cesnimda
4.1 KiB
17 October 2026 release repair
The owner authorized promotion of completed e7dba9a to main despite existing production NO-GO qualifications, then requested deployment first, qwen3.5:9b-q4_K_M on Ollama second, and continued Phase 7 work afterward. Unfinished Settings/import/company changes remain outside this release repair.
Deployment findings
Gitea run 820 initially failed during parser dependency installation: one attempt segfaulted and subsequent downloads failed locked hashes. An unchanged-release retry failed during Git checkout with a corrupt pack. A later attempt passed these stages and the backend checks, then failed the frontend audit with 19 moderate, 9 high and 1 critical findings.
The NumPy lock hash was already correct. Independent Windows verification and three fresh downloads on the supplied runner host matched the published SHA-256 and passed ZIP CRC checks. The host had rebooted between the earlier failures and these checks; the underlying integrity incident is not diagnosed or declared repaired. Hash enforcement and all ordinary test gates remain enabled.
Server source edits were preserved privately at /home/pi/.local/state/jobjakt/pre-release-source-20261017T185504Z. The only content change was GOMAXPROCS=1 for bundled Ollama, which this repair retains. The deploy script's executable bit is already restored by the deployment workflow. No database, volume or user data was reset.
Bounded dependency changes
| Dependency | Locked before | Locked after |
|---|---|---|
| Next.js and matching ESLint/SWC packages | 16.3.4 | 16.3.8 |
| Axios | 1.19.0 | 1.20.0 |
| brace-expansion | 2.1.4 | 2.1.7 |
| sharp and its matching platform payloads | 0.35.4 | 0.35.5 |
| source-map-js | 1.2.1 | 1.2.2 |
React, MUI, routing, application data owners and PDF geometry are unchanged. The production-only audit reports zero vulnerabilities.
Explicit temporary development exception
The owner separately approved GHSA-vfj7-8cjw-p6xm in dev-only braces through 31 October 2026 UTC. The upstream advisory lists no patched version. Its five linked audit nodes are braces, micromatch, fast-glob, @next/eslint-plugin-next and eslint-config-next; this is one advisory, not five independent accepted vulnerabilities.
The audit checker accepts only that high-severity origin, the explicit existing chain, braces 3.0.3, and lockfile nodes marked development-only. Production copies, another advisory, critical severity, missing data/nodes, cyclic origins and expiry fail closed. Full audit JSON is saved and printed in CI. All other high/critical findings remain blocking; the existing moderate threshold is retained. The raw full audit still reports the accepted development findings; they are not described as fixed.
Nine ordinary policy tests cover the exception and its rejection boundaries. The previous strict policy was captured failing the approved exception, and a critical-origin edge case was separately reproduced and repaired. The exception must be removed when upstream supplies a fix or explicitly reviewed before expiry; it does not authorize a future blanket bypass.
Verification and remaining work
Application TypeScript, lint, production build, backend Release compilation, production audit, policy tests and supply-chain/ingress tests pass. Settings persistence, authentication/account isolation and ordinary P2-D01 browser journeys pass (16 cases, zero skipped/flaky).
Fresh full frontend execution passed 824 tests across 95 suites, with zero skipped or pending cases (18:49-18:58 UTC). The nine separate audit-policy cases also pass. Supply-chain and ingress checks each passed three cases; whitespace and the tracked-secret scan passed. No existing test counts were reduced. Evidence is retained in the local release-20261017 artifact directory. CI and deployed runtime identity must be checked after promotion. Existing ingress, complete backup/restore, rollback, human accessibility/device and production-output qualifications remain open; deployment authorization does not convert them to verified GO. P5-13 stays withheld and no model qualification or Phase 8 work is enabled.