Harden 36 reachable security findings across runtime, install, parsers, http - #30722

Merged

Jarred-Sumner merged 6 commits into

mainfrom

claude/vuln-triage-fixes

May 16, 2026

Commits on May 14, 2026

Harden 36 reachable security findings across runtime, install, parsers, http
Jarred-Sumner
committed
ffa0ca0
Bound encoded SCRAM salt length before decode_alloc
Jarred-Sumner
committed
f5a76d5
Validate lockfile resolution tag on raw bytes; recoverable randomFill OOM
Jarred-Sumner
committed
1c78d7d
Address review findings on security hardening pass
Jarred-Sumner
committed
7f6e47f
Close remaining if-keyword classifiers and capture handlers across close callbacks
Jarred-Sumner
committed
74bc9af

Commits on May 15, 2026

Apply bunx cache trust check to all execution paths
Jarred-Sumner
committed
d9f2e8f