T3MP3ST v1 — hardened launch (AGPL, verify-claims 24/24, leak-scrubbed)

bench/cve-zero/samples/GHSA-x9g3-xrwr-cwfg/ground-truth.json

@@ -0,0 +1 @@
+{"ghsa": "GHSA-x9g3-xrwr-cwfg", "repo": "piscinajs/piscina", "cwes": ["CWE-1321", "CWE-94"], "summary": "fix: avoid tampering name and filename (prototype pollution via options)", "fix_commit": "1955a419c9db3d5f6b8e5958244b399c43cc2ea2", "parent_commit": "7af6e8300ed1083b0d312ab6756af5303831f265", "vuln_files": ["src/index.ts"], "vuln_lines": {"src/index.ts": [734, 759, 806, 809, 810]}, "source_files": 16, "scope_dirs": ["src"], "source_note": "Subset: only the src/ package (containing the vuln file) was copied into source/, not the full repo. The fix mechanically rewrote the whole Piscina constructor (options -> opts, adding '__proto__': null) and the run() options destructuring; vuln_lines records the load-bearing old-side locations (constructor entry 734, ThreadPool construction 759, and the run() destructuring 806/809/810) rather than every renamed line in the 731-812 hunk."}