fix: patch xml2js CVE + route OpenCode review through hush gateway#32

Closed

byapparov wants to merge 6 commits into

fix/xml2js-hush-review-proxy

Commits on Mar 2, 2026

fix: patch xml2js prototype pollution, route OpenCode review through hush

AICtrl Bot
and
claude
committed
fix: use global npm bin path for hush in CI review workflow

AICtrl Bot
and
claude
committed
fix: add 10m timeout and debug logging to OpenCode review step

AICtrl Bot
and
claude
committed
fix: bump OpenCode review timeout to 15m (was timing out mid-review)

AICtrl Bot
and
claude
committed
fix: add build step to review workflow so tests pass when OpenCode runs them

AICtrl Bot
and
claude
committed
fix: tell OpenCode reviewer not to run tests, just read code and post comment

AICtrl Bot
and
claude
committed