feat: support allow-insecure HTTP dependencies#700

Merged

danielmeppiel merged 25 commits into

microsoft:mainfrom

arika0093:feat/allow-http-request

Apr 21, 2026

Commits on Apr 21, 2026

feat: support allow-insecure HTTP dependencies (review item 14 stack split)

arika0093
and
Copilot
committed
fix: address Sergio review on insecure HTTP dependencies (review item 14 stack split)

arika0093
and
Copilot
committed
feat: tighten insecure HTTP dependency safeguards (review item 14 stack split)

arika0093
and
Copilot
committed
feat: gate transitive insecure dependencies by host (review item 14 stack split)

arika0093
and
Copilot
committed
feat: refine HTTP dependency transport and safeguards (review item 14 stack split)

arika0093
and
Copilot
committed
refactor(config): share config command boolean helpers (review item 14 split)

arika0093
and
Copilot
committed
feat: refine HTTP clone and validation transport behavior (review item 14 stack split)

arika0093
and
Copilot
committed
fix(security): suppress credential helpers on HTTP git attempts (review item 1)

arika0093
and
Copilot
committed
fix(drift): treat HTTP transport flips as dependency drift (review item 2)

arika0093
and
Copilot
committed
refactor(install): extract insecure dependency policy module (review item 3)

arika0093
and
Copilot
committed
fix(lockfile): replay allow_insecure for HTTP dependencies (review item 4)

arika0093
and
Copilot
committed
fix(reference): keep canonical dependency strings scheme-free (review item 5)

arika0093
and
Copilot
committed
refactor(lockfile): centralize locked dependency reference mapping (review item 6)

arika0093
and
Copilot
committed
fix(install): unify HTTP dependency remediation errors (review item 7)

arika0093
and
Copilot
committed
docs(security): document HTTP dependency threat model (review item 8)

arika0093
and
Copilot
committed
refactor(install): require logger for insecure policy diagnostics (review item 9)

arika0093
and
Copilot
committed
refactor(install): raise policy errors instead of exiting (review item 10)

arika0093
and
Copilot
committed
fix(install): tighten insecure HTTP warning copy (review item 11)

arika0093
and
Copilot
committed
fix(install): shorten transitive HTTP remediation error (review item 12)

arika0093
and
Copilot
committed
fix(deps): rename insecure list origin column (review item 13)

arika0093
and
Copilot
committed
merge: resolve conflicts with main + extract MCP warning helpers

danielmeppiel
and
Copilot
committed
merge: resolve conflicts with main after PR #809 landed

danielmeppiel
and
Copilot
committed
review: address panel round-2 nits (N1-N5, F2, F3)

committed
review: fix CodeQL "Incomplete URL substring sanitization" finding

committed
Merge branch 'main' into feat/allow-http-request
danielmeppiel
authored

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat: support allow-insecure HTTP dependencies#700

feat: support allow-insecure HTTP dependencies#700
danielmeppiel merged 25 commits into
microsoft:mainfrom
arika0093:feat/allow-http-request

Commits on Apr 21, 2026

feat: support allow-insecure HTTP dependencies (review item 14 stack split)

fix: address Sergio review on insecure HTTP dependencies (review item 14 stack split)

feat: tighten insecure HTTP dependency safeguards (review item 14 stack split)

feat: gate transitive insecure dependencies by host (review item 14 stack split)

feat: refine HTTP dependency transport and safeguards (review item 14 stack split)

refactor(config): share config command boolean helpers (review item 14 split)

feat: refine HTTP clone and validation transport behavior (review item 14 stack split)

fix(security): suppress credential helpers on HTTP git attempts (review item 1)

fix(drift): treat HTTP transport flips as dependency drift (review item 2)

refactor(install): extract insecure dependency policy module (review item 3)

fix(lockfile): replay allow_insecure for HTTP dependencies (review item 4)

fix(reference): keep canonical dependency strings scheme-free (review item 5)

refactor(lockfile): centralize locked dependency reference mapping (review item 6)

fix(install): unify HTTP dependency remediation errors (review item 7)

docs(security): document HTTP dependency threat model (review item 8)

refactor(install): require logger for insecure policy diagnostics (review item 9)

refactor(install): raise policy errors instead of exiting (review item 10)

fix(install): tighten insecure HTTP warning copy (review item 11)

fix(install): shorten transitive HTTP remediation error (review item 12)

fix(deps): rename insecure list origin column (review item 13)

merge: resolve conflicts with main + extract MCP warning helpers

merge: resolve conflicts with main after PR #809 landed

review: address panel round-2 nits (N1-N5, F2, F3)

review: fix CodeQL "Incomplete URL substring sanitization" finding

Merge branch 'main' into feat/allow-http-request