Uh oh!
There was an error while loading. Please reload this page.
chore: bump vendor/zoekt with CodeQL security fixes - #1141
Conversation
Pulls in sourcebot-dev/zoekt#13 (open), which resolves all open CodeQL security alerts on the zoekt repo: - go/clear-text-logging (high) in gitindex/clone.go - go/incorrect-integer-conversion (high) in api.go and zoekt-sourcegraph-indexserver/sg.go - actions/missing-workflow-permissions (medium x8) in ci.yml and buf-breaking-check.yml - actions/untrusted-checkout/high (high) in semgrep.yml Also carries through the dependency bumps from sourcebot-dev/zoekt#11 and #12 (go-git 5.18.0, grpc 1.80.0, otel 1.43.0) that were merged after #1140 so weren't included when main shipped the original zoekt sync. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
@msukkari your pull request is missing a changelog! |
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
✅ Files skipped from review due to trivial changes (1)
WalkthroughUpdates the Changes
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~2 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@vendor/zoekt`:
- Line 1: The vendor/zoekt submodule is pointing to the feature branch tip
commit 945c3e96 (msukkari/codeql-fixes) which is unstable; wait for
sourcebot-dev/zoekt#13 to be merged to main, then update the vendor/zoekt
gitlink to the exact merge commit on zoekt@main (replace the current
msukkari/codeql-fixes pointer), run git submodule sync && git submodule update
--init --recursive to fetch the new commit, and re-run the project tests to
confirm the merge commit works correctly before merging this PR.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
| @@ -1 +1 @@ | |||
| Subproject commit da9bf1a3c96b438268e2692c4b4fd7a3d341c2c9 | |||
| Subproject commit 945c3e96b253d242b2f2f31df872e81cacaa3bf3 | |||
There was a problem hiding this comment.
Critical: Submodule points to feature branch instead of main branch.
The submodule currently references commit 945c3e96 from the feature branch msukkari/codeql-fixes. As stated in the PR objectives, this pointer must be updated to the eventual merge commit on zoekt@main once sourcebot-dev/zoekt#13 is merged.
Referencing a feature branch tip is risky because:
- The branch may be rebased, force-pushed, or deleted after merging
- This breaks reproducibility and can cause
git submodule updatefailures - Production submodules should point to stable commits on the main branch
Action required: Do not merge this PR until:
sourcebot-dev/zoekt#13is merged to main- The submodule pointer is updated to reference the merge commit on main
- Testing is re-run to confirm the merge commit works correctly
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@vendor/zoekt` at line 1, The vendor/zoekt submodule is pointing to the
feature branch tip commit 945c3e96 (msukkari/codeql-fixes) which is unstable;
wait for sourcebot-dev/zoekt#13 to be merged to main, then update the
vendor/zoekt gitlink to the exact merge commit on zoekt@main (replace the
current msukkari/codeql-fixes pointer), run git submodule sync && git submodule
update --init --recursive to fetch the new commit, and re-run the project tests
to confirm the merge commit works correctly before merging this PR.
sourcebot-dev/zoekt#13 merged as 7c6c629f. Updating the submodule pointer from the feature-branch tip (945c3e96) to the merge commit on main so vendor/zoekt tracks canonical history before merging. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
sourcebot-dev/zoekt#10 was squash-merged into zoekt@main, which flattened the merge commit and left GitHub reporting the fork as 108 commits behind sourcegraph/zoekt:main even though all upstream content was present. Fixed by performing a 'git merge -s ours upstream/main' on zoekt@main: this records upstream/main as a second parent without changing any files, restoring the ancestry link. Bumping this submodule pointer from 7c6c629f (the previous main tip) to df983ea1 (the new merge-ours commit). The vendored tree content is byte-identical to 7c6c629f; only the commit graph is different. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
msukkari
commented
Apr 21, 2026
Bumped Root cause:sourcebot-dev/zoekt#10 was squash-merged, which collapsed the merge commit into a single-parent commit. The upstream content was present in the tree but Fix: ran Impact on this PR: none functionally — the vendored content didn't change. The submodule pointer is now on the canonical |
Summary
Bumps
vendor/zoektfromda9bf1a3(current main — zoekt upstream sync) to945c3e96, which includes:chore: resolve open CodeQL security alerts zoekt#13 (open) — resolves all 12 open CodeQL alerts on zoekt:
go/clear-text-logging(high): redact URL userinfo before logginggit cloneargs ingitindex/clone.go.go/incorrect-integer-conversion(high): use size-matched parsers inapi.go(Atoifor tenantID) andcmd/zoekt-sourcegraph-indexserver/sg.go(ParseUint(_,10,32)for SG_ID).actions/missing-workflow-permissions(medium × 8): add top-levelpermissions: contents: readtoci.ymlandbuf-breaking-check.yml.actions/untrusted-checkout/high(high): switchsemgrep.ymltrigger frompull_request_targettopull_requestso PR code is no longer checked out in a trusted context with access to secrets.Carries through chore: bump go-git/v5 to 5.18.0 (GHSA-3xc5-wrhm-f963) zoekt#11 (merged) —
go-git/v55.17.0 → 5.18.0 for GHSA-3xc5-wrhm-f963 (Dependabot Filter symbols by kind #16).Carries through chore: bump grpc and otel to patch GHSA alerts zoekt#12 (merged) —
google.golang.org/grpc1.75.0 → 1.80.0 andgo.opentelemetry.io/otel*1.42.0/1.33.0 → 1.43.0 for Dependabot Add 'install' event that is fired once on first run #11 (critical), FR: Support indexing code hosted on a local Bitbucket instance #14 (medium), and Support Line Number Highlighting #15 (high).These last two weren't in #1140's final squash because their respective zoekt merges landed after the Sourcebot PR merged.
Important
The submodule pointer in this PR currently references the feature-branch tip of sourcebot-dev/zoekt#13 (
945c3e96). Once #13 merges to zoekt@main, this pointer must be re-pinned to the resulting merge commit before this PR lands.Test plan
yarn build— full monorepo build passes topologically across all 10 packages.yarn test— all test workspaces pass: queryLanguage 269/269, shared 32/32, backend 122/122, web 295/295.go build -C vendor/zoekt -o bin ./cmd/...— all 18 zoekt binaries build.go build ./...andgo test -count=1 -short ./...pass across all 24 zoekt packages.repo:,sym:, streaming search,/api/source, and/api/reposall return expected data.Summary by CodeRabbit