Update Managed Files

[ChiaAutomation]

Note

Low Risk
Changes only affect workflow prompt text and post-processing of review comments; malware scanning and merge logic are unchanged.

Overview
Standardizes how Supply-Chain Malware Review verdicts appear in Dependabot/Renovate PR comments from the Dependency Cursor Review workflow.

The malware task prompt now requires the model to open with a standalone bold line (**Verdict: benign** or **Verdict: malicious**), not plain Verdict: text embedded in prose. After Cursor returns JSON, inline Python format_malware_review_verdict parses verdicts (including mid-sentence mentions), prefers a line-start match, strips duplicate verdict fragments, and rewrites the section so the posted comment always leads with one normalized bold verdict before the reasoning.

^{Reviewed by Cursor Bugbot for commit 66d661f. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Stale Bugbot comment from a previous run.

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 66d661f. Configure here.}

[cursor]

Wrong verdict can be selected

Medium Severity

The formatter promotes the first line-start Verdict: benign or Verdict: malicious token to the PR comment header, even when that token is an instruction example or the prefix of a longer sentence. The posted malware review can then show the opposite conclusion from the analysis.

Additional Locations (1)

• .github/workflows/dependency-cursor-review.yml#L925-L933

 

^{Reviewed by Cursor Bugbot for commit 66d661f. Configure here.}