Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

explosion/thinc

              v8.3.x @ 6c38b29
            

Fixes

CVEs

HIGH

Peak severity

66.7%

Coverage

Highlights

Denial of Service: 1 prior fix. Scrutinize any change in this area.

.github/workflows/explosionbot.yml: most-fixed (1 issue). Treat as high-risk during review.

2 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Secret Exposure: Pip install URL interpolated a secret token directly, exposing it in process listings and CI logs; fixed by switching to git config insteadOf.

Dependency Vulnerability: pydantic version constraint allowed vulnerable versions (>=1.7.1, <1.8.2) tied to GHSA-5jqp-qgf6-3pvh; pinning excluded them.

Denial of Service: Backprop functions lacked array size consistency checks, risking out-of-bounds access and crashes; ArrayInfo added.