@taiga-ai/mcp-server 0.36.0-dev.920 → 0.36.0-dev.921

package/dist/index.js

@@ -26346,8 +26346,19 @@ function isFixableFinding(finding) {
 		return typeof finding.baseMove === "boolean" ? finding.baseMove : baseImageMoveRemoves(finding.data);
 	}
 	if (finding.kind === "vulnerable_dependency" && isMaliciousPackageFinding(finding)) return true;
+	if (isPinBlocked(finding)) return false;
 	return isCodeRemediationKind(finding.kind) || !!finding.recommendedVersion;
 }
+/**
+* Whether a Fix cannot work: another package's pin caps this finding's fix, and
+* the last fix ended still vulnerable against it (`opentelemetry-api` under
+* `aws-opentelemetry-distro`'s `==1.44.0`). Another would spend a run to meet
+* it again. Blocked with no such fix, a person's Fix still runs (AC-17): they
+* may know a way round. The gate lifts the hold when the pin moves.
+*/
+function isPinBlocked(finding) {
+	return finding.autoFixHeld?.reason === "blocked_by_dependency" && finding.autoFixHeld.fixFailed === true;
+}
 function baseImageMoveRemoves(data) {
 	const baseImage = typeof data === "object" && data !== null ? data.baseImage : null;
 	const bases = typeof baseImage === "object" && baseImage !== null ? baseImage.bases : null;
@@ -28781,7 +28792,7 @@ function withFixability(row) {
 		return {
 			...row,
 			fixable: false,
-			fixNote: reason === "not_shipped" ? "No longer applies: the package is only a build for platforms the repository does not deploy to. Nothing to do." : reason === "license_approved" ? "No longer applies: its license is on the organization's approved list. Nothing to do." : reason === "license_undecided" ? "No longer applies: its license can no longer be judged against the list (some of what it can stand for is approved). Nothing to do." : reason === "superseded" ? "Replaced by the repository's finding of its license, which lists every package under it. Nothing to do here." : "Resolved: the sweep no longer reports it. Nothing to do."
+			fixNote: reason === "not_shipped" ? "No longer applies: the package is only a build for platforms the repository does not deploy to. Nothing to do." : reason === "license_approved" ? "No longer applies: its license is on the organization's approved list. Nothing to do." : reason === "license_undecided" ? "No longer applies: its license can no longer be judged against the list (some of what it can stand for is approved). Nothing to do." : reason === "superseded" ? "Replaced by the repository's finding of its license, which lists every package under it. Nothing to do here." : reason === "license_not_judged" ? "No longer applies: an OS package's license is judged only when it restricts use. Its packages keep it. Nothing to do." : "Resolved: the sweep no longer reports it. Nothing to do."
 		};
 	}
 	if (row["kind"] === "license_violation" && row["replaceable"] === true) return {
@@ -28820,6 +28831,16 @@ function withFixability(row) {
 		fixable: true,
 		fixNote: "A malicious package: taiga_fix_finding removes it (or replaces it), with every advisory on that version."
 	} : row;
+	const held = row["autoFixHeld"];
+	const inBase = row["baseImageFix"] != null || typeof row["baseMove"] === "boolean";
+	if (row["status"] === "open" && !inBase && held && isPinBlocked({ autoFixHeld: held })) {
+		const what = held.blockingPackage ?? "another dependency";
+		return {
+			...row,
+			fixable: false,
+			fixNote: `Waiting on ${what}${held.blockingConstraint ? `, which requires ${held.blockingConstraint}` : ""}. taiga_fix_finding refuses it until that moves.`
+		};
+	}
 	const base = row["baseImageFix"];
 	if (base && base.way !== "move" && isAgentRemediable({ remediableBy: remediableByOf(row) })) {
 		if (base.way === "upgrade") return row["status"] === "open" ? {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@taiga-ai/mcp-server",
-  "version": "0.36.0-dev.920",
+  "version": "0.36.0-dev.921",
   "description": "Taiga for AI coding assistants: read products, policies, initiatives and runs, and operate the line, over MCP",
   "mcpName": "ga.tai/mcp-server",
   "license": "UNLICENSED",