Repository navigation
Conversation
Allow absent package name and version metadata, and default an omitted type field to commonjs. Add regression coverage for dependency-only manifests. Work performance by GPT-5, reviewed by me. Signed-off-by: Andrew Lilley Brinker <abrinker@mitre.org> Change-Id: I21846c935d4b87e40232f3a6bbddb8d56a6a6964
Move package.json parsing and package-name validation into nv-common, then update nv-server to consume the shared parser API. Work performance by GPT-5, reviewed by me. Signed-off-by: Andrew Lilley Brinker <abrinker@mitre.org> Change-Id: Ica65426727c87669db668a03350627296a6a6964
Represent package.json type with a validated enum, default missing values to CommonJS, and reject unknown module kinds. Work performance by GPT-5, reviewed by me. Signed-off-by: Andrew Lilley Brinker <abrinker@mitre.org> Change-Id: Ifda68d26b8bbe9cf558b3e78e44092186a6a6964
Move npm package, dependency, specification, and range types into a shared module while preserving packument error and public API compatibility. Work performance by GPT-5, reviewed by me. Signed-off-by: Andrew Lilley Brinker <abrinker@mitre.org> Change-Id: I5117939fd4e693358c2f1c96cf02467b6a6a6964
Use one structured modern package-name parser for package.json and packuments, while retaining historic uppercase names only for dependency keys. Work performance by GPT-5, reviewed by me. Signed-off-by: Andrew Lilley Brinker <abrinker@mitre.org> Change-Id: Iab8b16b272e914f4c866c59b16e91f796a6a6964
Use common typed dependency maps, peer metadata, and bundled dependencies for package manifests and packuments. Add typed manifest overrides, workspaces, and cross-parser regression coverage. Work performance by GPT-5, reviewed by me. Signed-off-by: Andrew Lilley Brinker <abrinker@mitre.org> Change-Id: I042fa919a8b39af989606dd5b6239c796a6a6964
Treat bundleDependencies: true as every declared dependency in package manifests and packuments. Preserve the empty result for false or absent fields, and add regressions covering both parser paths. Signed-off-by: Andrew Lilley Brinker <abrinker@mitre.org> Change-Id: Ied14a9b23ae569c5485889ce0c34eddd6a6a6964
Add table-driven manifest cases, cross-parser assertions, a complex fixture, dependency retention checks, and property-based parser coverage. Signed-off-by: Andrew Lilley Brinker <abrinker@mitre.org> Change-Id: I6dc2357e715a05d03a96989451494f7a6a6a6964
Add typed root candidates, dependency-reference overrides, GitHub shorthand, and bounded package.json reads. Cover parser specifications, reader behavior, and metamorphic dependency invariants. Signed-off-by: Andrew Lilley Brinker <abrinker@mitre.org> Change-Id: I8e6fa53936923c5f5be86a501d835b326a6a6964
Provide Cargo Mutants through Flox, document the focused parser workflow. Cover the document-size contract exposed by the first mutation baseline. Signed-off-by: Andrew Lilley Brinker <abrinker@mitre.org> Change-Id: I885374e5f4b7b1c3c1fe43636ec9e8b26a6a6964
Signed-off-by: Andrew Lilley Brinker <abrinker@mitre.org> Change-Id: I5d20a3922fae23a50ab37ad4c5c6341b6a6a6964
Document copying pinned upstream Flox CI images to MITRE Artifactory, including the verified 1.14.0 command, digest pinning, and update steps. Signed-off-by: Andrew Lilley Brinker <abrinker@mitre.org> Change-Id: I440115891b5a4aa31ad3c3415a99b4bf6a6a6964
Run Compose configuration validation on the Docker-capable self-hosted runner. Add GNU sed to the Flox environment for shell scripts and frontend package wrappers. Normalize the Cargo lockfile so Cargo 1.95 accepts it with --locked. Signed-off-by: Andrew Lilley Brinker <abrinker@mitre.org> Change-Id: Id56412c61bb785b8a6d46f3a535331276a6a6964
Match the unescaped JSON body included in the health-check error message so the 500-response regression test passes. Signed-off-by: Andrew Lilley Brinker <abrinker@mitre.org> Change-Id: I47848c04883886c904aa5a40238aa6286a6a6964
Use display formatting for failed health response bodies so error output retains unescaped JSON and the regression test matches the API response. Signed-off-by: Andrew Lilley Brinker <abrinker@mitre.org> Change-Id: I25aae6e0468a5bc2b5462c7984649fb86a6a6964
Add Unix-only runtime debug-log toggling for nv-server via SIGUSR1. Defaults to false, so default behavior remains unchanged.
Dynamic debug filtering previously ran in the async log worker, so disabled debug records still occupied the bounded queue and could cause later warning/error records to be dropped during a burst. Move the filter ahead of the queue and implement is_enabled so suppressed records are rejected before enqueueing. Add a regression test for dynamic debug enablement. Work performance by GPT-5, reviewed by me. Signed-off-by: Andrew Lilley Brinker <abrinker@mitre.org> Change-Id: I7809759ee0b2e605763fae93351014436a6a6964
Signed-off-by: Andrew Lilley Brinker <abrinker@mitre.org> Change-Id: I6c9f53839ef1e727577630f9c07f27ab6a6a6964
Derive concrete NPM dependency names from v2/v3 package-lock paths, including scoped names. Add lockfile fixtures that cover unscoped and scoped dependencies. Work performance by GPT-5, reviewed by me. Signed-off-by: Andrew Lilley Brinker <abrinker@mitre.org> Change-Id: I36045bd292829bdbd09676146d67fc176a6a6964
Decode percent-encoded NPM package URL paths before extracting package names so scoped packages match their lockfile entries. Add a regression test for an encoded scoped PURL. Work performance by GPT-5, reviewed by me. Signed-off-by: Andrew Lilley Brinker <abrinker@mitre.org> Change-Id: Ifb18357207fe3ccd79c871521e036f506a6a6964
Fetch active CVE records for all KEV entries in one query and index them by CVE ID. Add a mock database test to prevent the N+1 lookup from returning. Work performance by GPT-5, reviewed by me. Signed-off-by: Andrew Lilley Brinker <abrinker@mitre.org> Change-Id: Ic5a0d76b0870037a706b230449546c606a6a6964
feat(frontend): Changes to code generation from OpenAPI spec on frontend fix(backend) fix pnpm issues and generation issues fix failed jobs
Signed-off-by: Andrew Lilley Brinker <abrinker@mitre.org> Change-Id: I005085f697d4ac9134662038a48b8c956a6a6964
fix error fix error fixed for failed backend:clippy tests
Reject malformed NPM package URLs and invalid source repository URLs before accepting Hipcheck reports. Add regression tests for invalid targets. Signed-off-by: Andrew Lilley Brinker <abrinker@mitre.org> Change-Id: I367c169e02908cbf4050cbc8887777be6a6a6964 edited report.rs to fix unchecked index arithmetic in Hipcheck percent-encoding validation which was causing failed jobs
Updates `xtask lint` to catch crates which are present in the backend workspace but not registered in the workspace-level `Cargo.toml`. Signed-off-by: Andrew Lilley Brinker <abrinker@mitre.org> Change-Id: Ia6eec6b78b744d7b469127c88b07f5376a6a6964
Compare discovered manifests against paths listed in the workspace instead of package-name suffixes, so similarly named unregistered crates are reported. Signed-off-by: Andrew Lilley Brinker <abrinker@mitre.org> Change-Id: Iace576aea75252fdfe4bfe34884a0b456a6a6964
Detect Cargo manifests from path components so unregistered-crate checks work on native Windows. Remove the no-longer-needed regex dependency. Signed-off-by: Andrew Lilley Brinker <abrinker@mitre.org> Change-Id: Icb84accc9df92f4611802c36799a0b786a6a6964
…patibility could not be evaluated
…kage_source resolve #102
…ckage_source resolve #102
…ng stops the timer
Keep polling alive when package-source status checks fail with retryable API errors, and stop only on non-retryable failures or true terminal statuses; update the polling regression tests to cover both retryable and non-retryable error paths. Generated by Chatgpt5.4, reviewed by Chris Lenk.
npm installs devDependencies only for the project being developed, never for its dependencies. Following them pulled in each dependency's test and build tooling, where wildcard ranges fanned out across much of the registry: a manifest depending only on left-pad@1.3.0 ran until the five-minute resolution timeout. - Skip devDependencies of published packages; the package source's own devDependencies are still followed - Parse and sort each package's published versions once per run instead of on every range resolution - Document which npm dependency kinds resolution follows
The upgrade_assessments status check constraint allows only processing, completed, and failed, but new assessments were inserted as pending. Every POST /upgrade-assessments against Postgres violated the constraint and returned 500. The unit tests use a mock database, which does not enforce constraints, so they did not catch it. Insert new assessments as processing. Reads already report a processing assessment to clients as pending, so the API response is unchanged.
Generated by Chatgpt5.4, reviewed by Chris Lenk.
… read models #92 fix(ci): include assessment read models and generated client
Discovery-style assessments can complete without selecting a candidate. The exposure detail read model only derived `verdict` from the selected candidate, so these completed assessments returned `verdict = null` even when the report itself had a verdict. Fall back to the completed report verdict so the exposure-to-verdict flow still works before candidate selection. Generated by Chatgpt5.4, reviewed by Chris Lenk.
The work queue was incrementing coverage counters before applying `view` and `search` filters, so filtered results could show counts inflated by hidden items, violating the contract that coverage refers only to the returned page; this change moves counting behind the visibility check and adds regression tests for filtered and source-status rows. Generated by Chatgpt5.4, reviewed by Chris Lenk.
Signed-off-by: Michael Chernicoff <mchernicoff@mitre.org>
mchernicoff
added
the
type: refactor
mchernicoff
enabled auto-merge
September 25, 2026 18:53
github-merge-queue
Bot
removed this pull request from the merge queue due to a conflict with the base branch
Sep 25, 2026
github-merge-queue
Bot
removed this pull request from the merge queue due to a conflict with the base branch
Sep 25, 2026
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This merge brings Night Vision into Hipcheck so the assessment-centric Night Vision product workflow and the Hipcheck analysis engine can evolve together in one repository.
Motivation
Night Vision’s architecture uses Hipcheck as its supply-chain analysis engine rather than maintaining a separate native analyzer. Consolidating the repositories reduces duplication, simplifies ownership of the integration boundary, and makes it easier to evolve reporting, plugins, and evidence handling together.
What’s included
Note
This is an MVP and prototype. While the backend is complete and supports the end-to-end package source assessment workflow, portions of the frontend need further development.