{"rows": [{"fix": 50, "title": "security: reject upload names that escape the root", "branch": "release/1.2", "status": "proven", "state": "\u2705 released v1.2.4 (!51)", "action": false, "reason": null, "probe": {"result": "bug reproduced", "excerpt": "Failed: DID NOT RAISE ValueError", "job_url": "https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/38599834/showcase/-/jobs/17499229854"}, "pick": {"result": "clean", "files": null}, "adaptation": null, "attempts": [{"n": 1, "status": "proven", "feedback_excerpt": ""}], "mr": {"iid": 51, "url": "https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/38599834/showcase/-/merge_requests/51", "state": "merged", "pipeline_id": 2993794982, "pipeline_url": "https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/38599834/showcase/-/pipelines/2993794982", "jobs": {"sast": {"status": "success", "url": "https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/38599834/showcase/-/jobs/17499229852"}, "secret_detection": {"status": "success", "url": "https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/38599834/showcase/-/jobs/17499229853"}, "repro": {"status": "success", "url": "https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/38599834/showcase/-/jobs/17499229854"}, "verify": {"status": "success", "url": "https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/38599834/showcase/-/jobs/17499229855"}, "integrity": {"status": "success", "url": "https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/38599834/showcase/-/jobs/17499229856"}}}, "p2p": "12/12", "release": {"tag": "v1.2.4", "url": "https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/38599834/showcase/-/releases/v1.2.4"}, "flow_run_url": "https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/38599834/showcase/-/jobs/17499116835", "label": "Proven"}, {"fix": 50, "title": "security: reject upload names that escape the root", "branch": "release/1.1", "status": "proven-adapted", "state": "\u2705 released v1.1.8 (!52)", "action": false, "reason": "fix adapted; test renamed only: resolve_upload_path \u2192 upload_path_for; porter: Kept upload_path_for name and its leading-slash stripping; added realpath/commonpath ValueError traversal check from the fix; ported test renamed resolve_upload_path->upload_path_for.", "probe": {"result": "bug reproduced", "excerpt": "Failed: DID NOT RAISE ValueError", "job_url": "https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/38599834/showcase/-/jobs/17499236290"}, "pick": {"result": "conflict", "files": ["src/core/paths.py"]}, "adaptation": {"summary": "fix adapted; test renamed only: resolve_upload_path \u2192 upload_path_for; porter: Kept upload_path_for name and its leading-slash stripping; added realpath/commonpath ValueError traversal check from the fix; ported test renamed resolve_upload_path->upload_path_for.", "test_ported": true, "renames": {"resolve_upload_path": "upload_path_for"}, "integrity": "valid port"}, "attempts": [{"n": 1, "status": "proven-adapted", "feedback_excerpt": ""}], "mr": {"iid": 52, "url": "https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/38599834/showcase/-/merge_requests/52", "state": "merged", "pipeline_id": 2993795683, "pipeline_url": "https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/38599834/showcase/-/pipelines/2993795683", "jobs": {"sast": {"status": "success", "url": "https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/38599834/showcase/-/jobs/17499236288"}, "secret_detection": {"status": "success", "url": "https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/38599834/showcase/-/jobs/17499236289"}, "repro": {"status": "success", "url": "https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/38599834/showcase/-/jobs/17499236290"}, "verify": {"status": "success", "url": "https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/38599834/showcase/-/jobs/17499236291"}, "integrity": {"status": "success", "url": "https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/38599834/showcase/-/jobs/17499236292"}}}, "p2p": "11/11", "release": {"tag": "v1.1.8", "url": "https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/38599834/showcase/-/releases/v1.1.8"}, "flow_run_url": "https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/38599834/showcase/-/jobs/17499116835", "label": "Proven, adapted"}, {"fix": 50, "title": "security: reject upload names that escape the root", "branch": "release/1.0", "status": "unproven", "state": "\u26d4 Refused: needs a backport by hand", "action": true, "reason": "No core.paths or path-resolving function exists on 1.0 (logic is inline in UploadStore.__init__); test would need to construct UploadStore instead, changing what it checks.", "probe": {"result": "test cannot run here", "excerpt": null, "job_url": "https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/38599834/showcase/-/jobs/17499116835"}, "pick": null, "adaptation": null, "attempts": [], "mr": null, "p2p": null, "release": null, "flow_run_url": "https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/38599834/showcase/-/jobs/17499116835", "label": "Refused"}, {"fix": 50, "title": "security: reject upload names that escape the root", "branch": "release/0.9", "status": "skipped", "state": "\u23ed Skipped: bug not present", "action": false, "reason": "bug not present (introducing commit 1ca73c66 not on this branch)", "probe": {"result": "bug not present", "excerpt": "test passes unpatched", "job_url": "https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/38599834/showcase/-/jobs/17499116835"}, "pick": null, "adaptation": null, "attempts": [], "mr": null, "p2p": null, "release": null, "flow_run_url": "https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/38599834/showcase/-/jobs/17499116835", "label": "Skipped"}, {"fix": 43, "title": "security: reject upload names that escape the root", "branch": "release/1.2", "status": "proven", "state": "\ud83d\udeab !44 was closed without merging", "action": true, "reason": null, "probe": {"result": "bug reproduced", "excerpt": "Failed: DID NOT RAISE ValueError", "job_url": "https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/38599834/showcase/-/jobs/17493887347"}, "pick": {"result": "clean", "files": null}, "adaptation": null, "attempts": [{"n": 1, "status": "proven", "feedback_excerpt": ""}], "mr": {"iid": 44, "url": "https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/38599834/showcase/-/merge_requests/44", "state": "closed", "pipeline_id": 2993097394, "pipeline_url": "https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/38599834/showcase/-/pipelines/2993097394", "jobs": {"sast": {"status": "success", "url": "https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/38599834/showcase/-/jobs/17493887345"}, "secret_detection": {"status": "success", "url": "https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/38599834/showcase/-/jobs/17493887346"}, "repro": {"status": "success", "url": "https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/38599834/showcase/-/jobs/17493887347"}, "verify": {"status": "success", "url": "https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/38599834/showcase/-/jobs/17493887348"}, "integrity": {"status": "success", "url": "https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/38599834/showcase/-/jobs/17493887349"}}}, "p2p": "12/12", "release": null, "flow_run_url": "https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/38599834/showcase/-/jobs/17493839083", "label": "Proven"}, {"fix": 43, "title": "security: reject upload names that escape the root", "branch": "release/1.1", "status": "proven-adapted", "state": "\ud83d\udeab !45 was closed without merging", "action": true, "reason": "fix adapted; test renamed only: resolve_upload_path \u2192 upload_path_for; porter: Adapted fix into upload_path_for (branch's name); kept stripping leading slashes since 1.1 tests rely on it, added realpath/commonpath traversal check raising ValueError.", "probe": {"result": "bug reproduced", "excerpt": "Failed: DID NOT RAISE ValueError", "job_url": "https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/38599834/showcase/-/jobs/17493892132"}, "pick": {"result": "conflict", "files": ["src/core/paths.py"]}, "adaptation": {"summary": "fix adapted; test renamed only: resolve_upload_path \u2192 upload_path_for; porter: Adapted fix into upload_path_for (branch's name); kept stripping leading slashes since 1.1 tests rely on it, added realpath/commonpath traversal check raising ValueError.", "test_ported": true, "renames": {"resolve_upload_path": "upload_path_for"}, "integrity": "valid port"}, "attempts": [{"n": 1, "status": "proven-adapted", "feedback_excerpt": ""}], "mr": {"iid": 45, "url": "https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/38599834/showcase/-/merge_requests/45", "state": "closed", "pipeline_id": 2993097917, "pipeline_url": "https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/38599834/showcase/-/pipelines/2993097917", "jobs": {"sast": {"status": "success", "url": "https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/38599834/showcase/-/jobs/17493892130"}, "secret_detection": {"status": "success", "url": "https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/38599834/showcase/-/jobs/17493892131"}, "repro": {"status": "success", "url": "https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/38599834/showcase/-/jobs/17493892132"}, "verify": {"status": "success", "url": "https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/38599834/showcase/-/jobs/17493892133"}, "integrity": {"status": "success", "url": "https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/38599834/showcase/-/jobs/17493892134"}}}, "p2p": "11/11", "release": null, "flow_run_url": "https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/38599834/showcase/-/jobs/17493839083", "label": "Proven, adapted"}, {"fix": 43, "title": "security: reject upload names that escape the root", "branch": "release/1.0", "status": "unproven", "state": "\u26d4 Refused: needs a backport by hand", "action": true, "reason": "No core.paths/resolve_upload_path equivalent on 1.0 (path logic is inside UploadStore.__init__); test can't be ported by renaming only.", "probe": {"result": "test cannot run here", "excerpt": null, "job_url": "https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/38599834/showcase/-/jobs/17493839083"}, "pick": null, "adaptation": null, "attempts": [], "mr": null, "p2p": null, "release": null, "flow_run_url": "https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/38599834/showcase/-/jobs/17493839083", "label": "Refused"}, {"fix": 43, "title": "security: reject upload names that escape the root", "branch": "release/0.9", "status": "skipped", "state": "\u23ed Skipped: bug not present", "action": false, "reason": "bug not present (introducing commit 1ca73c66 not on this branch)", "probe": {"result": "bug not present", "excerpt": "test passes unpatched", "job_url": "https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/38599834/showcase/-/jobs/17493839083"}, "pick": null, "adaptation": null, "attempts": [], "mr": null, "p2p": null, "release": null, "flow_run_url": "https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/38599834/showcase/-/jobs/17493839083", "label": "Skipped"}, {"fix": 34, "title": "security: reject upload names that escape the root", "branch": "release/1.2", "status": "proven", "state": "\u2705 merged (!35), no release yet", "action": true, "reason": null, "probe": {"result": "bug reproduced", "excerpt": "Failed: DID NOT RAISE ValueError", "job_url": "https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/38599834/showcase/-/jobs/17450109221"}, "pick": {"result": "clean", "files": null}, "adaptation": null, "attempts": [{"n": 1, "status": "proven", "feedback_excerpt": ""}], "mr": {"iid": 35, "url": "https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/38599834/showcase/-/merge_requests/35", "state": "merged", "pipeline_id": 2986823903, "pipeline_url": "https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/38599834/showcase/-/pipelines/2986823903", "jobs": {"sast": {"status": "success", "url": "https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/38599834/showcase/-/jobs/17450109219"}, "secret_detection": {"status": "success", "url": "https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/38599834/showcase/-/jobs/17450109220"}, "repro": {"status": "success", "url": "https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/38599834/showcase/-/jobs/17450109221"}, "verify": {"status": "success", "url": "https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/38599834/showcase/-/jobs/17450109222"}, "integrity": {"status": "success", "url": "https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/38599834/showcase/-/jobs/17450109223"}}}, "p2p": "12/12", "release": null, "flow_run_url": "https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/38599834/showcase/-/jobs/17450095983", "label": "Proven"}, {"fix": 34, "title": "security: reject upload names that escape the root", "branch": "release/1.1", "status": "proven-adapted", "state": "\u2705 merged (!36), no release yet", "action": true, "reason": "fix adapted; test renamed only: resolve_upload_path \u2192 upload_path_for; porter: Kept upload_path_for name and its leading-slash stripping; added realpath/commonpath containment check raising ValueError instead of adding resolve_upload_path; test ported by renaming resolve_upload_", "probe": {"result": "bug reproduced", "excerpt": "Failed: DID NOT RAISE ValueError", "job_url": "https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/38599834/showcase/-/jobs/17450110498"}, "pick": {"result": "conflict", "files": ["src/core/paths.py"]}, "adaptation": {"summary": "fix adapted; test renamed only: resolve_upload_path \u2192 upload_path_for; porter: Kept upload_path_for name and its leading-slash stripping; added realpath/commonpath containment check raising ValueError instead of adding resolve_upload_path; test ported by renaming resolve_upload_", "test_ported": true, "renames": {"resolve_upload_path": "upload_path_for"}, "integrity": "valid port"}, "attempts": [{"n": 1, "status": "proven-adapted", "feedback_excerpt": ""}], "mr": {"iid": 36, "url": "https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/38599834/showcase/-/merge_requests/36", "state": "merged", "pipeline_id": 2986824147, "pipeline_url": "https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/38599834/showcase/-/pipelines/2986824147", "jobs": {"sast": {"status": "success", "url": "https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/38599834/showcase/-/jobs/17450110496"}, "secret_detection": {"status": "success", "url": "https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/38599834/showcase/-/jobs/17450110497"}, "repro": {"status": "success", "url": "https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/38599834/showcase/-/jobs/17450110498"}, "verify": {"status": "success", "url": "https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/38599834/showcase/-/jobs/17450110499"}, "integrity": {"status": "success", "url": "https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/38599834/showcase/-/jobs/17450110500"}}}, "p2p": "11/11", "release": null, "flow_run_url": "https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/38599834/showcase/-/jobs/17450095983", "label": "Proven, adapted"}, {"fix": 34, "title": "security: reject upload names that escape the root", "branch": "release/1.0", "status": "unproven", "state": "\u26d4 Refused: needs a backport by hand", "action": true, "reason": "No core.paths or path-resolving function on this branch (logic is inline in UploadStore.__init__); test could only run by constructing a different object, so not ported.", "probe": {"result": "test cannot run here", "excerpt": null, "job_url": "https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/38599834/showcase/-/jobs/17450095983"}, "pick": null, "adaptation": null, "attempts": [], "mr": null, "p2p": null, "release": null, "flow_run_url": "https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/38599834/showcase/-/jobs/17450095983", "label": "Refused"}, {"fix": 34, "title": "security: reject upload names that escape the root", "branch": "release/0.9", "status": "skipped", "state": "\u23ed Skipped: bug not present", "action": false, "reason": "bug not present (introducing commit 1ca73c66 not on this branch)", "probe": {"result": "bug not present", "excerpt": "test passes unpatched", "job_url": "https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/38599834/showcase/-/jobs/17450095983"}, "pick": null, "adaptation": null, "attempts": [], "mr": null, "p2p": null, "release": null, "flow_run_url": "https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/38599834/showcase/-/jobs/17450095983", "label": "Skipped"}], "versions": ["- !50 (security: reject upload names that escape the root): **Versions:** bug reproduced on release/1.2, release/1.1 \u00b7 fixed in v1.2.4, v1.1.8 \u00b7 not affected: release/0.9 (its regression test passes without the fix) \u00b7 not proven either way: release/1.0", "- !43 (security: reject upload names that escape the root): **Versions:** bug reproduced on release/1.2, release/1.1 \u00b7 not affected: release/0.9 (its regression test passes without the fix) \u00b7 not proven either way: release/1.0", "- !34 (security: reject upload names that escape the root): **Versions:** bug reproduced on release/1.2, release/1.1 \u00b7 not affected: release/0.9 (its regression test passes without the fix) \u00b7 not proven either way: release/1.0"], "coverage_issue_url": "https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/38599834/showcase/-/work_items/3", "read_at": "18:40 UTC, Nov 08"}