From fe6677d0607035a171467a0eba1dabf38174a702 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 31 Jul 2026 00:35:12 +0000 Subject: [PATCH 1/4] Bump github/codeql-action from 4 to 4.37.3 Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4 to 4.37.3. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/v4...v4.37.3) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.37.3 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] --- .github/workflows/codeql.yml | 8 ++++---- .github/workflows/security-scan.yml | 6 +++--- 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index f90d832..468584b 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -31,17 +31,17 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@v7 - - uses: github/codeql-action/init@v4 + - uses: github/codeql-action/init@v4.37.3 with: languages: python - - uses: github/codeql-action/analyze@v4 + - uses: github/codeql-action/analyze@v4.37.3 analyze-java: name: codeql (java) runs-on: ubuntu-latest steps: - uses: actions/checkout@v7 - - uses: github/codeql-action/init@v4 + - uses: github/codeql-action/init@v4.37.3 with: languages: java-kotlin # App Components/Source is raw Mendix module source (no pom.xml/build.gradle, @@ -51,4 +51,4 @@ jobs: # it still catches source-level security queries (e.g. XPath injection) at # the cost of missing anything that needs resolved byte-code/type info. build-mode: none - - uses: github/codeql-action/analyze@v4 + - uses: github/codeql-action/analyze@v4.37.3 diff --git a/.github/workflows/security-scan.yml b/.github/workflows/security-scan.yml index d7241c3..281a174 100644 --- a/.github/workflows/security-scan.yml +++ b/.github/workflows/security-scan.yml @@ -96,7 +96,7 @@ jobs: output: trivy-${{ matrix.image }}.sarif exit-code: '0' - name: Upload SARIF - uses: github/codeql-action/upload-sarif@v4 + uses: github/codeql-action/upload-sarif@v4.37.3 with: sarif_file: trivy-${{ matrix.image }}.sarif category: trivy-${{ matrix.image }} @@ -127,7 +127,7 @@ jobs: - name: Bandit scan (full report, SARIF) run: bandit -r "${{ matrix.service }}/app" -f sarif -o bandit.sarif --exit-zero - name: Upload SARIF - uses: github/codeql-action/upload-sarif@v4 + uses: github/codeql-action/upload-sarif@v4.37.3 with: sarif_file: bandit.sarif category: bandit-${{ matrix.service }} @@ -154,7 +154,7 @@ jobs: exit-code: '1' - name: Upload SARIF if: always() - uses: github/codeql-action/upload-sarif@v4 + uses: github/codeql-action/upload-sarif@v4.37.3 with: sarif_file: trivy-secrets.sarif category: trivy-secrets From 7561d561c1be599e4c53ccbb64e7cb931862b9ab Mon Sep 17 00:00:00 2001 From: Robert van 't Hof Date: Wed, 16 Sep 2026 10:03:05 +0100 Subject: [PATCH 2/4] Fix Bandit annotation for deployment history pruning --- Controller/app/deploy_history.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Controller/app/deploy_history.py b/Controller/app/deploy_history.py index b21546c..9a024c7 100644 --- a/Controller/app/deploy_history.py +++ b/Controller/app/deploy_history.py @@ -105,7 +105,7 @@ def record(app_name: str, operation: str, record: AppRecord, status: str, def _prune(app_name: str) -> None: """Keep only the newest _KEEP_PER_APP rows for this app.""" - # nosec B608 - _TABLE is a fixed constant and _KEEP_PER_APP an int literal; + # _TABLE comes from deployment configuration and _KEEP_PER_APP is an int literal; # app_name is parameterized (bound twice, once per subquery reference). sf.execute_sql( f""" @@ -117,7 +117,7 @@ def _prune(app_name: str) -> None: ORDER BY ts DESC, id DESC LIMIT {_KEEP_PER_APP} ) - """, + """, # nosec B608 (app_name, app_name), ) From 0c7f0d4c4536a3dcb16bd5ee28574d0b1d8dd77b Mon Sep 17 00:00:00 2001 From: Robert van 't Hof Date: Wed, 16 Sep 2026 10:05:29 +0100 Subject: [PATCH 3/4] Use current CodeQL 4.38.0 release --- .github/workflows/codeql.yml | 8 ++++---- .github/workflows/security-scan.yml | 6 +++--- 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 468584b..9591d50 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -31,17 +31,17 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@v7 - - uses: github/codeql-action/init@v4.37.3 + - uses: github/codeql-action/init@v4.38.0 with: languages: python - - uses: github/codeql-action/analyze@v4.37.3 + - uses: github/codeql-action/analyze@v4.38.0 analyze-java: name: codeql (java) runs-on: ubuntu-latest steps: - uses: actions/checkout@v7 - - uses: github/codeql-action/init@v4.37.3 + - uses: github/codeql-action/init@v4.38.0 with: languages: java-kotlin # App Components/Source is raw Mendix module source (no pom.xml/build.gradle, @@ -51,4 +51,4 @@ jobs: # it still catches source-level security queries (e.g. XPath injection) at # the cost of missing anything that needs resolved byte-code/type info. build-mode: none - - uses: github/codeql-action/analyze@v4.37.3 + - uses: github/codeql-action/analyze@v4.38.0 diff --git a/.github/workflows/security-scan.yml b/.github/workflows/security-scan.yml index 281a174..e4c4a64 100644 --- a/.github/workflows/security-scan.yml +++ b/.github/workflows/security-scan.yml @@ -96,7 +96,7 @@ jobs: output: trivy-${{ matrix.image }}.sarif exit-code: '0' - name: Upload SARIF - uses: github/codeql-action/upload-sarif@v4.37.3 + uses: github/codeql-action/upload-sarif@v4.38.0 with: sarif_file: trivy-${{ matrix.image }}.sarif category: trivy-${{ matrix.image }} @@ -127,7 +127,7 @@ jobs: - name: Bandit scan (full report, SARIF) run: bandit -r "${{ matrix.service }}/app" -f sarif -o bandit.sarif --exit-zero - name: Upload SARIF - uses: github/codeql-action/upload-sarif@v4.37.3 + uses: github/codeql-action/upload-sarif@v4.38.0 with: sarif_file: bandit.sarif category: bandit-${{ matrix.service }} @@ -154,7 +154,7 @@ jobs: exit-code: '1' - name: Upload SARIF if: always() - uses: github/codeql-action/upload-sarif@v4.37.3 + uses: github/codeql-action/upload-sarif@v4.38.0 with: sarif_file: trivy-secrets.sarif category: trivy-secrets From 374dfcbf2fa0c9ee636d9be1c7a0fc626f704dc9 Mon Sep 17 00:00:00 2001 From: Robert van 't Hof Date: Wed, 16 Sep 2026 10:10:56 +0100 Subject: [PATCH 4/4] Refresh service runtime images for OpenSSL security fix --- Admin UI/Dockerfile | 2 +- Controller/Dockerfile | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/Admin UI/Dockerfile b/Admin UI/Dockerfile index 4cb5f75..4918beb 100644 --- a/Admin UI/Dockerfile +++ b/Admin UI/Dockerfile @@ -42,7 +42,7 @@ RUN mkdir -p /opt/runtime-libs \ # GLIBC_2.38 symbols libpython3.12.so needs. # NOTE: no RUN is possible in this stage (no shell). Anything needing mkdir/ # chown at build time goes in the builder stage above. -FROM gcr.io/distroless/cc-debian13:nonroot@sha256:aded2458d026e046cb68199db0e5793e1028ffa143f7258f3c4278253e20add7 +FROM gcr.io/distroless/cc-debian13:nonroot@sha256:54df941ed0d06a1bd95ef5e0ce391fd8d9f94b64782dc9a60062727849ee3f97 # /usr/local carries the interpreter, stdlib C extensions (lib-dynload), # libpython3.12.so, and all pip-installed packages in one consistent copy. COPY --from=builder --chown=65532:65532 /usr/local /usr/local diff --git a/Controller/Dockerfile b/Controller/Dockerfile index 52beba0..18c63d2 100644 --- a/Controller/Dockerfile +++ b/Controller/Dockerfile @@ -41,7 +41,7 @@ RUN mkdir -p /opt/runtime-libs \ # 2.36 predates the GLIBC_2.38 symbols libpython3.12.so needs. # NOTE: no RUN is possible in this stage (no shell). Anything needing mkdir/ # chown at build time goes in the builder stage above. -FROM gcr.io/distroless/cc-debian13:nonroot@sha256:aded2458d026e046cb68199db0e5793e1028ffa143f7258f3c4278253e20add7 +FROM gcr.io/distroless/cc-debian13:nonroot@sha256:54df941ed0d06a1bd95ef5e0ce391fd8d9f94b64782dc9a60062727849ee3f97 # /usr/local carries the interpreter, stdlib C extensions (lib-dynload), # libpython3.12.so, and all pip-installed packages in one consistent copy. COPY --from=builder --chown=65532:65532 /usr/local /usr/local