_result.get("reverted") or []

@cursorcursorBotJun 1, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Reverted items double-counted when triage has no deferred

Medium Severity

When triage.get("deferred") is falsy, the or fallback causes deferred to equal fix_result.get("reverted"), which is the same value assigned to unconfirmed. This means other_deferred and unconfirmed contain identical items, causing them to be double-counted in the summary bullets and duplicated in the (other_deferred + unconfirmed)[:10] details table. The test only covers reverted: [], so this path is untested.

Additional Locations (1)
Fix in CursorFix in Web

Reviewed by Cursor Bugbot for commit 8aafa3b. Configure here.

batch_limited = [
item for item in deferred
if "limited to" in str(item.get("reason") or "")
]
other_deferred = [
item for item in deferred
if "limited to" not in str(item.get("reason") or "")
]
lines.extend([
"",
"### Deferred / Rejected",
"| CVE/GHSA | Package | Reason |",
"|---|---|---|",
"### Not Included",
f"- Deferred by batch limit: {len(batch_limited)} advisories. They will be considered by future runs.",
f"- Other deferred scanner findings: {len(other_deferred)}.",
f"- Unconfirmed attempted fixes: {len(unconfirmed)}.",
])
deferred = triage.get("deferred") or fix_result.get("reverted") or []
for item in deferred:
vuln_id = item.get("ghsa") or item.get("cve") or item.get("id") or "Unavailable from detector"
lines.append(f"| {vuln_id} | {item.get('package','')} | {item.get('reason','')} |")
if not deferred:
lines.append("| (none) | | |")

if other_deferred or unconfirmed:
lines.extend([
"",
"<details>",
"<summary>Deferred details</summary>",
"",
"| CVE/GHSA | Package | Reason |",
"|---|---|---|",
])
for item in (other_deferred + unconfirmed)[:10]:
vuln_id = item.get("ghsa") or item.get("cve") or item.get("id") or "Unavailable from detector"
lines.append(f"| {vuln_id} | {item.get('package','')} | {item.get('reason','')} |")
omitted = len(other_deferred) + len(unconfirmed) - 10
if omitted > 0:
lines.append(f"| ... | ... | {omitted} additional items omitted from PR body. See workflow artifacts for full details. |")
lines.extend(["", "</details>"])
return "\n".join(lines) + "\n"


Expand Down
Loading