From 71207827ca05c83b5fb54cf796f697870e7efad1 Mon Sep 17 00:00:00 2001 From: Daniel Han Date: Tue, 30 Jun 2026 22:24:46 -0700 Subject: [PATCH] Keep the JS-bundle scan check size-agnostic so the baseline does not drift (#6770) check_js_file put the bundle's KB size inside the finding's check label, which is part of the baseline match key (package, file, check). When tensorboard's projector_binary.js grew from 1918 KB to 1933 KB, the reviewed baseline entry stopped matching and the benign HIGH resurfaced, red-failing the studio and extras scan-packages shards. Move the size into the evidence field (shown for review, not matched) and keep the check label constant, then update the one tensorboard baseline entry to the size-agnostic label. The finding is suppressed again and will not re-break when the bundle grows by a few KB. Scanner self-tests pass unchanged. Co-authored-by: danielhanchen --- scripts/scan_packages.py | 7 ++++--- scripts/scan_packages_baseline.json | 2 +- 2 files changed, 5 insertions(+), 4 deletions(-) diff --git a/scripts/scan_packages.py b/scripts/scan_packages.py index 4be9fc5efb..ce9763e235 100644 --- a/scripts/scan_packages.py +++ b/scripts/scan_packages.py @@ -1208,9 +1208,10 @@ def check_js_file(content: str, filename: str, package: str) -> list[Finding]: HIGH, package, filename, - f"Python wheel ships large ({len(content) // 1024} KB) JS bundle " - "(uncommon; manually review)", - "", + # Size stays in evidence, not the check label, so the baseline key + # does not drift when a wheel's bundle grows by a few KB. + "Python wheel ships large JS bundle (uncommon; manually review)", + f"{len(content) // 1024} KB JS bundle", ) ) return findings diff --git a/scripts/scan_packages_baseline.json b/scripts/scan_packages_baseline.json index f953f4d206..0c10ae3222 100644 --- a/scripts/scan_packages_baseline.json +++ b/scripts/scan_packages_baseline.json @@ -1181,7 +1181,7 @@ { "package": "tensorboard", "file": "tensorboard/plugins/projector/tf_projector_plugin/projector_binary.js", - "check": "Python wheel ships large (1918 KB) JS bundle (uncommon; manually review)", + "check": "Python wheel ships large JS bundle (uncommon; manually review)", "severity": "HIGH", "evidence": "" },