You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Automated candidates via brew advisory-match --formula-list (planned workers) --new-history, sharded by formula (SHA-256 bucket 39). See CONTRIBUTING.md for the review checklist.
No actionable comments were generated in the recent review.
Summary
Summary by CodeRabbit
Security
Added an advisory for a denial-of-service vulnerability affecting topydo through its upstream urwid dependency. The advisory identifies affected versions, the upstream fixed version and relevant references.
Updated an existing WebSocket advisory with a CVE identifier and details on how excessive memory overhead during frame reassembly can lead to resource exhaustion.
The change updates the pferd advisory with a new upstream identifier and a specific memory-exhaustion description. It also adds an advisory for topydo covering affected versions, upstream fix information, vulnerability details, severity, and references.
The advisory adds CVE-2026-123817, updates its modification date, and describes memory overhead from WebSocket frame reassembly using many small reads.
The new advisory records affected topydo versions, the upstream urwid fix, registry-matching evidence, reported encoding failures and denial-of-service impact, a CVSS v3.1 vector, and references.
Merge Risk: Minimal · up to 8b550
These are data-only advisory records. The topydo affected range is correctly left open because one version covers both vulnerable and patched builds. No merge-blocking risk remains.
Pre-merge checks: 4
Check name
Status
Explanation
Title check
The title identifies the matched advisory candidates and their shard, which accurately describes the main change.
Description check
The description explains how the advisory candidates were generated and directs reviewers to the checklist and run artifacts.
Linked Issues check
Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check
Check skipped because no linked issues were found for this pull request.
Reviewing files that changed from the base of the PR and between 3d0587c and 8b5504e.
Files selected for processing: 2
advisories/BREW-pferd-GHSA-2g87-pp6c-29x5.json
advisories/BREW-topydo-CVE-2026-103022.json
Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Automated candidates via
brew advisory-match --formula-list (planned workers) --new-history, sharded by formula (SHA-256 bucket39). See CONTRIBUTING.md for the review checklist.Run and review artifacts: https://github.com/Homebrew/advisory-database/actions/runs/42782513143