Thu Vo vctqs1

Practical Mitigation for Nx CREEP (CVE-2025-36852) Using GCP IAM Conditions

TL;DR

If you're using deprecated Nx self-hosted remote cache packages like @nx/gcs-cache, one immediate mitigation for the CREEP vulnerability is:

allow PR builds to restore cache artifacts
allow only trusted branches (main) to write cache artifacts
enforce this at the GCP IAM layer using Workload Identity Federation conditions

Code size comparison

This comparison between Connect-Web and gRPC-web

We generated code for the proto using protoc-gen-grpc-web and protoc-gen-connect-es. We then bundled a client for the service (see the client's PR) with vite, compressed it as a web server would usually do.

manabuf-syllabus-ts proto

protoc-gen-grpc-web: https://github.com/manabie-com/manabuf-syllabus-ts/commit/e71368eb9ed9ba620c06b707937437d3ac21a20e
protoc-gen-connect-es: https://github.com/manabie-com/manabuf-syllabus-ts/pull/184

	#!/bin/bash
	# This script cherry-picks the commits from a PR
	# Usage: ./cherry_pick_pr.sh <pr-number>
	set -e

	PR_NUMBER=$1

	# Check if PR number is provided
	if [ -z "$PR_NUMBER" ]; then
	echo "Usage: $0 <pr-number>"