🤖 CodeAnt AI — Review Status

Thanks for using CodeAnt! 🎉

We're free for open-source projects. if you're enjoying it, help us grow by sharing.

Share on X ·
Reddit ·
LinkedIn

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
worldscript-studio	Ready	Preview	Sep 29, 2026 8:24pm UTC

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

Priority: ⬇️ Low

Merge Risk: 🔵 Low · up to 328f0

Update the stale security-table entry before merging so reviewers see the current dependency versions. Automated scans use the lockfile, so the mismatch does not invalidate them.

_{Comment @coderabbitai help to get the list of available commands.}

🏁 CodeAnt Quality Gate Results

Commit: 02bec27e
Scan Time: 2026-09-29 20:46:35 UTC

✅ Overall Status: PASSED

Quality Gate Details

View Full Results

Release-truth correction before merge:

The remediation itself is correct and the exact-head Security Audit already passes, including the OSV scan. However, the PR body's release-disposition sentence “so nothing was published” is too broad.

Before the Tauri cancellation, Docker run 36618279810 had already pushed:

• ghcr.io/qnbs/worldscript-studio:1.29.0
• ghcr.io/qnbs/worldscript-studio:1.29
• ghcr.io/qnbs/worldscript-studio:latest

to digest:
sha256:1f463bc6ba1e2544b9d8c2191814c3eff50c9add81cd81d3d3927be736b3fe2d
with OCI revision cf72dc6db174ef8e7d37ccd3a47c564428fe656c.

The accurate statement is: no GitHub/Desktop Release was published; GHCR container tags were already published and must be reconciled by the v1.29.1 successor release.

Please fold this into the single correction wave with any other validated review findings. No scanner ignore/gate weakening is needed; the lockfile fix itself is already proven by the exact-head OSV gate.

Confirmed and folded in. The Docker run 36618279810 log shows manifests pushed for ghcr.io/qnbs/worldscript-studio:1.29.0, :1.29 and :latest @ sha256:1f463bc6…fe2d, before the Tauri cancel. I have corrected the PR body's release-disposition section and the #872 disposition comment. The statement now reads: no GitHub/desktop release was published; the GHCR tags were published and are reconciled by the v1.29.1 successor. I also checked that the image's runtime stage (Dockerfile lines 22–28) is nginx plus dist/ only, so joi is not in the published container either. There are no code changes, so the head stays 328f0aa8.

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ All tests successful. No failed tests found.

📢 Thoughts on this report? Let us know!

@coderabbitai Outside-diff finding (AUDIT.md Known Overrides row): valid, fixed in 1a1713e1.

I fixed the root cause as well. The actual workspace override was joi: ">=18.2.5 <19", which still admitted the affected 18.2.5. It is now ">=18.2.6 <19", and the lockfile overrides: header matches.

Both AUDIT.md statements were stale:

• the Known Overrides row, which you flagged;
• the accepted-risk note at line 143, which also said ^18.2.1.

Both now name >=18.2.6 <19, joi@18.2.9 and wait-on@7.2.0/9.1.0. The CHANGELOG entry mentions the raised floor.

@CodeAnt-AI review

#!/bin/bash
set -euo pipefail
printf 'HEAD: '; git rev-parse --short HEAD
printf '\nReferenced files:\n'
fd -i '^(AUDIT\.md|CHANGELOG\.md|package\.json|pnpm-lock\.yaml|package-lock\.json|yarn\.lock)$' .
printf '\nOverride and documentation references:\n'
rg -n -C 3 'Known Overrides|accepted.risk|joi@18\.2\.9|wait-on@|>=18\.2\.(5|6) <19|\^18\.2\.1|raised floor' --glob 'AUDIT.md' --glob 'CHANGELOG.md' --glob 'package.json' --glob 'pnpm-lock.yaml' --glob 'package-lock.json' --glob 'yarn.lock' . | head -220

#!/bin/bash
set -euo pipefail
printf 'Workspace file:\n'; fd -i '^pnpm-workspace\.yaml$' .
printf '\nWorkspace override:\n'; rg -n -C 5 'joi:|overrides:' pnpm-workspace.yaml | head -90
printf '\nChangelog current entry:\n'; sed -n '1,65p' CHANGELOG.md
printf '\nAudit accepted-risk note:\n'; sed -n '140,145p' AUDIT.md
printf '\nAudit override row:\n'; sed -n '1855,1861p;1881,1886p' AUDIT.md
printf '\nLockfile header and dependency resolutions:\n'; sed -n '1,15p;15614,15633p' pnpm-lock.yaml

@qnbs, I also verified the workspace override and changelog entry. The override, lockfile, and both AUDIT.md statements agree. The finding is addressed.

Learnt from: qnbs
URL: https://github.com/qnbs/WorldScript-Studio/pull/909

Timestamp: 2026-09-29T19:59:43.449Z
Learning: In WorldScript-Studio, the `joi` override in `pnpm-workspace.yaml` must exclude versions affected by GHSA-6h2x-m376-mqjq. The former floor `>=18.2.5 <19` admitted affected `joi18.2.5`; PR #909 raised it to `>=18.2.6 <19`. The `pnpm-lock.yaml` override must match, and both `wait-on7.2.0` and `wait-on9.1.0` resolve to `joi18.2.9`.

You are interacting with an AI system.

CodeAnt Nitpicks

CodeAnt nitpicks on 1a1713e1: both valid, fixed in 02bec27e.

1. AUDIT.md:143 chronology. That note sits in the dated v1.24.0 section. It is restored verbatim to its origin/main wording (historical record). The current joi state lives only in the Known Overrides table.

2. AUDIT.md Known Overrides path. The row now names both paths, checked against the lockfile:

   • root devDependency wait-on@9.1.0;
   • wait-on@7.2.0 ← jest-process-manager@0.4.0 ← @storybook/test-runner@0.24.5.

   The earlier arrow direction was also inverted, and that is corrected too.

@CodeAnt-AI review

Question: codeant nitpicks on 1a1713e1: both valid, fixed in 02bec27e.

1. audit.md:143 chronology. that note sits in the dated v1.24.0 section. it is restored verbatim to its origin/main wording (historical record). the current joi state lives only in the known overrides table.

2. audit.md known overrides path. the row now names both paths, checked against the lockfile:

   • root devdependency wait-on@9.1.0;
   • wait-on@7.2.0 ← jest-process-manager@0.4.0 ← @storybook/test-runner@0.24.5.

   the earlier arrow direction was also inverted, and that is corrected too.

review

Answer:
Both CodeAnt nitpicks are valid and appear correctly addressed in 02bec27e:

1. Chronology in AUDIT.md
   The note in the dated v1.24.0 section has been restored to the historical origin/main wording, avoiding retroactive changes to the audit record. The current joi remediation is documented in the Known Overrides table instead.

2. Known Overrides dependency path
   The joi row now accurately identifies both dependency paths:

   • Root dev dependency: wait-on@9.1.0
   • Transitive path: @storybook/test-runner@0.24.5 → jest-process-manager@0.4.0 → wait-on@7.2.0

   The arrow direction has also been corrected to reflect the dependency flow. The lockfile confirms that both wait-on versions now resolve to joi@18.2.9, while the workspace override enforces the secure floor >=18.2.6 <19.

No further issues are apparent from these questions.

@CodeAnt-AI review

CodeAnt nitpick on 02bec27e (AUDIT.md:143 vs 1884): deferred, with a recorded destination.

This contradicts the previous nitpick on 1a1713e1, which asked for line 143 (in the dated v1.24.0 section) not to carry v1.29-era content. Here is the resolution that satisfies both:

• keep the historical wording;
• append a neutral forward pointer ("range later raised; current value in the Known Overrides table").

That is a P3 doc-consistency edit with no effect on the fix. It goes into the v1.29.1 release-prep PR, which edits AUDIT.md anyway, so the full CI matrix is not restarted here. The authoritative current state (>=18.2.6 <19, joi@18.2.9, both paths) is already in the Known Overrides row, pnpm-workspace.yaml and the lockfile.