The sync.Pool example returned buf.Bytes(). That slice points into the
pooled buffer. The deferred Reset and Put give the buffer to the next
Get, so another goroutine can overwrite the result while the caller
still uses it.
Return bytes.Clone(buf.Bytes()) instead, and add a short note. Same code
fix in the five translations. pi/core regenerated with
scripts/build-pi-core.js.
Tested: 64 goroutines calling the example under go test -race (Go 1.27).
Old code: DATA RACE and wrong results. New code: passes.
node scripts/build-pi-core.js --check passes.
Replaces the golang part of closed PRs #3351 and #3405, which were not
merged.
Integrate contributor PRs #3533, #3534, and #3535 on current main. Preserve the read-only module audit, canonical glossary and ADR ownership, and opt-in install closure. Refresh only the manual trigger manifest registry binding and coverage after adding the skill.
Sources: #3689#3691#3692#3693. Preserve Claude marketplace migration guidance, tool-result boundaries, scoped workflow authority, and bounded batch preparation. Regenerate the Pi projection and recompute the shared registry digest on one main head.
The AJAX example reads csrftoken from document.cookie, which fails when
CSRF_COOKIE_HTTPONLY is True. Drop the setting from the production
block (the default is False) and set it to False in the CSRF block, as
the .kiro copy already does there. Also remove SECURE_BROWSER_XSS_FILTER,
which Django 4.0 removed. Updated .kiro and regenerated pi/core.
Signed-off-by: Wen <jwcastillo@gmail.com>
(cherry picked from commit bdc4407edf)
Perl::Critic has no InputOutput::RequireThreeArgOpen or
Modules::RequireTaintChecking policy. perlcritic warns that they are
not installed and ignores them. Two-arg open is already covered by
InputOutput::ProhibitTwoArgOpen in the same profile. Regenerated pi/core.
Signed-off-by: Wen <jwcastillo@gmail.com>
(cherry picked from commit d70726d79c)
sanitize_html is not a built-in Laravel rule and the skill never
registers it, so the validator throws BadMethodCallException. The same
FormRequest already strips tags in validated(). Regenerated pi/core.
Signed-off-by: Wen <jwcastillo@gmail.com>
(cherry picked from commit 453c0651f7)
The users router uses Depends() for OAuth2PasswordRequestForm but the
import line omits it, so the module raises NameError on import.
Regenerated pi/core with scripts/build-pi-core.js.
Signed-off-by: Wen <jwcastillo@gmail.com>
(cherry picked from commit d383fb57e9)
Preserve complete source ancestry for PRs #3512, #3513, #3515, #3516, #3517 and #3518. Repair bounded recovery, alias compatibility and evaluator packaging gaps while keeping registry reuse inside the canonical loader. Verified actual hook, setup, dashboard, evaluator, sandbox and profile workflows plus full npm, Python, lint and supply-chain checks. ECC-043 preparation only; integration remains with the delivery owner.
Preserve full contributor head; refresh catalogs and Pi projection. Verify disposable Claude/Codex installs and resource discovery, with no automatic hooks or governance files.
Drop the duplicate ECC_PREPUSH_RUN_CHECKS key now that main sets it,
refresh the skill-triggers registry digest, classify skill-host-compat
for pi/core, and bump the Turkish AGENTS.md counts the catalog sync
does not cover.
Treat non-2xx activity responses as feed errors, preserve non-Markdown Copilot agent assets, and apply the reviewed reference escape parity correction with regenerated bindings. Allow the test runner to drain piped output on its existing success or failure exit status. Validate installed workflows and bounded real Node20/24 pipe regressions.
Phase 1 pipes the build into `tail -20`. Without pipefail the pipeline's
exit status is tail's, so a failed build exits 0. Phase 2 already sets
pipefail, but only after Phase 1 has run, and each phase is its own code
block. Set it at the top of the Phase 1, 3 and 4 blocks, which pipe a gate
into head or tail. Mirrored in pi/core.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
pi/core and the bundled blueprint skill now refer to the project as ECC only;
the generated README no longer expands the name. Profile contents, package
name and paths are unchanged (123 skills, 24 commands).
The release workflows poll npm for up to five minutes after publish before
verifying the artifact. In 2.2.2 the check gave up after about 30 seconds while
npm was still processing, failing the run before latest was promoted and the
GitHub Release was created.
Version metadata synced to 2.2.3 with CHANGELOG, translated release headings
and release notes; skill-triggers registryDigest updated for the blueprint text.
haelyra