GeezerVison

The World Wide Web, restored to 800 pixels of glory.

GeezerVison is showing github.com — Redact credentials from logged URLs, VEX product ids and hosted Composer locks by mikolalysenko · Pull Request #1026 · SocketDev/socket-patch

Conversation

Mikola Lysenko (mikolalysenko) commented Oct 7, 2026 •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link

Copy Markdown

Collaborator

Problem

Architecture audit, credential leaks:

B02 / Hosted Composer rewrite keeps the entry's transport-options, so Composer sends a private repository's auth headers to the hosted patch URL #399: the hosted Composer rewrite pointed dist.url at the patch host but kept the entry's transport-options. Composer copies a repository's options (http.header auth tokens, ssl client certificates, http.proxy) into each lock entry and applies them to that entry's dist download, so every composer install sent the private registry's credentials to the hosted patch server. The vendored backend already dropped the key, but with its own hand-written list.
B26: grant tokens and URL userinfo reached --json events, CI logs, debug output and telemetry:
- 8 hand-written vendor_prebuilt_downloaded advisories quoted the grant URL;
- registry_fetch::download and the Maven fetch errors quoted GOPROXY, .npmrc and mirror URLs, reqwest's error text included;
- client.rs debug lines and artifact errors quoted grant URLs;
- three separate debug_log copies (client, telemetry, jvm_cache) and four raw eprintln! debug lines; only the client's redacted anything, so the telemetry endpoint and the socket-cli apiBaseUrl were printed with their userinfo;
- the hosted npm-manifest and wheel-metadata skip details hid only a byte-exact copy of the artifact URL (<hosted artifact>), so a URL reqwest re-rendered kept its grant token;
- telemetry::sanitize_error_message only replaced $HOME, and patch_fetch_failed.uuid carried whatever identifier the user passed (CVE, purl, private package name).
B21: the VEX product @id fell back to the raw git origin URL for unknown hosts and GitLab subgroups, so https://gitlab-ci-token:<token>@… and https://<PAT>@… were published in the OpenVEX document.

Fixes #399

Change

New utils::redact is the one redactor.
- redact_url / redact_urls_in replace userinfo, the Socket grant-token level (the path level before the patch uuid under /patch/ or /patch-registry/) and secret query values with <redacted>.
- Each element of a comma-joined URL list (GOPROXY) is redacted on its own. A scheme:// nested in a query stays part of its URL.
- strip_url_credentials is the identifier form. url_host and url_hostname are the userinfo-safe host parsers.
Each emission point now goes through it:
- VendorWarning::new (every vendor advisory);
- registry_fetch::download and maven_repo::fetch_registry_bytes;
- api::client's network_error_detail and artifact errors;
- telemetry::sanitize_error_message;
- every core debug line, through the single printer env_compat::debug_log (and debug_message for the client's deferred lines). A ratchet test fails when a core module prints its own [socket-patch …] line again. The CLI update notifier redacts its lines too;
- the hosted npm-manifest / wheel-metadata skip details and the vlt ARTIFACT_UNVERIFIABLE warning, through engine::redact_artifact_text. That is redact_urls_in plus the artifact's own grant token, known from its patch uuid, so a custom --api-url serve root or a non-canonical patch id is covered too.
patch_fetch_failed now sends uuid only when the identifier is a uuid.
VEX: a remote that falls back to the URL is stripped of credentials first.
Composer: formats::composer::ORIGIN_BOUND_ENTRY_KEYS (source, transport-options) is shared by the vendored rewrite_lock_entry and the hosted apply_dist_edit. Only that policy is shared: the vendored backend rebuilds the entry with serde, and the hosted one splices bytes to keep the lock's formatting, so the mechanics differ on purpose.
- The hosted splice drops every listed member, rescanning between removals so adjacent members never leave a dangling comma.
- It widens the recorded edit to cover every changed byte, so the ledger's fragment revert restores them.
- It edits a copy of the entry object alone and splices it back once, so the work per package is bounded by its entry, not by the lock. The in-place sweep passes against the golden blessed before this change.
- It warns with the new code redirect_composer_transport_options_removed, documented in docs/testing/composer-compatibility.md.

Behavior changes to note

An https remote with only a username (https://[email protected]/team/repo.git, common on Bitbucket Server and Azure DevOps) now loses user@, so its VEX product @id changes. This is pinned in remote_url_credentials_never_reach_the_product_id. ssh login names (ssh://git@host/…) and scp-like remotes keep theirs.
The hosted skip details now quote the artifact URL with its grant token redacted, instead of replacing the whole URL with <hosted artifact>.
In shown text, an ssh login without a password (git+ssh://[email protected]/…) is kept. Short secret markers (auth, key, sig, pass, pwd, cred, jwt) only match whole words of a query-parameter name, so author, keyword and design are not redacted. Long markers (token, secret, password, signature, session, credential, apikey) still match anywhere.

Duplicate copies deleted

What	Before	After
`vendor_prebuilt_downloaded` advisory builders	8	1 (`VerifiedArchive::downloaded_warning`, pinned by a ratchet test)
URL redactors	4 (`redirect::redact_grant_token`, `hosted::guidance::url_host`'s userinfo strip, two `.replace(artifact_url, "<hosted artifact>")` in `hosted/engine.rs`)	1 (`utils::redact`; `engine::redact_artifact_text` calls it and adds only the dep-known token)
Userinfo-stripping host extractors	4 (`hosted::guidance::url_host`, `upstream/uv.rs`, `formats/gem/mirror.rs::source_host`, `vex_consumed.rs::registry_host`)	1 (`utils::redact::url_host` / `url_hostname`)
Core debug printers	7 (`debug_log` in client, telemetry and jvm_cache; raw `eprintln!` in socket_cli_config, reuse, concurrent and process)	1 (`env_compat::debug_log` / `debug_message`, pinned by a ratchet test)
Composer origin-bound key lists	2 (vendored match arms; hosted `source`-only plan)	1

Testing

Run on macOS after merging current main (d47eab3a), every cargo call through the shared limiter with -j4 and CARGO_INCREMENTAL=0:

cargo test -p socket-patch-core --lib: 5622 passed, 0 failed. This includes the composer equivalence sweep, which was run once against the pre-change golden (unchanged output) and then re-blessed with the new transport-options inputs.
cargo test -p socket-patch-core --test '*': all 36 integration binaries passed, including redirect_golden and upstream_restore_golden with the composer-lock/transport-options case.
cargo test -p socket-patch-cli: --bins, scan (118), in_process_vendor (121), in_process_redirect (117), hosted_memory_engine (30), hosted_memory_parity (31), scan_vendor_e2e (37), covgap_commands_vex (12), e2e_vex_lockfile (323), e2e_hosted_production (30), e2e_vendored_production (30) and e2e_embedded_vex (15) all passed.
cargo clippy -p socket-patch-core -p socket-patch-cli --all-targets -- -D warnings reports no lints in changed code. Under the local toolchain it reports only test-code lints that also fail on main (jvm_jar.rs, python_crawler.rs, maven_repo.rs:2511, nuget_feed.rs:2005, bun_binary.rs, pnpm_lock.rs, yarn_berry_lock.rs, yarn_layering_tests.rs, apply.rs, redirect/mod.rs, upstream/uv.rs), plus the macOS-only unused unix_default in python_crawler.rs.
New regression tests. Removing the redaction at any of these routing points now fails a test:
- vendor::vendor_warning_redaction_tests::a_vendor_warning_never_carries_a_credential;
- service_fetch::the_download_advisory_quotes_the_grant_url_redacted;
- registry_fetch::download_errors_never_carry_a_credential (refused scheme, HTTP 404, refused connection);
- api::client::download_artifact_errors_never_carry_a_credential;
- hosted::engine::hosted_skip_details_never_carry_the_grant_token (canonical, custom serve root and non-canonical patch id);
- env_compat::debug_lines_have_one_printer (ratchet);
- utils::redact: URL-list, ssh-login, marker-word and url_hostname cases;
- telemetry URL redaction and the uuid-only field;
- vex::product::remote_url_credentials_never_reach_the_product_id (now with the username-only case);
- formats::composer::source::transport_options_are_dropped_with_source_in_any_layout;
- golden composer-lock/transport-options;
- the composer equivalence sweep now requires a case to reach redirect_composer_transport_options_removed.

Deferred

depscan's TS twin (composer-lock-members.ts) has to port the transport-options drop to stay byte-identical. The shared golden composer-lock/transport-options will fail there until it does. depscan has issues disabled, so this is tracked in Port the Composer transport-options drop to depscan's composer-lock-members.ts #1052.
The CLI in_process_vendor fixture serves artifacts at /artifacts/<uuid>/<leaf>, which has no grant level, so it cannot assert redaction end to end. The core advisory test and the one-builder ratchet cover it.
Not every hosted RewriteWarning goes through the redactor: they are built as struct literals at about 180 sites. Most already quote only url_host. The Gradle/sbt guidance snippets embed the repository URL on purpose, because the user is meant to paste it. A CLI-envelope-level choke point needs a decision about those snippets.
update/release.rs keeps its own reqwest-based url_host, which drops default ports, so moving it would change the "cannot reach" text.
GitLab subgroup purls (pkg:gitlab with a namespace) are not done. The fallback is now credential-free.
No maintainer decisions are touched (Decide: one shape for the --json top-level error (scan and get emit both a string and a {code, message} object) #704, Decide: warn on and then remove scan --apply/--vendor, and whether --vex stays embedded #966, Decide: give SOCKET_FORCE per-command names so forcing a self-update doesn't also force apply and vendor #615, Decide: where patch API calls go when a token is set but the org slug can't be resolved #648).

🤖 Generated with Claude Code

Note

High Risk
Changes touch credential handling in Composer lock rewrites, broad user-facing error/telemetry paths, and VEX/npm skip messaging; mis-redaction could hide debugging info or leave leaks, while dropping transport-options alters install behavior for private Composer setups.

Overview
Introduces utils::redact as the single place to scrub URLs before they appear in errors, --json, debug lines, telemetry, vendor warnings, and hosted skip details. Userinfo, Socket grant-token path segments, and sensitive query values become <redacted>; free-text and GOPROXY-style lists are handled via redact_urls_in. Debug output is centralized through env_compat::debug_log / debug_message (with ratchet tests), and hosted skips use redact_artifact_text so grant tokens stay hidden even when reqwest rewrites the URL.

Composer hosted redirect (#399): lock entries now drop transport-options together with source (shared ORIGIN_BOUND_ENTRY_KEYS with the vendored path). That stops private registry auth headers/certs/proxy from being sent to the patch host; upstream restore warns when packagist repo options cannot be put back. Telemetry patch_fetch_failed only reports a uuid when the identifier is actually a UUID.

Duplicate ad-hoc redactors and vendor_prebuilt_downloaded builders are removed in favor of VerifiedArchive::downloaded_warning and the shared redact helpers; registry/Maven/API download errors quote redacted URLs.

^{Reviewed by Cursor Bugbot for commit 14160e3. Configure here.}

Generated by Claude Code

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

Mikola Lysenko (mikolalysenko) and others added 3 commits

October 7, 2026 10:25


          Redact credentials from every URL the CLI shows or logs

98c2675

Add utils::redact, the one place a URL is made safe to show: userinfo,
the Socket grant-token path level (the level before the patch uuid under
/patch/ or /patch-registry/) and secret query values become <redacted>.
Route every emission through it:

- VendorWarning::new redacts its detail, so the vendor_prebuilt_downloaded
  advisory (8 hand-written copies, now one VerifiedArchive::
  downloaded_warning builder) no longer puts the grant URL into --json
  events and --verbose output;
- registry_fetch::download and maven_repo::fetch_registry_bytes errors
  (GOPROXY / .npmrc / mirror userinfo, reqwest's own error text);
- api::client debug_log, network_error_detail and the artifact
  not-found / still-building / non-http errors;
- telemetry::sanitize_error_message; patch_fetch_failed now reports the
  uuid field only when the identifier is a uuid, not a CVE, purl or
  private package name.

Consolidation: redirect::redact_grant_token (1 caller, vlt preflight) is
deleted and the caller routed through redact_urls_in; the userinfo-safe
host extractor hosted::guidance::url_host and the upstream/uv.rs copy
are replaced by utils::redact::url_host. A ratchet test pins the
download advisory to its single builder.

Audit B26.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>


          Keep git remote credentials out of the VEX product @id

b585b63

remote_url_to_purl fell back to the raw origin URL for any host other
than github.com / gitlab.com / bitbucket.org and for any non owner/repo
path (a GitLab subgroup), so a CI clone's
https://gitlab-ci-token:<job token>@host/... or https://<PAT>@host/...
was published verbatim in the OpenVEX document. The fallback now goes
through utils::redact::strip_url_credentials (userinfo and secret query
parameters dropped); an ssh login name (ssh://git@host/...) and
scp-like remotes stay as they were, so existing product ids do not move.

Audit B21.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>


          Drop Composer transport-options in the hosted lock rewrite

9e28f04

Composer copies a repository's options (http.header auth tokens, ssl
client certificates, http.proxy) into every lock entry it resolves from
it as transport-options, and applies them to that entry's dist download.
The hosted rewrite retargeted dist.url to the patch host but kept
transport-options, so every composer install sent the private
repository's credentials to the hosted patch server.

The origin-bound entry members are now one list,
formats::composer::ORIGIN_BOUND_ENTRY_KEYS (source, transport-options),
used by both backends: the vendored rewrite_lock_entry (which already
dropped both by hand) and the hosted apply_dist_edit, which now drops
each member, re-scanning between removals so adjacent members never
leave a dangling comma, and widens the recorded edit to cover every
changed byte so the ledger's fragment revert restores them. A new
warning, redirect_composer_transport_options_removed, says so.

New golden case composer-lock/transport-options (plus its vex-discover
golden entry) and a unit test over five member layouts.

Fixes #399. Audit B02.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

Mikola Lysenko (mikolalysenko) added the arch-refactor PR opened by the scheduled architecture refactor routine label

Oct 7, 2026

Mikola Lysenko (mikolalysenko) mentioned this pull request

Oct 7, 2026

Port the Composer transport-options drop to depscan's composer-lock-members.ts #1052

Open

Mikola Lysenko (mikolalysenko) and others added 7 commits

October 7, 2026 12:19


          Merge origin/main into arch-fix/sec-credentials

ec7bde2

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

# Conflicts:
#	crates/socket-patch-core/src/hosted/engine.rs
#	crates/socket-patch-core/src/vendor/maven_repo.rs
#	crates/socket-patch-core/src/vendor/registry_fetch.rs


          Tighten the URL redactor and share its host parser

e075618

Each element of a comma-joined URL list (GOPROXY) is now redacted on its
own, an ssh login name without a password is kept, and short secret
markers (auth, key, sig, pass) only match whole words of a query
parameter name, so author/keyword/design are no longer redacted.

The gem mirror and vex-consumed cargo registry host parsers now use the
new utils::redact::url_hostname instead of their own userinfo-stripping
authority split. The VEX product test pins that a username-only https
remote loses its user@ in the product @id.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>


          Send every debug line through one redacting printer

67e235b

telemetry, jvm_cache and the API client each had their own debug_log,
and socket_cli_config, reuse, concurrent and process printed raw
eprintln! lines. Only the API client redacted URLs, so the telemetry
endpoint and the socket-cli apiBaseUrl were printed with any userinfo.

env_compat::debug_log (and debug_message for the API client's deferred
lines) is now the one printer and redacts every URL. A ratchet test
fails when a core module prints its own [socket-patch ...] line again.
The CLI update notifier redacts its lines too. Adds a client test that
the artifact errors never quote the grant token or userinfo.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>


          Redact hosted skip details with the shared redactor

664811c

wheel_metadata_unavailable and npm_manifest_unavailable replaced only a
byte-exact copy of the artifact URL with <hosted artifact>, so a URL
reqwest re-rendered, or any other URL in the text, kept its grant token.
They and the vlt ARTIFACT_UNVERIFIABLE warning now go through
engine::redact_artifact_text: utils::redact::redact_urls_in, then the
artifact's own grant token (known from its patch uuid), which also
covers a custom --api-url serve root or a non-canonical patch id.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>


          Pin redaction at the vendor warning and download error sites

b8c130d

Regression tests for B26 at the routing points: VendorWarning::new, the
vendor_prebuilt_downloaded advisory, and registry_fetch::download for a
refused scheme, an HTTP 404 and a refused connection. Removing the
redact call from any of them now fails a test.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>


          Bound the composer dist edit to its entry

37351f2

apply_dist_edit cloned the whole composer.lock and diffed it end to end
for every redirected package. It now edits a copy of the entry object
alone and splices it back once. Output is unchanged: the in-place sweep
passes against the golden blessed before this change.

The sweep now also generates entries with transport-options and
requires a case to reach redirect_composer_transport_options_removed;
its golden is re-blessed for the new inputs.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>


          Pin the redacted hosted skip details in the scan tests

61cb86b

The npm manifest and wheel metadata skip details no longer hide the
whole artifact URL behind <hosted artifact>; they quote it through the
shared redactor. The yarn berry test now checks the grant-token level is
redacted. The wheel fixture's URL has no grant token, so that test only
checks a detail is present; core's
hosted_skip_details_never_carry_the_grant_token covers the redaction.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

Mikola Lysenko (mikolalysenko) marked this pull request as ready for review

October 7, 2026 16:29

Mikola Lysenko (mikolalysenko) commented Oct 7, 2026

Copy link

Copy Markdown

Collaborator Author

bugbot run

Generated by Claude Code

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.


          Merge origin/main into arch-fix/sec-credentials

ee87b33

Merges cleanly; additionally routes the yarn berry url-copy VEX
justification (added on main in #940) through redact_url so a
credentialed tarball URL never reaches the published VEX document.

Co-Authored-By: Claude <[email protected]>

Mikola Lysenko (mikolalysenko) commented Oct 7, 2026

Copy link

Copy Markdown

Collaborator Author

bugbot run

Generated by Claude Code

cursor[bot] reacted with thumbs up emoji

All reactions

👍 1 reaction

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

cursor Bot reviewed

Oct 7, 2026

View reviewed changes

cursor Bot left a comment •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link

Copy Markdown

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Stale Bugbot comment from a previous run.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

github-advanced-security Bot found potential problems

Oct 7, 2026

View reviewed changes

Comment thread

crates/socket-patch-core/src/vendor/mod.rs Fixed

Uh oh!

There was an error while loading. Please reload this page.

Comment thread

crates/socket-patch-core/src/vendor/registry_fetch.rs Fixed

Uh oh!

There was an error while loading. Please reload this page.


          Rename the secret loop variable in the redaction tests

24502da

CodeQL's rust/cleartext-logging matched the variable name `secret` in
two test assertion messages (alerts 195, 196). The values are test
literals that the assertions prove absent; renaming the binding clears
the false positive without changing what the tests check.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

Mikola Lysenko (mikolalysenko) commented Oct 7, 2026

Copy link

Copy Markdown

Collaborator Author

bugbot run

Generated by Claude Code

cursor[bot] reacted with thumbs up emoji

All reactions

👍 1 reaction

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

cursor Bot reviewed

Oct 7, 2026

View reviewed changes

cursor Bot left a comment •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link

Copy Markdown

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Stale Bugbot comment from a previous run.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions


          Merge remote-tracking branch 'origin/main' into arch-fix/sec-credentials

f21c383

Mikola Lysenko (mikolalysenko) commented Oct 7, 2026

Copy link

Copy Markdown

Collaborator Author

bugbot run

Generated by Claude Code

cursor[bot] reacted with thumbs up emoji

All reactions

👍 1 reaction

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

cursor Bot reviewed

Oct 7, 2026

View reviewed changes

cursor Bot left a comment •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link

Copy Markdown

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Stale Bugbot comment from a previous run.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions


          Merge remote-tracking branch 'origin/main' into arch-fix/sec-credentials

fa788c6

Main's #1070 landed its own B21 fix for the VEX product id (drops
userinfo on every scheme, plus query and fragment), so vex/product.rs
takes main's version and this branch's remote_iri is dropped. The other
conflicts were main's rustfmt-only edits to lines this branch had
already removed or reworded.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

Mikola Lysenko (mikolalysenko) commented Oct 8, 2026

Copy link

Copy Markdown

Collaborator Author

Merged main (d7f8679) in fa788c6. Main's #1070 already shipped a B21 fix in vex/product.rs, so that file now takes main's version: the fallback product @id drops all userinfo (an ssh login name like ssh://git@host too), the query and the fragment. This PR's remote_iri is gone, and the B21 notes in the description about keeping ssh login names and fragments no longer apply. Local: core lib 5697 passed, redirect_golden, upstream_restore_golden and covgap_commands_vex passed, clippy clean.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

This was referenced Oct 8, 2026

Route the remaining hand-rolled child-process deadlines through utils::process #1067

Open

Bound the PDM site probe through utils::process (#1067) #1106

Merged


          Merge origin/main into arch-fix/sec-credentials

2dd091f

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

Mikola Lysenko (mikolalysenko) closed this

Oct 8, 2026

Mikola Lysenko (mikolalysenko) added the Ready for review Agent-verified: mergeable, CI green, Bugbot clean — awaiting human review label

GeezerVison

Conversation

Mikola Lysenko (mikolalysenko) commented Oct 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Problem

Change

Behavior changes to note

Duplicate copies deleted

Testing

Deferred

Uh oh!

Mikola Lysenko (mikolalysenko) commented Oct 7, 2026

Uh oh!

Mikola Lysenko (mikolalysenko) commented Oct 7, 2026

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Mikola Lysenko (mikolalysenko) commented Oct 7, 2026

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Mikola Lysenko (mikolalysenko) commented Oct 7, 2026

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Mikola Lysenko (mikolalysenko) commented Oct 8, 2026

Uh oh!

Mikola Lysenko (mikolalysenko) commented Oct 9, 2026

Uh oh!

Mikola Lysenko (mikolalysenko) commented Oct 9, 2026

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Mikola Lysenko (mikolalysenko) commented Oct 9, 2026

Uh oh!

Mikola Lysenko (mikolalysenko) commented Oct 9, 2026

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Mikola Lysenko (mikolalysenko) commented Oct 9, 2026

Uh oh!

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Mikola Lysenko (mikolalysenko) commented Oct 7, 2026 •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.

cursor Bot left a comment •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.

cursor Bot left a comment •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.

cursor Bot left a comment •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.

cursor Bot left a comment •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.