@taiga-ai/mcp-server 0.36.0-dev.871 → 0.36.0-dev.873

package/dist/index.js

@@ -26189,10 +26189,22 @@ function isFixableFinding(finding) {
 	if (finding.status !== "open") return false;
 	if (finding.location?.historyOnly) return false;
 	if (!isAgentRemediable(finding)) return false;
+	if (finding.fingerprint?.startsWith("base-image:")) return typeof finding.baseMove === "boolean" ? finding.baseMove : baseImageMoveRemoves(finding.data);
 	if (finding.kind === "vulnerable_dependency" && isMaliciousPackageFinding(finding)) return true;
 	return isCodeRemediationKind(finding.kind) || !!finding.recommendedVersion;
 }
 /**
+* Whether moving the base images a finding names to the builds their tags
+* name now removes its advisory (PRO-1728): every base it names moves and the
+* sweep found the advisory gone from each newer build
+* (`data.baseImage.bases[].removed`), as the move itself requires.
+*/
+function baseImageMoveRemoves(data) {
+	const baseImage = typeof data === "object" && data !== null ? data.baseImage : null;
+	const bases = typeof baseImage === "object" && baseImage !== null ? baseImage.bases : null;
+	return Array.isArray(bases) && bases.length > 0 && bases.every((b) => typeof b === "object" && b !== null && typeof b.movesTo === "string" && b.removed === true);
+}
+/**
 * A malicious package (OSV `MAL-*`): its advisory id or one of its aliases
 * says so, or its tier is Act now with no KEV listing, which only a malware
 * advisory earns (`findingTierReason`). The id and aliases come first: a
@@ -26424,10 +26436,16 @@ object({
 	commit: d.commit
 }));
 /**
-* The judges the API runs over what a sweep read (PRO-4070): the runtime
-* judge (PRO-3659) and the base OS judge (PRO-4074). Never an agent's scanner.
+* The sources whose findings no agent scanner's outcome decides (PRO-4070):
+* the API's runtime judge (PRO-3659) and base OS judge (PRO-4074), and the
+* base image reading (PRO-1728), whose findings the agent drafts but only a
+* sweep that read the images may settle.
 */
-const MAINTENANCE_JUDGED_SOURCES = ["runtime", "base_os"];
+const MAINTENANCE_JUDGED_SOURCES = [
+	"runtime",
+	"base_os",
+	"base_image"
+];
 [...MAINTENANCE_SCANNERS, ...MAINTENANCE_JUDGED_SOURCES];
 new Set(MAINTENANCE_SCANNERS);
 /**
@@ -28320,6 +28338,7 @@ const FINDING_ROW_FIELDS = [
 	"tier",
 	"kevListedAt",
 	"malicious",
+	"baseMove",
 	"removal",
 	"replaceable",
 	"status",
@@ -28486,6 +28505,15 @@ function withFixability(row) {
 		fixable: true,
 		fixNote: "A malicious package: taiga_fix_finding removes it (or replaces it), with every advisory on that version."
 	} : row;
+	if (typeof row["baseMove"] === "boolean" && isAgentRemediable({ remediableBy: typeof row["remediableBy"] === "string" ? row["remediableBy"] : null })) return row["baseMove"] === true && row["status"] === "open" ? {
+		...row,
+		fixable: true,
+		fixNote: "taiga_fix_finding moves the base images it is in to the builds their tags name now, the FROM line alone, with every other advisory that move removes."
+	} : {
+		...row,
+		fixable: false,
+		fixNote: "Inside a base image no newer build of which removes it yet: it is fixed by a base move, not a package bump, and is held until one does."
+	};
 	if (dependency && !row["recommendedVersion"] && row["remediableBy"] === "coding_agent") return {
 		...row,
 		fixable: false,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@taiga-ai/mcp-server",
-  "version": "0.36.0-dev.871",
+  "version": "0.36.0-dev.873",
   "description": "Taiga for AI coding assistants: read products, policies, initiatives and runs, and operate the line, over MCP",
   "mcpName": "ga.tai/mcp-server",
   "license": "UNLICENSED",