Skip to content

Docs/ci first runs - #2

Merged
protechnocrats merged 2 commits into
mainfrom
docs/ci-first-runs
Oct 24, 2026
Merged

protechnocrats merged 2 commits into
mainfrom
docs/ci-first-runs

Conversation

@protechnocrats

Copy link
Copy Markdown
Owner

No description provided.

protechnocrats and others added 2 commits October 23, 2026 20:56
The CSS nesting blow-up found by fuzzing (0b427ba) was capped, not fixed:
the selector parser accepted `a:not( .c0`, and nesting copied that text
into every child, where the unclosed `(` hid their commas from the
selector-count cap.

- A selector with an unclosed `(` or `[` (outside a string) is invalid;
  in CSS syntax the bracket would run on past the rule's `{`.
- A nested rule passes down only combined selectors that parse. An
  invalid one matches nothing, nor does anything nested under it.
- Both nested-selector caps report a new Guard::CssNestedSelectorsTooLarge
  instead of borrowing the @media depth guard.
- The regression test checks output instead of elapsed time.

The fuzz input now builds nothing past its first level; the 64 KiB text
cap stays for `&`-heavy children. 1,213 tests pass.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- AUDIT.md: a CI row (every PR job passes on PR #1; the nightly fuzz job
  has not passed yet), the five fuzz findings, three advisory exceptions
  (rustybuzz added), 1,213 tests; the "no CI run observed" gaps updated.
- M25: a "First CI runs" section: the two fuzz-smoke script fixes, the
  five bugs and their fixes, and why the first nightly run failed (it ran
  before PR #1 merged, on the script without the --target pin).
- ROADMAP: the font risk names both unmaintained crates.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@protechnocrats
protechnocrats merged commit bf344b5 into main Oct 24, 2026
4 checks passed
@protechnocrats
protechnocrats deleted the docs/ci-first-runs branch October 24, 2026 00:59
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant