Repository navigation
feat(app): report stale and ambiguous suppression entries - #9087
Draft
isaacroldan wants to merge 7 commits into
Draft
isaacroldan wants to merge 7 commits into
isaacroldan wants to merge 7 commits into
Conversation
Contributor
Differences in type declarationsWe detected differences in the type declarations generated by Typescript for this branch compared to the baseline ('main' branch). Please, review them to ensure they are backward-compatible. Here are some important things to keep in mind:
New type declarationsWe found no new type declarations in this PR Existing type declarationspackages/cli-kit/dist/public/node/upgrade.d.ts@@ -5,11 +5,9 @@ export { getAutoUpgradeEnabled, setAutoUpgradeEnabled };
* Utility function for generating an install command for the user to run
* to install an updated version of Shopify CLI.
*
- * @param version - The version or dist-tag to install. Homebrew can't
- * install a specific version, so it always upgrades to the formula's current version.
* @returns A string with the command to run, or undefined if the package manager cannot be determined.
*/
-export declare function cliInstallCommand(version: string): string | undefined;
+export declare function cliInstallCommand(): string | undefined;
/**
* Options for {@link runCLIUpgrade}.
*/
@@ -21,13 +19,6 @@ export interface RunCLIUpgradeOptions {
* their `package.json` / lockfile in the background.
*/
autoupgrade?: boolean;
- /**
- * The exact version to install. The auto-upgrade hook passes the version it already
- * vetted, such as one that isn't a major version change, so the install can't drift to
- * whatever `latest` points at by the time the package manager runs. When omitted, the
- * CLI installs `latest`.
- */
- version?: string;
}
/**
* Runs the CLI upgrade using the appropriate package manager.
|
4 tasks
isaacroldan
force-pushed
the
clisec/CLISEC-11
branch
from
November 6, 2026 12:40
c63b9df to
26da4d3
Compare
An entry of shopify.app-security.json that matches nothing, or whose code matches more than one finding, suppresses nothing. Since patch 5, `--json` gives each entry a status, but the text output of `check` and `review` lists only the entries that matched. So a stale or ambiguous entry goes unnoticed by anyone who reads the text. - Text, without `--verbose`: `check` and `review` list each stale entry with its source, check, path, kind and reason, and say to remove or update it. They list each ambiguous entry with the number and the locations of the findings that its code matches, and ask for a more specific code. One line counts the not-evaluated entries with their reasons: other app configurations, or no executed result for the check. `review` shows this in its own box before the summary, and `--check-id` narrows it. `check` shows it after the suppressed findings. - A stale entry with `code` whose file no longer exists names a likely new path when exactly one finding of the same source and check, at another path, holds its code: "Maybe moved to <path>". The entry still applies to nothing. The commands only test whether the file exists; they read no source file. - `--json`: each entry gets a nullable `likelyPath` and `candidateFindingCount`, and `suppressions` gets `staleEntryCount` and `ambiguousEntryCount`. Fields are only added. The README and the oclif manifest are regenerated. Stale and ambiguous entries don't change the exit code or `--blocking`. Co-authored-by: Isaac Roldan <[email protected]>
isaacroldan
force-pushed
the
clisec/CLISEC-11
branch
from
November 6, 2026 14:49
26da4d3 to
e7cfe7b
Compare
Co-authored-by: Claude Code <[email protected]>
…d match Since #9085, text that occurs only in the messages of findings with captured code matches none of them, so that entry is stale and lists no candidates. Co-authored-by: Claude Code <[email protected]>
Co-authored-by: Claude Code <[email protected]> #9085 matches a finding with captured code by its code alone. The likely new path of a stale entry now follows the same rule, so a message that happens to hold the entry's text doesn't name a path.
Co-authored-by: Claude Code <[email protected]>
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
WHY are these changes introduced?
A suppression entry can stop matching after code changes, or match several findings. These entries suppress nothing, but the text output did not explain this.
Builds on #9086.
WHAT is this pull request doing?
Show stale and ambiguous entries in
app security checkandapp security review, without--verbose. Include candidate locations for ambiguous entries and a count of entries that were not evaluated.For a stale entry with
code, suggest a possible new path when the old path is absent and exactly one finding of the same source and check contains the text. This is a hint; it does not apply the suppression.Add
staleEntryCount,ambiguousEntryCount,likelyPath, andcandidateFindingCountto--json. Stale and ambiguous entries do not change exit codes or--blocking.review --check-idfilters the text report; JSON suppression counts still cover all entries.How to manually test your changes?
In a test app with a working code-specific suppression, rename the affected file. Run
shopify app security check --path <app> --skip-instructions, thenshopify app security review --path <app> --json. Check the stale entry and possible new path. Confirm that the finding in the renamed file remains active.Checklist