judgeRunRecord lets a forged record settle a waiting approval gate to skipped without an approve

28m ago

#3983

Extension dependencies: the shared import scan reads Babel syntax, not tokens (follow-up to #3969)

s55m ago

#3272

swamp-extensions: use explicit npm:/jsr: specifiers in root extensions/models

s1h ago

#3998

bundleExtension same-cache test can pass with a broken first-bundle gate under CPU load

1h ago

#3639

bundleExtension 'bundles on different caches do not wait for each other' test fails under CPU load

s1h ago

#3383

extension pull: safety analysis scans the bundle the extension runs

s12h ago

#3979

Extension scoring queue: two replicas can claim the same pending event

s13h ago

#3995

Registry: bump @swamp-club/extension-scoring to the version carrying #3983 (and #3845) before the v5 rescore

13h ago

#3994

Five Mongo queues can hand the same row to two replicas

6h ago

#3863

Registry rescore: secret-safe-docs passes a secret README line on versions whose stored metadata predates the sensitive flag (follow-up to #3783)

s14h ago

#3977

Score extensions with @swamp-club/extension-scoring (rubric v5) instead of the registry's own copy

s16h ago

#3991

Move the Zod argument-field extractor into @swamp-club/extension-scoring so the CLI and registry read schemas alike

16h ago

#3969

Extension dependencies: one resolver for push, quality and fmt (no behaviour change)

s16h ago

#3989

Docs: extension quality scores with the registry formula and reports grade (swamp-club#3845)

s2h ago

#3980

Rescore every extension's current version under rubric v5

18h ago

#3153

extension push: a swamp-quality-ignore directive after a comment holding an apostrophe is silently ignored

18h ago

#3781

Share the extension quality rubric between the swamp CLI and swamp-club instead of mirroring it

s19h ago

#3974

Manual: the supported extension dependency categories, the canonical form and the lock rule, rewritten once against the final design

19h ago

#3973

Registry audits v2 extension archives as written, and a range costs the loose point only without a valid lock

19h ago

#3972

Extension consumers keep the publisher's bundle: pull, update and auto-resolve stop rebuilding (direction A for #3634)

19h ago

#3971

Extension push: inputs that open up (workspace root lock, ancestor config refused by name, JSR dist-tags) and the skill docs rewritten once

19h ago

#3970

Extension push ships the canonical form: every npm:/jsr: import pinned exact, and a v2 dependency-audit.json

s23m ago

#3828

stagecraft studio: show a factory's open tickets that have no work item yet on the Board

s23h ago

#3964

stagecraft studio ticket columns: round-5 review lows from #3828 (source watch cost, relationText lookup, cross-instance claim)

23h ago

#3963

A long-lived serve client for extensions, and a stable rate_limited error code

23h ago

#3725

Docs: dependency trust across push, quality, fmt and the registry — Deno-config resolution, read-only lock, package.json mode, the archive's audit record (merges #3728)

s23h ago

#3793

extension push (package.json mode): two installed copies under one declared range are audited once, so the second shipped version goes unaudited

s1d ago

#3772

cve/emudhra page: Windows and macOS support, and shared CVE layer fixes (follow-up to #3710 and #3766)

s2d ago

#3775

@swamp/cve/php-rce-2026-10: match RHEL fixes for the PHP RCEs

s2d ago

#3776

@swamp/cve/dirtyfrag: report and README print the old swamp model command spelling

3d ago

#3870

package.json mode: no loose-specifier warning for a range push ships as the exact installed version

3d ago

#3869

extension fmt (and any command) creates or rewrites deno.lock when the extension lives in the repo's loaded extensions/ dir

s1h ago

#3826

method run masks a sensitive array from --input element by element, exposing its shape (regression from #3752)

s3d ago

#3783

Registry scorecard: score secret-safe-docs (rubric v4) and keep sensitive on extracted arguments

s3d ago

#3778

Registry dependency audit: audit the locked version push records in the archive, not the registry's newest match for a range specifier (swamp-club half of #3662)

s3d ago

#3855

stagecraft: rename work mode `method` to `behavior`, matching swamp's rename of models to behaviors

3d ago

#3662

extension push: record each dependency's audited (locked) version in the archive, so the registry audits what ships (swamp half; registry half #3778)

s3d ago

#3796

main fails type check: query_view_test.ts passes a namespace string where expressionQueryView now takes a NamespaceReader (semantic conflict between #3790 and #3785)

s4d ago

#3795

forEachNameWithoutSecrets property test fails intermittently: an empty-string secret and an overlapping recorded value give different names

4d ago

#3782

extension push finds no local modules when a folder above the repo is named node_modules

4d ago

#3630

extension push (package.json mode): audit dependencies resolved through package.json, and leave the author's node_modules/ unchanged (merges #3632)

s4d ago

#3764

Local verification docs still tell agents to put ANTHROPIC_API_KEY in verify.env for reviews

s4d ago

#3770

@swamp/cve/php-rce-2026-10 follow-ups: dry-run heading, command spelling, Debian 12 fix, podman image scan

s5d ago

#3612

extension push resolves the Deno config and import map the way Deno does: deno.jsonc, importMap file references and scopes

s5d ago

#3717

extension fmt --check writes deno.lock in deno.json mode, which push and quality then bundle against with --frozen

s5d ago

#3720

@swamp/cve/dirtyfrag: scan logs are never saved (file writer handle dropped, data name collides with the status resource)

5d ago

#3715

audit_deps.ts skips cve/ extensions, so their deno.lock files are never dependency-audited

s5d ago

#3719

@swamp/cve/dirtyfrag README shows --input targetHost/sshUser/sshKey/dockerContainer, which the CLI rejects

5d ago

#3716

@swamp/cve/dirtyfrag mitigate uses interactive sudo, so it can hang on a password prompt or fail mid-run

s5d ago

#3718

extension quality names the wrong cause: a bundle failure prints no reason, the not-audited row always blames an outage, and symbols-docs blames JSDoc when deno doc failed

s5d ago

#3728

Docs: extension fmt never writes deno.lock and warns on a stale one (swamp-club#3717)

3d ago

#3631

Docs: extension dependency trust pages — import-map auditing, bare-import rewrite and scoring, and the clarified warning/error plan

5d ago

#3682

Registry scorecard: a loose specifier costs one of the two dependency-trust points and a yanked one costs both, matching the CLI (#3354)

s5d ago

← Back to list

01Issue

FeatureShippedExtensionsPublic

Assigneesstack72

Relationships

#3775 @swamp/cve/php-rce-2026-10: match RHEL fixes for the PHP RCEs

Opened by skunk-ape · 10/22/2026· Shipped 10/24/2026

PR #552: https://git.swamp-club.com/swamp-club/swamp-extensions/pulls/552

Found while triaging #3770. Red Hat has fixed CVE-2026-109618 and CVE-2026-109619 for RHEL 8, 9 and 10 (RHSA-2026:87070, 87071, 87072, 87073, 87079, 87080, 87151; RHEL 9 php:8.4 still listed Affected as of 2026-10-22). The extension cannot use these: DISTRO_FIXES is Debian/Ubuntu only and verdictFor compares Debian version strings, so RHEL builds below the upstream fix are always check-vendor unless dnf has an update pending. RHEL 8 and 9 publish module stream builds (php:8.2-9080020261020145734.9), not package NVRs, so matching needs a mapping from the installed rpm to its module build, or a comparison against the fixed package NVR from the RHSA. Scope: add rpm version comparison and RHEL rows to the tracker table, with tests and README.

02Bog Flow

Shipped

10/24/2026, 10:35:42 PM

Click a lifecycle step above to view its details.

03Sludge Pulse

stack72 assigned stack7210/24/2026, 8:36:38 PM

system commented 10/22/2026, 2:12:30 PM

Classified automatically when this issue was filed.

Source: Extensions

If you feel this classification is incorrect, add a ripple to tell us so.