What changed
Removed an unused statSync after RegexScannerDriver reads and matches a source file. Added a regression test that removes the file during the matcher call, after the content has been read.
Why
A file can disappear during a scan, for example while a checkout or build updates the tree. The read path already tolerates a missing file, but the later statSync throws ENOENT and aborts the run. Its result is never used; the file hash is computed from the content already read.
Verification
- The regression test failed on
mainwithENOENTatpackages/scanner/src/index.ts:346, then passed with this change. -
pnpm -r build -
pnpm lint -
pnpm knip -
pnpm bundle -
pnpm exec vitest run --maxWorkers 2: 2,418 passed, 1 skipped. -
pnpm testat default concurrency: an unrelated oversized-tarball test timed out at its 5-second limit on this machine in two runs. That test passed on its own (11/11 in its file), and the full suite passed with two workers.
Notes for reviewer
The test only requires the scan to complete after the file disappears. It does not prescribe whether findings from a file removed after the read should be retained. No matcher or candidate persistence behavior was changed.
Activity
4
auto-maintain[bot]1mo ago🤖 auto-maintain review
Automated, advisory triage for @Osraka's PR. Facts below are read from the GitHub API.
| Check | Result |
|---|---|
| Author's merged PRs (this repo) | 0 — ⚠️ first-time contributor |
| Account established | ✅ (age 1714d · 1 followers · 71 public repos) |
| Commits signed/verified | ✅ 1/1 |
Review panel: 🟢 low highest severity
deepsec maintainer code review: 🟢 low
No actionable issues found; removing the unused stat prevents the documented race without changing persisted scan content.
General code review: 🟢 low
The unused stat removal correctly prevents ENOENT after a successful read, and the regression test covers the failure path.
Scanner and matcher quality: 🟢 low
No actionable scanner or matcher quality issues found in the change.
Sandbox and credential boundaries: 🟢 low
Removes a dead post-read statSync whose discarded result only served to abort scans on files that vanish mid-run; the file hash is computed from already-read content, so no sandbox, path-safety, or credential boundary is weakened, and the added regression test is self-contained and restores DEEPSEC_DATA_ROOT.
Durability and distributed state: 🟢 low
No actionable durability or distributed-state issues found in the change.
Posted by auto-maintain. This automated code review is advisory; a human maintainer makes the call.
Osraka17d agoFor review: the code and security checks are green. The two failing Vercel statuses are authorization-required preview deployments for an external PR, not build or test failures. I cannot approve the team-level deployment from my fork. The regression test and local verification are in the description; happy to run another scanner-only check if useful.
@Osraka is attempting to deploy a commit to the Vercel Labs Team on Vercel.
A member of the Team first needs to authorize it.