Repository navigation
fix(deps): remediate OpenSSF-reported vulnerable dependencies - #14685
Merged
Merged
Conversation
Address advisories from the OpenSSF Scorecard vulnerabilities check across the Python, Java, and Go dependency trees. Python: - gitpython -> 3.1.55 (docs; lock 3.1.57): GHSA-2f96/3rp5/6p8h/94p4/ 956x/fjr4/r9mr/rwj8/v396 - cryptography -> 48.0.1 (pycloudlib, shibboleth): GHSA-537c - pymdown-extensions -> 11.0.0 (docs; lock 11.0.1): GHSA-9xwg - click -> 8.3.3 (pycloudlib, configurator, cloudtools, shibboleth, docs): PYSEC-2026-2132 - lxml-html-clean -> 0.4.5 (automation): PYSEC-2026-2614 - setuptools -> 83.0.0 (pycloudlib, linux-setup): PYSEC-2026-3447 - pyasn1 -> 0.6.4 (linux-setup): PYSEC-2026-3455/3456/3457 - mcp -> 1.28.1 (demos/mcp): PYSEC-2026-3481/3482/3483 Java: - jackson-databind/jackson-core -> 2.22.1 (jans-bom, config-api, cedarling_uniffi): GHSA-3pjw/5gvw/5hh8/5jmj/9fxm/hgj6/j3rv/mhm7/ rcqc/rmj7/r7wm - nimbus-jose-jwt -> 9.37.4 (cedarling bindings; jans-bom already 10.0.2): GHSA-xwmg Go (go mod tidy, build verified): - golang.org/x/net -> 0.56.0: GO-2026-5942 - golang.org/x/text -> 0.39.0: GO-2026-5970 - google.golang.org/grpc -> 1.82.1: GO-2026-6061 - github.com/klauspost/compress -> 1.18.7: GO-2026-5841 - go.opentelemetry.io/otel -> 1.44.0: GO-2026-5158 Not fixable (documented, no upstream fix or unreachable): - GO-2026-5932 (x/crypto/openpgp): unmaintained, sub-package not imported; already noted in go.mod - RUSTSEC-2023-0071 (rsa), 2021-0127 (serde_cbor), 2026-0194/0195 (quick-xml): already accepted in deny.toml / .cargo/audit.toml Signed-off-by: moauto <54212639+mo-auto@users.noreply.github.com>
mo-auto
requested review from
devrimyatar,
iromli,
moabu,
pujavs,
yurem,
yuriyz and
yuriyzz
as code owners
August 3, 2026 14:05
Contributor
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
💤 Files with no reviewable changes (1)
📝 WalkthroughWalkthroughThis pull request updates dependency versions in Python, Maven, and Go manifests. It removes pinned Python dependencies and adds temporary OSV-Scanner exceptions with documented rationales and expiry dates. ChangesDependency and vulnerability updates
Estimated code review effort: 2 (Simple) | ~15 minutes Possibly related PRs
Suggested labels: Suggested reviewers: 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches 💡 1🛠️ Fix failing CI checks 💡
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
mo-auto
added
area-CI
Member
Author
|
| Status | Scan Engine |  Critical |
 High |
 Medium |
 Low |
Total (0) |
|---|---|---|---|---|---|---|
| Open Source Security | 0 | 0 | 0 | 0 | See details |
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.
coderabbitai
Bot
added
the
kind-dependencies
…canner.toml The OpenSSF Scorecard Vulnerabilities check reads osv-scanner.toml next to each lockfile (deny.toml / .cargo/audit.toml are only read by the local cargo-audit job). Add IgnoredVulns entries for the advisories with no upstream fix or that are unreachable, so they stop lowering the score: - jans-cedarling/osv-scanner.toml (Cargo.lock): RUSTSEC-2023-0071 (rsa), RUSTSEC-2021-0127 (serde_cbor), RUSTSEC-2026-0194/0195 (quick-xml) - jans-cedarling/cedarling_opa/osv-scanner.toml and terraform-provider-jans/osv-scanner.toml (go.mod): GO-2026-5932 (x/crypto/openpgp, sub-package not imported) Each entry carries a reason and an ignoreUntil review date. Signed-off-by: moauto <54212639+mo-auto@users.noreply.github.com>
mo-auto
had a problem deploying
to
integration-tests
August 3, 2026 14:13 — with 
GitHub Actions
Failure
GitHub Actions
Failure
mo-auto
had a problem deploying
to
integration-tests
August 3, 2026 14:13 — with
GitHub Actions
Failure
GitHub Actions
Failure
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@demos/mcp/config-api/mcp-config-api-server/requirements.txt`:
- Line 1: Update the requirements declaration containing mcp>=1.28.1 to add a
direct minimum constraint for python-multipart at the patched release, then
regenerate the lockfile and rerun OSV Scanner to verify python-multipart==0.0.9
is excluded.
In `@docker-jans-shibboleth/requirements.txt`:
- Around line 1-4: Add a direct minimum requests version constraint to
docker-jans-shibboleth/requirements.txt, using requests>=2.33.0 or newer,
alongside the existing dependencies so webdavclient3 cannot resolve the affected
older transitive version.
In `@jans-bom/pom.xml`:
- Around line 54-56: Add the annotation-specific property
jackson.annotations.version with value 2.22 alongside the existing Jackson
version properties, then update the jackson-annotations dependency at the
relevant declaration to reference this property instead of the general
jackson.version.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 1f5bef86-4d00-4b4a-a768-009b1eb0786b
⛔ Files ignored due to path filters (3)
docs/poetry.lockis excluded by!**/*.lockjans-cedarling/cedarling_opa/go.sumis excluded by!**/*.sumterraform-provider-jans/go.sumis excluded by!**/*.sum
📒 Files selected for processing (15)
automation/requirements.txtdemos/mcp/config-api/mcp-config-api-server/requirements.txtdocker-jans-cloudtools/requirements.txtdocker-jans-configurator/requirements.txtdocker-jans-shibboleth/requirements.txtdocs/pyproject.tomljans-bom/pom.xmljans-cedarling/bindings/cedarling-java/pom.xmljans-cedarling/bindings/cedarling_uniffi/javaApp/pom.xmljans-cedarling/cedarling_opa/go.modjans-config-api/pom.xmljans-linux-setup/requirements.txtjans-linux-setup/setup.pyjans-pycloudlib/pyproject.tomlterraform-provider-jans/go.mod
Contributor
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@jans-cedarling/cedarling_opa/osv-scanner.toml`:
- Around line 4-7: Update the GO-2026-5932 entries in
jans-cedarling/cedarling_opa/osv-scanner.toml (lines 4-7) and
terraform-provider-jans/osv-scanner.toml (lines 4-7) to document the exception
as module-wide, then add automated checks for both modules that fail before
merge if their dependency imports golang.org/x/crypto/openpgp.
In `@jans-cedarling/osv-scanner.toml`:
- Around line 6-9: Update the RUSTSEC-2023-0071 entry in IgnoredVulns: verify
cedarling’s deployed JWT path and, if it only performs RS/PS public-key
verification, state that explicitly and document how remote callers cannot
observe private-key operations; otherwise remove this exception and replace the
rsa-dependent signing path.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 03cff3e2-6060-43f5-80d4-0014b0fca7f0
📒 Files selected for processing (3)
jans-cedarling/cedarling_opa/osv-scanner.tomljans-cedarling/osv-scanner.tomlterraform-provider-jans/osv-scanner.toml
yuriyz
previously approved these changes
Aug 3, 2026
iromli
requested changes
Aug 3, 2026
…ationale
Jackson 2.20+ dropped the patch segment from jackson-annotations, so the
artifact ships as 2.22 (2.22.1 does not exist on Maven Central). The explicit
jackson-annotations management entry forced ${jackson.version}=2.22.1, which
would fail to resolve; add a jackson.annotations.version=2.22 property and
reference it (mirrors jackson-bom's own jackson.version.annotations split).
Also tighten the osv-scanner.toml ignore rationales:
- RUSTSEC-2023-0071 (rsa): document that cedarling only verifies JWTs with
issuer public keys and never performs an RSA private-key op, so the Marvin
private-key timing side-channel is unreachable.
- GO-2026-5932 (x/crypto/openpgp): note the module-wide exception is justified
by 'go list -deps' showing the openpgp sub-package is not imported.
Signed-off-by: moauto <54212639+mo-auto@users.noreply.github.com>
mo-auto
had a problem deploying
to
integration-tests
August 3, 2026 15:51 — with
GitHub Actions
Error
GitHub Actions
Error
mo-auto
had a problem deploying
to
integration-tests
August 3, 2026 15:51 — with
GitHub Actions
Error
GitHub Actions
Error
Both images install jans-pycloudlib, which already requires Click>=8.3.3 (PYSEC-2026-2132 fix), so the explicit click pin is redundant. Left intact in docker-jans-shibboleth, which does not install jans-pycloudlib. webdavclient3 is not a jans-pycloudlib dependency and stays in shibboleth. Signed-off-by: moauto <54212639+mo-auto@users.noreply.github.com>
mo-auto
had a problem deploying
to
integration-tests
August 3, 2026 15:57 — with
GitHub Actions
Error
GitHub Actions
Error
mo-auto
had a problem deploying
to
integration-tests
August 3, 2026 15:57 — with
GitHub Actions
Error
GitHub Actions
Error
webdavclient3 is not imported anywhere in the image (or the repo); drop the unused dependency. Signed-off-by: moauto <54212639+mo-auto@users.noreply.github.com>
coderabbitai
Bot
added
the
comp-docker-jans-saml
mo-auto
temporarily deployed
to
integration-tests
August 3, 2026 16:07 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
mo-auto
temporarily deployed
to
integration-tests
August 3, 2026 16:07 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
iromli
approved these changes
Aug 3, 2026
|
|
|
moabu
approved these changes
Aug 3, 2026
This branch was previously deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Remediates the vulnerable dependencies flagged by the OpenSSF Scorecard vulnerabilities check, across the Python, Java, and Go dependency trees. Each bump targets the fixed version from the corresponding OSV/GHSA advisory.
Python
jans-pycloudlibfloors drive every docker image, so the core fixes land there.Java
jans-bom,jans-config-api,cedarling_uniffi): GHSA-3pjw, 5gvw, 5hh8, 5jmj, 9fxm, hgj6, j3rv, mhm7, rcqc, rmj7, r7wm. Several are only fixed in 2.21.5+, so a 2.18.x bump is insufficient; 2.22.1 is already used byjans-casa.jans-bomalready 10.0.2): GHSA-xwmg.Go (
go mod tidy+ build verified)terraform-provider-jansandcedarling_opacedarling_opaNot fixable — no upstream fix / unreachable (already documented)
jans-cedarling/deny.tomland.cargo/audit.toml(no upstream fix, or dev-only profiling chain that never parses untrusted input).Test and Documentation
go mod tidy+go build ./...pass for both modules (cedarling_opa's final CGO link needs the prebuilt Rust native lib, unrelated to these bumps).docs/poetry.lockregenerated with Poetry.Closes #14686,
Summary by CodeRabbit
Chores
Security