Five jobs green
Exact head a84262c passed Dependency Scanning, unit tests, production audit, worker tests, and trigger tests. The branch artifact reported zero vulnerabilities.
From scanner dead end to clean main
One repair.
Millions of weekly downloads.
extract-zip still received 13,493,850 downloads in a week.
Revival reproduced its flaw and merged a reviewed repair.
One rule: a quiet repository is not a broken package. Revival starts only after the advisory fails on untouched code.
See the full evidence path ↓From Duo fix
to your app.
GitLab Duo fixed parse-git-config after a real red regression. We installed the public upstream package and the merged repair in the same small consumer app. One hostile Git config and one ordinary remote config show both sides of the decision.
Checking the adoption evidence.
This is the earlier supervised Duo repair. The newer feature scan opened issue #7. A later supervised session stopped safely on a workload-ref mismatch; a SHA-bound retry was started but its workload never executed. No fresh repair MR is claimed. The original GitLab merge request and pipeline require project access; the tested fix and flow definition are readable here.
A repair you can adopt.
One downstream address check, the same tests, three actual executions. Compare the vulnerable package, the catalog repair, and a deliberately overbroad patch. Local package proof, not a new Duo run.
Read the unchanged consumer tests · Verify bundled package provenance · Read the consumer admission check · Read execution evidence
The check rejects octal, short, hexadecimal and mapped loopback/private addresses, preserves normal IPv4/IPv6 public addresses, and refuses malformed input without throwing. These cases do not prove every address format safe. Review the upstream repair and your own compatibility tests before adoption.
No finding, no repair: a real OSV query for is-number 7.0.0 returned zero advisories at the recorded time. Open provider response. An empty result is not a guarantee of safety.
Fresh automation trace, 26 October: the exact feature pipeline uploaded a Dependency Scanning report with one High ip finding. Its manual trigger opened issue #7. The original CI Flow request failed; a supervised Duo session then stopped safely on an ephemeral workload-ref mismatch. The published SHA guard pinned the approved source, but the supervised retry stayed queued and never executed. Read the public evidence summary; the original pipeline and issue links require project access. No fresh repair MR or green repaired consumer test is claimed.
Company finish line.
MR !4 joins the repaired packages and direct GitLab Duo flow trigger in example-shop. The cards read public GitLab state when it is available, then keep the default-branch proof separate from the captured branch receipt.
Same head reviewed
GitLab Duo review session 9977912 approved the retry-safe issue-note marker after its earlier duplicate-session concern was fixed.
Open MR !4Merge and main proof
The branch receipt is not a default-branch result. Release requires MR !4 merged, a green main pipeline at the merge SHA, and zero covered findings.
Open main pipelinesFresh repair still unproved: the scanner opened a real issue and a supervised Duo session started, but that session stopped safely and the guarded retry never executed. There is no new repair MR. The earlier merged Duo repair and its consuming-app test remain the adoption proof.
One case.
Nine receipts.
What a judge can click through for parse-git-config, 19 Oct 2026. Every step points to a real object, from the population count to the merged fix.
- Count
Find the dead that are still used
The 18 October snapshot records 2,645 npm packages at the 1,000-dependent threshold, including 781 in its abandoned_commit field (cutoff 18 October 2024).
- Pick
parse-git-config 3.0.0
Last release 20 Nov 2018. 455,081 downloads in the week to 18 Oct. Advisory GHSA-8g77-54rh-46hx, prototype pollution, HIGH, no fixed version.
- Import
Copy it into our own group
A GitLab import into our own group. No contact with the original project, nothing published.
- Red
Prove the hole before touching code
A plain Node check writes a config with a __proto__ section. The linked pipeline records the regression on untouched code. The pipeline failed, as it should.
- Fix
The smallest change that closes it
expandKeys now drops __proto__, constructor and prototype keys. See the linked repair diff and pipeline for the tests.
- Green
Every job passes
Security check, old test suite and production audit all green on the fix.
- Review
GitLab Duo reads the diff
Duo Code Review found nothing to comment on and approved. On other cases Duo asked for changes; the agent fixed them and answered in the thread.
- Merge
Back on the main branch
Merged only when Duo approved and the head pipeline was green.
- Duo flow
Then GitLab Duo wrote the fix itself
A second copy, same red test. An issue was assigned to our Duo custom flow, Revival fix. It read the advisory, fixed expandKeys, ran the regression and the old suite in a GitLab runner (17 passing, recorded in DUO-PROOF.md and the linked pipeline), and opened the merge request. The commit author is the flow service account. Duo Code Review asked for one comment to move, then approved, and it merged on a green pipeline.
issue flow merge request green pipeline 2964044246 flow definition
The GitLab evidence links open when the case projects are public. The npm and OSV links open for anyone.
Would Revival pick it?
Type an npm or PyPI name. Your browser asks the public registries directly and applies the same rule used for every case below.
Try request, extract-zip, lodash, left-pad.