run-llama / llama-agents / 27030259463
84%

DEFAULT BRANCH: main
Ran
Jobs 12
Files 225
Run time 1min
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst
coverage: 83.206%. Remained the same
27030259463

push

github

web-flow 
chore(deps): bump dulwich from 1.1.0 to 1.2.5 (#645)

Bumps [dulwich](https://github.com/dulwich/dulwich) from 1.1.0 to 1.2.5.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/dulwich/dulwich/releases">dulwich's
releases</a>.</em></p>
<blockquote>
<h2>dulwich 1.2.5</h2>
<p>This is a security release. All users are encouraged to upgrade.</p>
<h2>Security fixes</h2>
<ul>
<li>
<p><strong>GHSA-gfhv-vqv2-4544</strong> -- Validate submodule paths in
<code>porcelain.submodule_update</code> (and thus
<code>porcelain.clone(recurse_submodules=True)</code>). A crafted
upstream repository could carry a submodule whose path was
<code>.git/hooks</code> (or any other path inside <code>.git</code> or
above the work tree), causing the submodule's tree contents to be
written there with their executable bits intact. The dulwich analogue of
git's CVE-2024-32002 / CVE-2024-32004. (Reported by tonghuaroot)</p>
</li>
<li>
<p><strong>CVE-2026-42305</strong> -- Harden tree path validation
against entry names that are harmless on POSIX but dangerous when
checked out on Windows. <code>validate_path_element_ntfs</code> now also
rejects Windows path separators, the alternate data stream marker
<code>:</code>, NTFS 8.3 short-name aliases of <code>.git</code>, and
reserved Windows device names. <code>core.protectNTFS</code> now
defaults to true on every platform, and both
<code>core.protectNTFS</code> and <code>core.protectHFS</code> are now
read under their correct option names. (Reported by Christopher
Toth)</p>
</li>
<li>
<p><strong>CVE-2026-42563</strong> -- Shell-quote values substituted
into <code>ProcessMergeDriver</code> commands. A malicious branch could
inject shell commands when a merge driver referencing <code>%P</code>
was configured. (Reported by Ravishanker Kusuma (hayageek))</p>
</li>
<li>
<p><strong>CVE-2026-47712</strong> -- Sanitize commit subjects used in
<code>porcelain.format_patch</code> filenames so a malicious subje... (continued)

16365 of 19668 relevant lines covered (83.21%)

1.09 hits per line

Jobs
ID Job ID Ran Files Coverage
1 llama-index-workflows - 27030259463.1 44
92.89
 GitHub Action Run
2 llama-agents-dbos - 27030259463.2 11
71.31
 GitHub Action Run
3 llama-index-utils-workflow - 27030259463.3 1
70.78
 GitHub Action Run
4 llama-agents-core - 27030259463.4 15
81.34
 GitHub Action Run
5 llama-agents-server - 27030259463.5 30
80.88
 GitHub Action Run
6 llamactl - 27030259463.6 48
79.78
 GitHub Action Run
7 llama-agents-integration-tests - 27030259463.7 92
66.77
 GitHub Action Run
8 llama-agents-agentcore - 27030259463.8 5
70.22
 GitHub Action Run
9 llama-agents-control-plane - 27030259463.9 31
73.2
 GitHub Action Run
10 llama-agents-client - 27030259463.10 4
87.99
 GitHub Action Run
11 llama-agents-appserver - 27030259463.11 17
80.66
 GitHub Action Run
12 llama-agents-dev - 27030259463.12 12
76.5
 GitHub Action Run
Source Files on build 27030259463