MWG rule-basis anchor broken: defensive-browser-policies-validate-origins (guide validate-origins)
Nobody has claimed this yet.
Assessment
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Newbie friendliness
- 55/100
- Issue type
- Bug
- Clarity
- Mostly clear
- Activity status
- Active
- Tech stack
- javascript, node.js
- Domain
- tooling
Research direction
Start by locating the drift check that emits ANCHOR-BROKEN and the registry entry for rule defensive-browser-policies-validate-origins. Compare its quoted anchor with the validate-origins guide in upstream version 0.0.195; the issue does not name source files or tests. Done means the rule evidence points to text that exists in the guide and the anchor check passes.
Written by the indexing model from the issue text.
Description
This is an anchor-broken alert. It is NOT a stale-heartbeat alert and NOT an unactioned-delta alert: the drift check ran, and what failed is the rule basis it verifies.
Upstream version: 0.0.195
Rule-basis anchor problem(s): 1
The registry quotes verbatim guide text as evidence for each rule, so an anchor that no longer
resolves means the guide we depend on has moved (or vanished) and a human must re-anchor it.
Refreshing the heartbeat cannot repair this, and neither can waiting for a version delta: the
versions may already agree.
Violations:
- rule
defensive-browser-policies-validate-origins, guidevalidate-origins, anchor "event.origin === 'https://trusted.example.com'"
Drift-check output:
ANCHOR-BROKEN: 1 rule-basis anchor problem(s) against upstream 0.0.195
- Rule "defensive-browser-policies-validate-origins" for guide "validate-origins": anchor not found in guide text: "event.origin === 'https://trusted.example.com'"
ANCHOR-BROKEN: 1 rule-basis anchor problem(s) against upstream 0.0.195
{"result":"anchor-broken","analysedVersion":"0.0.194","upstreamVersion":"0.0.195","checkedAt":"2026-10-20T01:01:46.760Z","source":"https://registry.npmjs.org/modern-web-guidance/latest","anchorCheck":{"result":"anchor-broken","rules":8,"anchors":16,"violations":["Rule \"defensive-browser-policies-validate-origins\" for guide \"validate-origins\": anchor not found in guide text: \"event.origin === 'https://trusted.example.com'\""],"source":"https://registry.npmjs.org/modern-web-guidance/-/modern-web-guidance-0.0.195.tgz"}}
- Dominant language
- JavaScript
- Stars
- 11
- Forks
- 1
- PR merge metrics
- No merged PRs in 30d
Getting set up
This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from PaulKinlan/web-uplift
-
Difficulty 1/5 1-3 hours Newbie friendliness 82/100
PaulKinlan/web-uplift#18 ·
-
Difficulty 3/5 1-2 days Newbie friendliness 45/100
PaulKinlan/web-uplift#29 ·
-
Difficulty 4/5 3-5 days Newbie friendliness 45/100
PaulKinlan/web-uplift#28 ·
All issues in PaulKinlan/web-uplift
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
Maintainers usually reply within 1 day
-
enhancement
Difficulty 1/5 Under an hour Newbie friendliness 84/100
Maintainers usually reply within 1 day
-
Difficulty 1/5 Under an hour Newbie friendliness 88/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 66/100
remotion-dev/remotion#13341 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
svix/svix-webhooks#2808 ·
Maintainers usually reply within 1 day