fix(codeql): reject non-canonical dispatch repository identities - #2271

Draft

seonghobae wants to merge 21 commits into

mainfrom

fix/codeql-dispatch-repository-identity

Commits on Sep 18, 2026

fix(security): allowlist https://api.github.com before urllib urlopen

seonghobae
and
cursoragent
committed
a83d6d3
test(codeql): reproduce non-canonical dispatch repository identity
seonghobae
committed
2167dae
test(codeql): pin repository admission failure boundary
seonghobae
committed
10a87ab
fix(codeql): reject non-canonical dispatch repositories
seonghobae
committed
2b849c8
test(security): pin GitHub API redirect credential boundary
seonghobae
committed
225260a
fix(security): contain GitHub API redirects to admitted origin
seonghobae
committed
0ae2204
test(security): pin Strix redirect credential boundary
seonghobae
committed
062663a
fix(security): contain Strix GitHub API redirects
seonghobae
committed
2708a6b
chore(deps): bump anyio from 4.14.0 to 4.14.2
dependabot[bot]
authored
3758b89

Commits on Sep 19, 2026

test(security): align Strix transport seam with dedicated opener
seonghobae
committed
4dcd25c
test(security): bind authenticated openers at owned seams
seonghobae
committed
834d285
Merge URL authority owner into CodeQL repository identity
seonghobae
committed
c3a4d51
fix(codeql): emit invalid dispatch identity errors on stderr
seonghobae
committed
9501aea
test(codeql): assert dispatch admission errors on stderr
seonghobae
committed
055ee9b
Merge current URL authority evidence owner
seonghobae
committed
8aff1a6
merge(security): carry #2269 urllib GitHub API opener into #2278
seonghobae
committed
6d10002
chore(deps): isolate AnyIO security owner delta
seonghobae
committed
545648e
merge: carry AnyIO lock update onto protected owner
seonghobae
committed
c51c8d2
Merge protected main after #2279 admission
seonghobae
committed
a0e1424

Commits on Sep 20, 2026

fix(deps): restore AnyIO owner isolation
seonghobae
committed
8a5251b
fix(codeql): adopt canonical AnyIO security owner
seonghobae
committed
8da5f48