Bump hyrax-webapp to Hyku main for the security fix's regression specs - #759
Open
ShanaLMoore wants to merge 1 commit into
Open
ShanaLMoore wants to merge 1 commit into
ShanaLMoore wants to merge 1 commit into
Conversation
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code review is billed via overage credits. To resume reviews, an organization admin can raise the monthly limit at claude.ai/admin-settings/claude-code.
Once credits are available, reopen this pull request to trigger a review.
Production is currently served from the unmerged #758 branch while main still points at daf1ec83, which carries the vulnerable controllers. Any routine deploy from main or from tag v1.6.0 silently reverts the fix. Takes Hyku main rather than #758's pinned SHA so the upstream regression specs come with it. #758 omits all three, including the 78-line group_roles_controller_spec that covers the escalation path; the other five knapsack security PRs all include them. Closes GHSA-qvw7-2cfx-c54q and GHSA-7cq7-84q2-f23j. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
ShanaLMoore
force-pushed
the
update-submodule-2026-09-17
branch
from
September 17, 2026 14:34
bcfe101 to
e30ef3e
Compare
ShanaLMoore
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Story
Follows #758, which is now merged. That PR patched GHSA-qvw7-2cfx-c54q and GHSA-7cq7-84q2-f23j but pinned a SHA that carries the controller fixes without their tests. This adds the tests.
Expected Behavior Before Changes
mainis on9568632a, which has the correct authorization inAdmin::GroupRolesController,Admin::GroupUsersControllerandAdmin::UsersController, but none of the upstream specs that cover it. Nothing in the suite fails if that authorization is removed again.Expected Behavior After Changes
hyrax-webappmoves9568632ato76bd7f52, which is Hykumain. Same controller code, plus the three regression specs — including the 78-linegroup_roles_controller_spec.rbcovering the escalation path. The five sibling knapsack PRs (utk#123, adventist#1048, enact#196, palni_palci#745, ethos#200) all shipped with these; HykuUp was the only one without.Notes
Worth arguing with: this also pulls samvera/hyku#3297, a two-line fix to
screening_room.scssfor the featured-works hero modal audio player. That is the only change here beyond the specs.Recommend
v1.6.1offmainonce merged, so production runs a tagged release rather than the branch it was hotfixed from.