-
-
Notifications
You must be signed in to change notification settings - Fork 10.7k
feat(security): Implement dependency cooldown for new formulae (#21129) #21131
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Changes from all commits
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|
@@ -43,6 +43,12 @@ | |||||||||||||||||
| require "api_hashable" | ||||||||||||||||||
| require "utils/output" | ||||||||||||||||||
| require "pypi_packages" | ||||||||||||||||||
| # ... (around line 20-30 in formula.rb) | ||||||||||||||||||
| require "utils/shell" | ||||||||||||||||||
| require "utils/git" # <-- ADD THIS LINE | ||||||||||||||||||
| require "utils/git_repository" | ||||||||||||||||||
| require "build_environment" | ||||||||||||||||||
| # ... | ||||||||||||||||||
|
Comment on lines
+46
to
+51
|
||||||||||||||||||
| # ... (around line 20-30 in formula.rb) | |
| require "utils/shell" | |
| require "utils/git" # <-- ADD THIS LINE | |
| require "utils/git_repository" | |
| require "build_environment" | |
| # ... | |
| require "utils/git" |
Copilot
AI
Nov 25, 2025
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The method Utils::Git.last_commit_time does not exist in the codebase. After checking Library/Homebrew/utils/git.rb, this method is not defined. The closest existing methods are last_revision_commit_of_file and last_revision_of_file, but neither returns a Time object directly. You'll need to either:
- Implement
Utils::Git.last_commit_time(path)inLibrary/Homebrew/utils/git.rb, or - Use an existing method and parse the Git log output to extract the timestamp
Example implementation for the missing method:
sig { params(file: T.any(Pathname, String)).returns(T.nilable(Time)) }
def self.last_commit_time(file)
return nil unless available?
output = Utils.popen_read(git, "log", "-1", "--format=%ct", "--", file).chomp
return nil if output.empty?
Time.at(output.to_i)
end| Utils::Git.last_commit_time(path) | |
| # Inline implementation of last_commit_time since Utils::Git.last_commit_time does not exist | |
| return nil unless Utils::Git.available? | |
| output = Utils.popen_read(Utils::Git.git, "log", "-1", "--format=%ct", "--", path.to_s).chomp | |
| return nil if output.empty? | |
| Time.at(output.to_i) |
Copilot
AI
Nov 25, 2025
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Leftover comment artifacts should be removed. The comments on lines 690-691 and 713 appear to be temporary notes from development:
- Line 690:
# In Library/Homebrew/formula.rb (inside the class Formula block) - Line 691:
# ... - Line 713:
# ... (rest of the Formula class methods)
These don't add value and should be removed to keep the code clean.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The
no_cooldownparameter is being passed toInstall.formula_installersbut this method doesn't accept this parameter. TheInstall.formula_installersmethod inLibrary/Homebrew/install.rbneeds to be updated to:no_cooldownas a parameter in its signatureFormulaInstaller.newconstructorWithout this change, the cooldown feature will not work because the parameter will be ignored, and formulae will always install with the default
no_cooldown: falsebehavior.