Repository navigation
fix: bootstrap image security remediation with retained evidence - #2409
Open
groupthinking wants to merge 7 commits into
Open
groupthinking wants to merge 7 commits into
groupthinking wants to merge 7 commits into
Conversation
Bumps [source-map-js](https://github.com/7rulnik/source-map-js) from 1.2.1 to 1.2.2. - [Release notes](https://github.com/7rulnik/source-map-js/releases) - [Changelog](https://github.com/7rulnik/source-map-js/blob/main/CHANGELOG.md) - [Commits](7rulnik/source-map-js@v1.2.1...v1.2.2) --- updated-dependencies: - dependency-name: source-map-js dependency-version: 1.2.2 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [proxy-addr](https://github.com/jshttp/proxy-addr) from 2.0.7 to 2.0.8. - [Release notes](https://github.com/jshttp/proxy-addr/releases) - [Changelog](https://github.com/jshttp/proxy-addr/blob/master/HISTORY.md) - [Commits](jshttp/proxy-addr@v2.0.7...v2.0.8) --- updated-dependencies: - dependency-name: proxy-addr dependency-version: 2.0.8 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
Contributor
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Contributor
|
Important
This repository does not receive automatic reviews because it has fewer than 10 stars. ⚙️ Run configuration
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
github-actions
Bot
added
ci/cd
documentation
Contributor
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found. |
Contributor
✅ E2E Test Results: ALL TESTS PASSED
Test Output |
Contributor
🔍 PR Validation |
Contributor
✅ E2E Test Results: ALL TESTS PASSED
Test Output |
This was referenced Oct 12, 2026
Contributor
✅ E2E Test Results: ALL TESTS PASSED
Test Output |
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
The bootstrap merge path remains unresolved, and SARIF enforcement does not honor the intended severity threshold.
2 open findings
What changed in this PR
Patches dependencies in UVAI’s application image and introduces blocking Trivy checks. This is partial remediation; the parent security backlog remains open.
Changes:
- Updates npm dependencies and Python packaging constraints.
- Enforces image vulnerability checks and retains scan evidence.
- Aligns merge policy and regression tests with enforcement.
| File | Description |
|---|---|
| tests/unit/test_merge_policy_security_scan_wording.py | Tests enforcement, evidence retention, and dependency floors. |
| package.json | Updates dependency pins and overrides. |
| package-lock.json | Records patched dependency versions. |
| MERGE_POLICY.md | Documents blocking image checks and exception requirements. |
| Dockerfile | Updates packaging tools and replaces inherited Python packages. |
| constraints.txt | Adds the urllib3 security floor. |
| apps/web/package.json | Pins the patched Next.js version. |
| .github/workflows/security.yml | Enforces scanning and retains source/image evidence. |
| .github/trivy-no-exceptions.txt | Provides an explicit empty exception list. |
🧠 Review effort: Balanced
💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+119
to
+120
| exit-code: '1' | ||
| ignore-unfixed: false |
| output: 'trivy-results.sarif' | ||
| exit-code: '0' | ||
| ignore-unfixed: true | ||
| exit-code: '1' |
Contributor
✅ E2E Test Results: ALL TESTS PASSED
Test Output |
groupthinking
changed the title
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Canonical issue
Closes #2425
Refs #2396
Linear: GRV-807
Outcome
Ship the verified image dependency repairs separately from final strict Trivy enforcement, using the split bootstrap path requested by #2425. This is partial remediation. Parent #2396 remains open until every remaining finding is accounted for; this PR does not establish a clean image, accepted risk, full license-inventory compliance, production remediation, or deployment.
Implementation head:
a729d875ae94e0e0b4af0e6f3143bad79123a989.Scope
64d2562dce7f2d870b32e3982ffe8888bbdcd808.trivyrequired for image build, scanner execution and exact source/image/SARIF evidence. Use findingsexit-code: '0'during this explicit bootstrap split; operational failures still fail. No scanner/jobcontinue-on-error, approved baseline or vulnerability exception is added.limit-severities-for-sarif: trueso SARIF honors HIGH/CRITICAL, including unfixed findings. Strictexit-code: '1'enforcement is a separate reviewed Triage image findings despite successful Trivy job #2396 change after finding accounting, or a separately reviewed delta policy.NumPy license diagnosis
The historical NumPy
2.5.4expressionBSD-3-Clause AND 0BSD AND MIT AND Zlib AND CC0-1.0was correctly rejected because Zlib is absent from the allowlist. It is not a composite-parser defect. The action's locked SPDX evaluator reproduces that rejection. No Zlib approval or NumPy bypass is introduced.Dependency Review run 38707004697 / job 116329188139 executed and passed for inspected head
64d2562dce7f2d870b32e3982ffe8888bbdcd808with the same policy, because its graph comparison contained no NumPy delta. This resolves that historical check blocker only for that head; full snapshots are unavailable, so the precise snapshot change is unknown. New-head hosted verification remains separate. See the complete diagnosis.Image evidence preserved
The original retained 259 HIGH/CRITICAL occurrences remain intact. The later inspected head
64d2562…has 252 (244 OS, 4 npm, 4 Python; 251 HIGH and 1 CRITICAL), across 63 unique advisories. Seven advisory/package/path occurrences disappeared between independent image builds/scans; this is not adjudicated remediation. Both raw artifacts, image identities, original SARIF and count/path reconciliation are preserved, with image IDs, artifact ZIP and SARIF hashes in the bootstrap evidence record.Latest inspected pre-change image:
sha256:58c3934b3b50d5e9086a822bfd87f185839ff61f8302b0d165f1960acf839201, linux/amd64; run 38706968204 / job 116328658621, artifact11958184738, ZIPsha256:1ff1b9ca9a058b14f536a585bbe9e29e8dc0dbd3d079940878b0bd6422275217. This image is not the new implementation-head image. No published registry digest is inferred from a Docker image ID.Risk
Verification
Local focused checks on the committed implementation:
python -m pytest -q tests/unit/test_merge_policy_security_scan_wording.py tests/unit/test_dependency_review_workflow.py tests/unit/test_workflow_pr_gate_coverage.py tests/unit/test_security_dependency_pr_evidence.py --override-ini addopts=: 51 passed.git diff --check: passed. Independent complete diff review: no actionable defects.Hosted workflows have started for
a729d875ae94e0e0b4af0e6f3143bad79123a989. Their prior-head results do not validate this commit. Do not merge before the exact-head CI, security, Dependency Review, E2E, coverage, CodeQL, secret scan and applicable review/protection gates are satisfied. No merge or deployment was performed by this follow-up.Security dependency evidence
Historical evidence retained
The following is the prior PR record centered on head
1d9f72d7c40bff34aa43b8107cb817ad01e8efd5, preserved to retain all 259 findings, identities, package paths, tests and prior governance observations. Its phrases “current head,” draft status, failing license check and strict-gate configuration describe that earlier record. The implementation, later graph delta and current gates are stated above; this historical record is not current-head verification.Original scan, dependency repairs, remaining findings and historical validation
Historical retained scan evidence
Security Scan run 38258616455 / job 114843053097 scanned source
1d9f72d7c40bff34aa43b8107cb817ad01e8efd5and image IDsha256:3e479db974698dc0bf11eec7fbce12acee901a33fe8179570fe4418a6b2ec34e, created 2026-10-12T13:53:16Z for linux/amd64.Retained artifact
trivy-image-evidence:11751896119sha256:545f1565a67c41fe5a9d641854e74f28bbb7050aa3247e537ca27d4fcb976459image-source-commit.txt,image-identity.json,trivy-results.sarifThe SARIF contains 259 HIGH/CRITICAL occurrences across 68 unique advisories:
This is 15 fewer HIGH/CRITICAL occurrences than the exact prior-head image (274). The enforcing lowercase
trivyjob failed as designed. The uppercaseTrivySARIF-ingestion check succeeded because it found no new code-scanning alert in the PR diff; it does not override the findings gate.Verified corrections
These no longer appear in the exact current-head image report:
proxy-addr2.0.7 -> 2.0.8, production path Workflow ->@workflow/web-> Expresssource-map-js1.2.1 -> 1.2.2, production path Next -> PostCSSdevalue5.9.2 -> 5.9.3 under@workflow/coreThe reconciliation commit has PR #2353 and PR #2358 as parents, incorporating their exact dependency changes without merging their stale branch trees.
Implementation:
package-lock.jsonurllib3>=2.8.0application constraintsetuptools>=80.10.2andwheel>=0.46.2; 78.1.1 still carried flagged vendor metadata, so that lower floor was rejectedsite-packagesmetadata before copying the constrained environmentexit-code: 1,ignore-unfixed: false, retained identity/source/SARIF evidence, and a regular comment-only.github/trivy-no-exceptions.txtEvery remaining non-OS finding
/usr/lib/node_modules/npm/node_modules/brace-expansion/package.json/usr/lib/node_modules/npm/node_modules/http-cache-semantics/package.json/usr/lib/node_modules/npm/node_modules/undici/package.json/usr/local/lib/python3.11/site-packages/pip/_vendor/msgpack/usr/local/lib/python3.11/site-packages/pip/_vendor/setuptools/usr/local/lib/python3.11/site-packages/pip/_vendor/urllib3The Python filesystem paths are established by the exact version match to the latest pip 26.2.1 wheel's
pip/_vendor/vendor.txtand source tree; Trivy labels these four only asPython. Normal requirements constraints cannot replace pip's private vendor bundle.npm 12.2.0 and pip 26.2.1 are the current published releases inspected on 2026-10-12. npm has an open Priority 1 bug (#10062) confirming its current brace-expansion and undici copies are bundled, downstream overrides/audit fixes cannot replace them, and a refreshed npm release is required. pip 26.2.1 itself vendors msgpack 1.1.2, setuptools 70.3.0, and urllib3 2.7.0.
npm/npx remain runtime-reachable through optional build-validation and NotebookLM paths. pip remains reachable through the repository's CLI installation command and copied utility scripts. Removing either tool would change runtime behavior and is not treated as an incidental security update.
Remaining OS findings
The exact report has 251 OS occurrences across 61 unique advisories, with no fixed version populated. Representative authoritative Debian tracking confirms:
ffmpeg/ffprobe are part of readiness and yt-dlp runtime behavior. curl is the container healthcheck. gnupg/dirmngr support NodeSource installation but remain in the runtime layer today. Removing packages or changing the base image needs an isolated compatibility/build investigation; no OS finding is dismissed.
Verification
Local:
npm ci --legacy-peer-deps: passed (1,010 packages)npm run test --workspace=apps/web: 169 files / 1,495 tests passed; 28 skippednpm run type-check --workspace=apps/web: passedpython -m unittest tests.unit.test_merge_policy_security_scan_wording: 4 passedgit diff --check: passedCurrent-head hosted:
build, frontend/Python tests and lint, guards: passedtrivy: failed on 259 unresolved occurrences, as policy requiresMerge gates
No Trivy exceptions are applied. Future exceptions require separately reviewed package/version/image scope, applicability evidence, compensating controls, owner, linked issue, expiry, and enforced expiry validation.
Ruleset 24057160 requires a Closing keyword to an open issue; this body closes bounded child #2425 and references parent backlog #2396 without closing it. The classic branch-protection endpoint returns 403 to the GitHub App, so complete protection verification remains blocked. PR remains draft and unmerged.