Issues

• [Security] GHSA-ch52-4w7c-c8xp (http-cache-semantics) has no fixed release, so docs/bun.lock fails the audit gate until upstream resolves it

  dependenciesinfrastructurepriority: mediumsecurityseverity: low
  pathosDev/actor-ts#1664 · Filter by author pathosDev opened on Oct 7, 2026

• [Security] The three audited Bun lockfiles carry 1 critical and 17 high advisories — the audit gate has been red since 2026-09-30

  bugdependenciesinfrastructurepriority: highsecurityseverity: medium
  pathosDev/actor-ts#1663 · Filter by author pathosDev opened on Oct 7, 2026
  1

• [Bug] KubernetesLease stamps an acquire before its GET, so a slow GET shortens the first lease period — and one slower than the TTL yields a win checkAlive() denies at once

  bugpriority: lowseverity: low
  pathosDev/actor-ts#1661 · Filter by author Nevs08 opened on Oct 6, 2026

• [Security] An applied LeaseMajority win is never re-checked, so a winner that stalls past the TTL afterwards survives beside the side that took the lease

  bugpriority: highproduction-goalsecurityseverity: high
  pathosDev/actor-ts#1660 · Filter by author Nevs08 opened on Oct 6, 2026

• [Security] KubernetesLease.release() deletes the Lease object unconditionally, so a holder stepping down on a stale held flag can delete its successor's record

  bugpriority: highproduction-goalsecurityseverity: medium
  pathosDev/actor-ts#1659 · Filter by author Nevs08 opened on Oct 6, 2026

• [Bug] lint:knip is red on develop: two chat-example tests spawn a cwd-relative script, and knip resolves it against the test's own directory

  buginfrastructurepriority: medium
  pathosDev/actor-ts#1641 · Filter by author pathosDev opened on Sep 28, 2026

• [Security] The unbounded system-queue drain is a starvation surface, and only the queue is documented

  priority: mediumproduction-goalsecurityseverity: medium
  pathosDev/actor-ts#1633 · Filter by author pathosDev opened on Sep 25, 2026

• [Security] Snapshot and durable-state stores never validate persistence-id content

  enhancementpriority: lowsecurityseverity: low
  pathosDev/actor-ts#1632 · Filter by author pathosDev opened on Sep 25, 2026

• [Feature] Run the Prometheus exposition through a real parser

  enhancementpriority: mediumproduction-goal
  pathosDev/actor-ts#1631 · Filter by author pathosDev opened on Sep 25, 2026

• [Security] A wrapper around an internal seam is published without any gate noticing

  priority: mediumproduction-goalsecurityseverity: medium
  pathosDev/actor-ts#1630 · Filter by author pathosDev opened on Sep 25, 2026

• [Security] TcpTransport logs a peer-supplied address unescaped, so a peer forges log records

  priority: mediumsecurityseverity: medium
  pathosDev/actor-ts#1629 · Filter by author pathosDev opened on Sep 25, 2026

• [Security] graphify.yml installs and runs a third-party Python package in the job that holds contents: write, and WorkflowHygiene's INSTALL_COMMAND does not know pip

  buginfrastructurepriority: lowsecurityseverity: low
  pathosDev/actor-ts#1623 · Filter by author pathosDev opened on Sep 21, 2026

• [Test] Docs quote benchmark figures that nothing pins to the benchmark headers they come from

  documentationenhancementpriority: low
  pathosDev/actor-ts#1592 · Filter by author pathosDev opened on Sep 19, 2026

• [Test] NoSyncWorkInHandlers ratchet: a false ledger reason, missing blocking names, and a scanner scope hole

  enhancementinfrastructurepriority: low
  pathosDev/actor-ts#1591 · Filter by author pathosDev opened on Sep 19, 2026

• [Test] Routing recipes bound by no test: the self-healing Router.roundRobin(n, BackoffSupervisor.factory(…)) pool, and smallest-mailbox over the worker mesh

  enhancementpriority: low
  pathosDev/actor-ts#1590 · Filter by author pathosDev opened on Sep 19, 2026

• [Bug] canonicalActorPathString is prefix-only: doubled/trailing separators and line terminators still make targetPath and .path disagree

  bugpriority: lowseverity: low
  pathosDev/actor-ts#1589 · Filter by author pathosDev opened on Sep 19, 2026

• [Docs] Custom WorkerBackend: the docs sample calls an undefined InMemoryWorker (never type-checked) and no withBackend JSDoc mentions containsWorkerErrors

  documentationpriority: low
  pathosDev/actor-ts#1588 · Filter by author pathosDev opened on Sep 19, 2026

• [Feature] MetricsRelay: bind stop() on coordinated shutdown, propagate registry options to workers, arm the ticker only while metrics are on

  enhancementpriority: low
  pathosDev/actor-ts#1587 · Filter by author pathosDev opened on Sep 19, 2026

• [Test] tcp-message-cost: the completion check admits a broken transport in two variants — pin TELL_BATCH and the far-node placement outside the file

  enhancementpriority: low
  pathosDev/actor-ts#1586 · Filter by author pathosDev opened on Sep 19, 2026

• [Docs] PARALLELISM_WIRE_KINDS JSDoc names a dead-protocol guard that does not read it

  documentationpriority: low
  pathosDev/actor-ts#1585 · Filter by author pathosDev opened on Sep 19, 2026

• [Test] examples/chat: bind that onReceive returns the match result so the cell holds the mailbox

  enhancementpriority: low
  pathosDev/actor-ts#1584 · Filter by author pathosDev opened on Sep 19, 2026

• [Feature] Testkit conformance helper: prove a WorkerBackend's containsWorkerErrors=true on a real thread

  enhancementpriority: low
  pathosDev/actor-ts#1583 · Filter by author pathosDev opened on Sep 19, 2026

• [Bug] A RemoteActorRef to the node's own address decodes an ask-response replyTo to Nobody, so a loopback ask never gets its reply

  bugpriority: mediumseverity: medium
  pathosDev/actor-ts#1582 · Filter by author pathosDev opened on Sep 19, 2026

• [Feature] Bridge WorkerBroker.dropped() into a worker_broker_dropped_frames_total{reason} stock metric

  enhancementpriority: low
  pathosDev/actor-ts#1581 · Filter by author pathosDev opened on Sep 19, 2026

• [Feature] Deno: object-storage compression still runs on the main thread despite the async zlib forms

  enhancementpriority: low
  pathosDev/actor-ts#1580 · Filter by author pathosDev opened on Sep 19, 2026