From 46ecd5a180c8d90961b52071ff9436dfdd73eb35 Mon Sep 17 00:00:00 2001 From: Alberto Martinez Date: Mon, 19 Oct 2026 13:19:29 +0200 Subject: [PATCH] Use latest FCS CLI version in the security scan FCS CLI 2.0.2 is no longer available for download, which made the security scan fail with exit code 6. Stop pinning the version so the scan action uses its default, `latest`. --- .github/workflows/build.yml | 1 - CHANGELOG.md | 1 + 2 files changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 77e01ef..9200740 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -45,7 +45,6 @@ jobs: falcon_client_id: ${{ secrets.FALCON_CLIENT_ID }} falcon_client_secret: ${{ secrets.FALCON_CLIENT_SECRET }} falcon_region: ${{ secrets.FALCON_REGION }} - fcs_version: "2.0.2" - name: Push Docker image uses: docker/build-push-action@v6 with: diff --git a/CHANGELOG.md b/CHANGELOG.md index 8b8791c..5df250f 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -11,6 +11,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 - Upgraded all locked dependencies to their latest versions to address vulnerabilities reported in the Docker image scan (including `starlette`, `fastapi`, `urllib3`, `aiohttp`, `requests` and `certifi`). - Rebuilt the Docker image as a multi-stage build on a pinned base image (`python:3.13-alpine3.24`) with the latest Alpine security patches applied. The runtime image no longer includes build tools, `git`, `curl`, `uv`, `pip` or dev dependencies, reducing its size from 569MB to 210MB. - The release workflow now builds the image without cache and from the latest base image, and scans the freshly built image before pushing it. +- The security scan now uses the latest CrowdStrike FCS CLI version instead of the pinned `2.0.2`, which is no longer available for download. ### Fixed - Declared `httpx` as a direct dependency; it was previously only available transitively through `openai`.