Repository navigation
Update checkmarx-ast-cli to 2.3.69 - #227
Merged
Merged
Conversation
* bump checkmarx-ast-cli.version to 2.3.69 * refresh SHA-256 checksums for all five CLI archives * bump package version to 1.0.44 Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* add .claude/skills/update-ast-cli with SKILL.md and checksum script * stop ignoring .claude so project skills are shared; keep settings.local.json ignored Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
cx-aniket-shinde
previously approved these changes
Oct 29, 2026
cx-rakesh-kadu
previously approved these changes
Oct 29, 2026
cx-kedar-bhujade
left a comment
cx-kedar-bhujade
left a comment
There was a problem hiding this comment.
Thanks for this. The 2.3.69 bump looks right (version, five checksums, 1.0.44), and the skill is a useful, well-documented equivalent of update-cli.yml. I read through the diff but haven't run the script or re-hashed the archives. One issue I'd like fixed before we rely on this for future bumps (the cross-check fails open, see inline), plus a few portability and robustness suggestions. Everything else is non-blocking.
fetch-checksums.sh * fail closed: missing GitHub checksums file or entry now exits 2; explicit --skip-crosscheck flag to override * portable to bash 3.2 and BSD userland: parallel arrays instead of declare -A, shasum fallback for sha256sum, wc -c instead of stat -c * --out FILE writes atomically via temp file + mv so a failure never leaves an empty checksums file * clean up the temp download dir on exit when we created it * exact filename match with awk instead of grep -E on a dotted version SKILL.md * disable-model-invocation: true; skill runs only via /update-ast-cli * use gh api --jq for the latest tag instead of grep/sed * use npm version --no-git-tag-version for the package bump, which works offline and replaces the sed on package-lock.json * verification asserts the five checksum keys and lockfile/package version agreement * add release-notes review step * move gpg, gh and registry specifics into a generalized Troubleshooting section; drop attribution-trailer wording .gitignore * ignore /.claude/* but share /.claude/skills/ Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
cx-anurag-dalke
dismissed stale reviews from cx-rakesh-kadu and cx-aniket-shinde
via
October 29, 2026 09:25
40281b7
cx-rakesh-kadu
previously approved these changes
Oct 29, 2026
* validate the version as strict MAJOR.MINOR.PATCH before it reaches any URL or file path; rejects traversal, URL metacharacters and malformed input * pin curl to HTTPS for the request and any redirect, cap redirects, add connect and overall timeouts * remove any pre-existing file or symlink at a download path before writing so a planted symlink is never followed * reject --out when it names a directory * verify each computed hash is 64 hex chars before emitting it * a hash mismatch is never skippable; --skip-crosscheck only covers a missing checksums file or entry, and ends with a loud UNVERIFIED banner Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
cx-aniket-shinde
requested review from
cx-aniket-shinde,
cx-kedar-bhujade and
cx-rakesh-kadu
October 29, 2026 12:02
cx-aniket-shinde
approved these changes
Oct 29, 2026
cx-tejal-thorat
self-requested a review
October 29, 2026 17:11
cx-tejal-thorat
approved these changes
Oct 29, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Updates checkmarx-ast-cli from 2.3.67 to 2.3.69 and bumps the wrapper package to 1.0.44.
Also adds a Claude Code project skill,
/update-ast-cli, that performs this same upgrade end to end for future releases.Changes
checkmarx-ast-cli.version: 2.3.67 → 2.3.69checkmarx-ast-cli.checksums: refreshed SHA-256 for all five archives (windows_x64, darwin_x64, linux_x64, linux_arm64, linux_armv6)package.json/package-lock.json: 1.0.43 → 1.0.44.claude/skills/update-ast-cli/: new skill (SKILL.md+scripts/fetch-checksums.sh) that resolves the latest CLI release, creates thefeature/update_<version>branch, refreshes the version and checksum files, bumps the package version, and opens the PR. The script mirrors the checksum step inupdate-cli.ymland cross-checks every hash against the GitHub release'schecksums.txt..gitignore:/.claudeis no longer ignored so the skill is shared with the repo;/.claude/settings.local.jsonstays ignored.Verification
download.checkmarx.com/CxOne/CLI/2.3.69/and hashed locally, matching the process inupdate-cli.yml.ast-cli_2.3.69_checksums.txtpublished on the 2.3.69 GitHub release.🤖 Generated with Claude Code