mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-16 19:59:26 +00:00
Marius CiepluchandClaude Opus 4.8
9a3250f6c5
test_no_pair_repeats_a_repository_the_benchmarks_already_name failed: advisory-fix catalog repos also appeared elsewhere under benchmarks/. Root cause split two ways: 1. Genuine leak: 16 catalog repos are also subjects in benchmarks/search/private/ pilot.json (a real private pilot population). Removed those 16 pairs from the three catalogs and their verification.json rows (totals recomputed, catalog == verification preserved). 2. Spurious: the overlap scan greped ~49k vendored files under benchmarks/search/private/runs/*/checkout/node_modules/, so any catalog repo a vendored dependency's README names collided. Added a narrow vendored-tree skip (node_modules/vendor) to the scan rather than deleting labelled pairs over a dependency mention. Implemented from Codex's first pass (gpt-6.1-sol), then gated and corrected: Codex removed 20 pairs; 4 of those (backstage/backstage, koajs/koa, beaugunderson/ ip-address, cakephp/cakephp) were driven only by vendored/non-population mentions and are kept. Also excluded advisory-fixes-spread.json (catalog-derived report) and research-2026-09-26.md (selection write-up) as non-population. tests/test_advisory_fix_pairs.py + tests/test_learn_labels.py: 53 passed. Co-Authored-By: Claude Opus 4.8 <[email protected]>