fix: patch xml2js CVE, integrate hush gateway into OpenCode review workflow#33

Closed

byapparov wants to merge 10 commits into

fix/xml2js-hush-review-proxy

Commits on Mar 2, 2026

fix: patch xml2js prototype pollution, route OpenCode review through hush

AICtrl Bot
and
claude
committed
fix: use global npm bin path for hush in CI review workflow

AICtrl Bot
and
claude
committed
fix: add 10m timeout and debug logging to OpenCode review step

AICtrl Bot
and
claude
committed
fix: bump OpenCode review timeout to 15m (was timing out mid-review)

AICtrl Bot
and
claude
committed
fix: add build step to review workflow so tests pass when OpenCode runs them

AICtrl Bot
and
claude
committed
fix: tell OpenCode reviewer not to run tests, just read code and post comment

AICtrl Bot
and
claude
committed
fix: use custom provider to route OpenCode through hush proxy

AICtrl Bot
and
claude
committed
fix: switch review model to glm-4.7-flash for CI speed

AICtrl Bot
and
claude
committed
fix: pass PR number explicitly and bump proxy timeout to 120s

AICtrl Bot
and
claude
committed
fix: switch review model back to glm-5

AICtrl Bot
and
claude
committed