Skip to content

Resolve SonarCloud findings on 2026.3 (action SHA pins, node: imports, native map/filter) - #128

Merged
xIrusux merged 4 commits into
2026.3from
fix/sonar-findings-2026.3
Oct 1, 2026
Merged

xIrusux merged 4 commits into
2026.3from
fix/sonar-findings-2026.3

Conversation

@xIrusux

@xIrusux xIrusux commented Oct 1, 2026

Copy link
Copy Markdown
Contributor

Resolves the open SonarCloud findings reported on the branch analysis of this repo.

Changes

  • Security (High) · .github/workflows/copilot-setup-steps.yml L30, L39 — pin shivammathur/setup-php (2.37.2) and ramsey/composer-install (3.2.1) to full commit SHAs; actions/checkout (v5.0.1) pinned the same way for consistency. Resolved versions are noted in trailing comments.
  • Maintainability (Medium) · assets/studio/eslint.config.mjs L21–22 — import from node:url / node:path.
  • Maintainability (Medium) · object-merger-view/helpers.ts — Array.prototype.map/filter instead of lodash map/filter. intersection stays (no native equivalent). Behaviour unchanged: an undefined or empty breadcrumbsList still yields [].

Verification

  • eslint + tsc clean locally.
  • Pure refactor on the TS side; no runtime behaviour change intended. CI validates the workflow pins.

Forward-merge 2026.3 → 2026.x after merge.

🤖 Generated with Claude Code

…ve map/filter

- copilot-setup-steps.yml: pin actions/checkout, shivammathur/setup-php and
  ramsey/composer-install to full commit SHAs (version noted in a comment)
- eslint.config.mjs: import from node:url / node:path
- object-merger-view/helpers.ts: use Array.prototype.map/filter instead of
  lodash map/filter; intersection stays (no native equivalent)

Co-Authored-By: Claude <noreply@anthropic.com>
@xIrusux
xIrusux requested a review from bluvulture as a code owner October 1, 2026 10:17
@xIrusux xIrusux added this to the 2026.3.1 milestone Oct 1, 2026
@xIrusux
xIrusux requested a review from berfinyuksel as a code owner October 1, 2026 10:17
@xIrusux xIrusux self-assigned this Oct 1, 2026
xIrusux and others added 2 commits October 1, 2026 12:44
@sonarqubecloud

sonarqubecloud Bot commented Oct 1, 2026

Copy link
Copy Markdown

@xIrusux

xIrusux commented Oct 1, 2026

Copy link
Copy Markdown
Contributor Author

@bluvulture gave me the go ahead on the workflow side here

@xIrusux
xIrusux merged commit a0b267f into 2026.3 Oct 1, 2026
1 check passed
@xIrusux
xIrusux deleted the fix/sonar-findings-2026.3 branch October 1, 2026 11:52
@github-actions github-actions Bot locked and limited conversation to collaborators Oct 1, 2026
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant