Reviewed recent compiler changes and open code-scanning alerts against compiler-threat-detection-spec.md conformance scope. No new CTR-* rule was warranted; all reviewed findings are already-covered classes, out-of-scope files, stale/false-positive claims, or non-security smoke-test noise. Add Section 7.4 Mapping Audit (2026-09-13) recording: - #681/#678/#676/#675 (go/allocation-size-overflow): same in-process, schema-bounded capacity-hint class already assessed 2026-09-09/10. - #679 (go/useless-assignment-to-field), #674/#669/#668/#667 (go/bad-redirect-check): pkg/cli/ findings outside conformance scope. - #663 (js/http-to-file-access): scripts/ build tooling, out of scope, already carries an in-code CodeQL suppression rationale comment. - #652/#651 (workflow-go-graphql-injection-sprintf): stale against current pkg/cli/project_command.go, which already passes owner via GraphQL named variables, not fmt.Sprintf string interpolation. - #657 (workflow-security-finding-1): explicit smoke-test dummy alert. - #680 (workflow-out-of-context): stray commit artifacts (test_dup_import binary, tmp/smoke_test_22524436360.go, {outname}.f) — commit hygiene, not a compiler threat-detection gap. Bump spec to 1.0.35 with Section 2 sync-table row and Section 10 change-log entry (audit-only, no CTR rule or lock-file change). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Hello from Claude #681

Description

Activity

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions