[pid1]

Runtimes

• Node 22 → 24 (Active LTS) in all three CI jobs. The repo has no package.json/.nvmrc; CI's node-version is the only pin.

Dependencies

• None: the verifier, vectors check and coverage script use only Node built-ins.

CI

• actions/checkout v4 / v6 → v7.0.1, pinned by SHA
• actions/setup-node v4 → v7.1.0, pinned by SHA (no package.json, so v5+ automatic caching doesn't apply)
• actions/upload-artifact v4 → v7.0.2, pinned by SHA
• Semgrep container semgrep/semgrep → 1.181.0@sha256:8147…304b
• koreader/kosync:latest service image left on purpose: the weekly schedule exists to notice changes in the reference image.

Semgrep

• fixed: 979831624–979831631 (github-actions-mutable-action-tag ×8) in conformance.yml:23,25,54,56,123,133,134 and semgrep.yml:25
• acceptable risk: 979831623 (md5-used-as-password, verify.mjs:111): kosync requires x-auth-key = md5(password) (SPEC.md K-AUTH-2, K-REG-1). A conformance client has to send exactly that.
• acceptable risk: 979831632 (crypto-weak-algorithm, verify.mjs:107): the same protocol-mandated MD5 helper.
• acceptable risk: 979831633 (crypto-weak-algorithm, vectors/check.mjs:47): KOReader's document digest is a partial MD5 (SPEC.md K-DOC-5, util.partialMD5). It's used to check vectors, not for security.

Holds

• none

Verification

node --check on verify.mjs, vectors/check.mjs and coverage.mjs: ok. node coverage.mjs: spec and verifier agree, 48 assertions. node vectors/check.mjs: 7 passed, 0 failed. node verify.mjs --help: exits 2 as expected. semgrep ci --dry-run: only the 3 protocol-mandated MD5 findings remain.

🤖 Generated with Claude Code