Jens-G commented on PR #3608: URL: https://github.com/apache/thrift/pull/3608#issuecomment-4845789483
### Code review Found 2 issues (adversarially verified): 1. The commit body references `CVE-2019-10790` directly: *"This eliminates taffydb (CVE-2019-10790) from the lib/js dependency tree."* `AGENTS.md` §6 prohibits CVE identifiers and security framing in public-facing text (commit messages, PR descriptions) without qualification — the rule uses "Never" unconditionally. Neutral phrasing: *"removes taffydb from the transitive dependency tree."* Verified: CVE reference confirmed in commit body `f293e625e`; `AGENTS.md` §6 prohibition confirmed unqualified. 2. The jsdoc 4.x upgrade is never exercised in CI. `lib/js` is absent from all 10 CI workflow files — no job runs `make -C lib/js check` or `grunt jsdoc`. The `lib/js/Gruntfile.js` default task includes `jsdoc` (line 348) and `lib/js/Makefile.am` `check-local` runs grunt, but CI only covers `lib/nodejs`, not `lib/js`. The upgrade is therefore untested in CI. https://github.com/apache/thrift/blob/f293e625e368de39bb31441509f19505fc1977c0/lib/js/Gruntfile.js#L348 Verified: grepped all 10 CI workflow files at PR head; zero references to `lib/js`, `grunt jsdoc`, or `make -C lib/js`. 🤖 Generated with [Claude Code](https://claude.ai/code) <sub>- If this code review was useful, please react with 👍. Otherwise, react with 👎.</sub> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
