Bump actions/checkout from 4 to 7 - #4
Open
dependabot[bot] wants to merge 10 commits into
Open
Conversation
…covery Response to the 2026-08-08 external audit. All six P1 findings and the actionable P2s are fixed with regression tests. Backend: - Valuations store a SHA-256 input fingerprint; the API flags stale results and report generation returns 409 until valuation + strategies are refreshed from one consistent state - Unscored comparables get zero weight (was: full base weight) with an explicit warning; new effective_count drives adequacy warnings and the single-comparable band - Strict config validation (unknown keys, NaN/Infinity, negative range_k, negative dollar assumptions, non-positive similarity caps all 422) - CSV import rejects non-finite numbers and surplus cells as row errors; blank property_type/pool stay unknown (nullable columns + migration) instead of being guessed; pool adjustments skip unknown status - Explicit-null PATCH on required fields 422s; PATCH enforces the future-sale-date rule; no-op adjustment edits create no audit events - SQLite FK enforcement, SQL-side audit pagination, pre-read upload size check, report favicon fix Frontend: - Stale banners on valuation/strategies/report + header badge - Generate suggested adjustments persists visible assumption edits first - Failed saves keep drafts and re-enable controls (finally + commit-on- success drafts); report flow uses an explicit open link instead of a blockable popup and updates the stepper; dashboard gains complete/ archive/restore; weights editor blocks an all-zero total Docs/tools: METHODOLOGY calc-v1.1 notes, DATA_DICTIONARY, README (counts, env vars, e2e isolation, expanded known limitations), QA_REPORT addendum, CHANGELOG; verify_math.py verifies the new semantics and no longer assumes CMA id 1 (279 checks passing) Tests: 106 pytest (+19), 33 Vitest (+5), 4/4 Playwright (chromium+webkit)
Fixes the five remaining findings from the follow-up external audit. Backend: - Suggested adjustments record the assumption set that produced them (weight_configurations.suggestions_assumptions + migration). Changing assumptions without regenerating flags the config, adds an outdated_suggestions warning to any valuation computed from them, and blocks report generation (409) until suggestions are regenerated - Reports require a complete chain: no valuation or no strategies is 400, never a seller-facing document with empty sections - Hard input bounds: adjustment amounts +/-$1B, prices <= $1B, living area <= 1M sq ft, lot <= 100M sq ft (API and CSV) so extreme values cannot overflow; nonpositive_estimate warning when the central estimate <= 0 and strategies refuse to price off it (a falsy check previously let negative centrals generate negative list prices) - Strategies record the valuation_id they were derived from (+ migration); seed records the same provenance as the API Frontend: - Manual comparable entry defaults property type and pool to "Not specified" (stored as unknown) instead of guessing single-family/no-pool - Weight, multiplier, and adjustment changes refresh the header staleness flag immediately; adjustments page shows an outdated-suggestions banner and refetches the flag after regenerating - Report page disables Generate and lists exactly what is still missing; strategy cards show the valuation they were computed against Docs: METHODOLOGY provenance/bounds/completeness notes, DATA_DICTIONARY columns and limits, CHANGELOG, README test counts Tests: 112 pytest (+6), 33 Vitest, 4/4 Playwright (chromium+webkit), verify_math 279/279 against the reseeded demo
…-click repair Six previously deferred usability gaps, all user-facing convenience: - Form submits with validation errors focus the first invalid field - 44px touch targets for the include toggles and pool checkbox - Strategy price inputs display $ + thousands separators (text/numeric input; commit strips formatting, accepts pasted currency) - StaleBanner gains a one-click "Recalculate valuation & refresh strategies" button (pages refetch via onRefreshed) - Workflow stepper auto-centers the active step on narrow screens with an edge-fade scroll hint; scrolls only its own container (scrollIntoView panned the whole page on mobile and was replaced) - Inline rename in the CMA header (Enter/Escape, audit-logged; excluded from the staleness fingerprint as a cosmetic field) Verified in-browser on mobile and desktop viewports; 35 Vitest (+2), 4/4 Playwright (chromium+webkit), tsc/ESLint clean, verify_math 279/279.
UX review follow-up: the remaining gaps were all about staleness being invisible in places results appear. - Dashboard: value ranges whose inputs changed show an "outdated: recalculate" badge (the list API already computed the flag; it was simply never rendered) - Strategies: warn when the cards were generated from an earlier valuation (stored valuation_id vs latest) with an inline refresh action, distinct from the inputs-changed banner - Comparables table: secondary columns (sale date, sq ft, beds/baths, distance) collapse below md; sold date moves into the address sub-line and full details remain in the expandable similarity breakdown (10 -> 6 columns on phones) Verified headless on iPhone-width: 6 visible columns, page cannot pan horizontally (window.scrollX stays 0; the documentElement scrollWidth delta is a benign reporting artifact of the stepper's clipped scroller). 35 Vitest, 4/4 Playwright (chromium+webkit), tsc/ESLint clean, build ok. Note: the review's report-completeness and manual-entry-guessing items were already fixed in e01ed99 (gates + "Not specified" defaults).
…caps Third external audit round. The headline finding was real: the suggestion-provenance snapshot only tracked assumptions, so editing the subject's square footage let old adjustments into a "fresh" report. - suggestions_fingerprint (new column + migration) hashes ALL suggestion inputs: assumptions + subject priced fields + every comparable's priced fields (as-of date deliberately excluded to avoid daily false flags). Subject edits, comp edits, and newly added comps now flag suggestions outdated, warn on the valuation, and block the report - Strategy generation and price edits 409 while the latest valuation is stale, closing the API path that priced strategies off known-outdated numbers - Magnitude caps: assumptions <= $1B, similarity params <= 1M, subject living area/lot size capped, so extreme finite values cannot overflow into server errors - Subject property_type/has_pool now nullable with "Not specified" defaults (+ migration), matching the comparables' never-guess rule; report template renders unknowns as placeholders - Saving assumptions refreshes the header staleness flag immediately - Docs: corrected test counts (117/35), METHODOLOGY provenance section, DATA_DICTIONARY columns Tests: 117 pytest (+5, 1 strengthened), 35 Vitest, 4/4 Playwright, verify_math 279/279, migration up/down/up verified
Found while live-demoing the provenance gate: fingerprints hashed 1850 (int) and 1850.0 (float) differently, so SQLite/JSON round-trips could flip staleness flags on identical values. Two real consequences: - seed.py assigns int literals to Float columns and fingerprints them pre-persistence, so a fresh demo seed reported its own suggestions as outdated (unknown/true) the moment the values round-tripped - config defaults hold ints (bedroom_cap: 3) that become 3.0 after any user save, silently changing the valuation fingerprint All numeric fingerprint leaves are now normalized to float (bools kept as bools, dates as ISO strings) in both valuation and suggestion fingerprints. Verified live: fresh seed -> clean; subject resized -> flagged + report 409; reverted -> clean + report 201. Also: README roadmap notes the hosted read-only demo as future work (blocked on auth + rate limiting). Tests: 119 pytest (+2: type-stability unit test, seeded-provenance regression)
… ints Fourth external audit round, all four findings: - The one-click repair now regenerates outdated suggested adjustments before recalculating valuation and strategies (it previously cleared the banner while leaving the report gate blocked); button renamed to "Refresh the full analysis" and covered by two new component tests - Unknown provenance FAILS CLOSED: valuations/suggestions with null fingerprints (rows migrated from before provenance tracking) now 409 on strategy generation and reports until recalculated, instead of silently passing verification they cannot satisfy - CSV integer caps (bedrooms/parking <= 50, bathrooms <= 50, distance <= 20,000 mi): bedrooms=1e308 becomes a row error instead of a database-overflow 500 - Test counts corrected in README/ARCHITECTURE (121 backend / 36 frontend) Tests: 121 pytest (+2), 36 Vitest (+1), 4/4 Playwright, verify_math 279/279 on the reseeded demo
Bumps [actions/checkout](https://github.com/actions/checkout) from 4 to 7. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@v4...v7) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps actions/checkout from 4 to 7.
Release notes
Sourced from actions/checkout's releases.
... (truncated)
Changelog
Sourced from actions/checkout's changelog.
... (truncated)
Commits
3d3c42eprep v7.0.1 release (#2531)2880268escape values passed to --unset (#2530)12cd223trim only ascii whitespace for branch (#2521)62661c4skip running unsafe pr check if input is default (#2518)e8d4307Bump the minor-actions-dependencies group with 2 updates (#2499)631c942eslint 9 (#2474)4f1f4aeBump actions/upload-artifact from 4 to 7 (#2476)ba09753Bump actions/checkout from 6 to 7 (#2488)b9e0990Bump docker/login-action from 3.3.0 to 4.2.0 (#2479)e8cb398Bump docker/build-push-action from 6.5.0 to 7.2.0 (#2478)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)