Repository navigation
fix(deps): clear urllib3, brace-expansion, fast-uri osv advisories - #932
Merged
scottschreckengaust merged 1 commit intoOct 1, 2026
Conversation
- urllib3 2.7.0 -> 2.8.0 in agent/uv.lock (GHSA-8988-9cw3-xx77 7.6, GHSA-vxq7-64xx-v4gw 8.9). Transitive, lockfile-only. - brace-expansion 5.0.9 -> 5.0.12 in yarn.lock and jira-forge-app's package-lock.json (GHSA-6j4f-fj2g-mc7p 7.5, GHSA-qhr7-859c-m2p7 7.5, GHSA-q2hr-2g5m-vwhr 5.3). - fast-uri 3.1.7 -> 3.1.8 in both lockfiles (GHSA-hrr3-gc8f-f4qj 4.8). Root `resolutions` and jira-forge-app `overrides` floors raised to ^5.0.12 / ^3.1.8 so a re-resolve cannot drop back below the fixed versions; check-transitive-pin-sync stays green. Re-resolved surgically (uv lock --upgrade-package, yarn install, npm install --package-lock-only) rather than a wholesale upgrade.
|
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #932 +/- ##
=======================================
Coverage ? 92.69%
=======================================
Files ? 344
Lines ? 99800
Branches ? 9989
=======================================
Hits ? 92508
Misses ? 7292
Partials ? 0 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
This was referenced Oct 1, 2026
isadeks
added a commit
to isadeks/sample-autonomous-cloud-coding-agents
that referenced
this pull request
Oct 2, 2026
Eight advisories published 2026-10-01, after aws-samples#932 merged: - devalue 5.9.2 -> 5.9.4 (GHSA-4q55-j62x-fr9h, GHSA-hx4r-w6wj-j8fg, GHSA-j22f-vq7h-c4qm, GHSA-mcm9-63f2-9j32, GHSA-r9w8-h9r3-54w4, GHSA-wf3x-273g-mvxv, GHSA-x5rw-q4pp-hg5g). Transitive via astro (docs build); within astro's ^5.8.1 range. - basic-ftp 5.3.1 -> 6.2.1 (GHSA-c475-qrg2-pj4r). Transitive via get-uri <- pac-proxy-agent <- proxy-agent <- markdown-link-check / link-check / retire (dev tooling only). No published get-uri accepts 6.x (latest 8.0.1 still pins ^5.3.1), so the resolution forces a major. The only 6.0.0 break is rejecting separate PASV transfer hosts by default (FTP-bounce hardening); get-uri only calls access / lastMod / list / downloadTo, which are unchanged. Root `resolutions` floors added so a re-resolve cannot drop back below the fixed versions. Neither package is in jira-forge-app's lockfile, so no `overrides` mirror is needed; check-transitive-pin-sync stays green. Co-authored-by: isadeks <isadeks@gmail,com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Clears the 10 OSV findings (6 unique advisories, 3 packages) that osv-scanner reports on main.
Area
agent— Python runtime / Docker imagetooling— rootmise.toml, scripts, CI workflowsRelated
agent/uv.lockagent/uv.lockyarn.lock,integrations/jira-forge-app/package-lock.jsonChanges
agent/uv.lock:uv lock --upgrade-package urllib3. It's a transitive dependency, so only the lockfile changes.package.jsonresolutionsandintegrations/jira-forge-app/package.jsonoverrides: raised the floors tobrace-expansion ^5.0.12andfast-uri ^3.1.8, so re-resolving can't pull the vulnerable versions back in.check-transitive-pin-syncstays in sync.yarn.lock/package-lock.json: re-resolved only these entries, with no wholesale upgrade. That follows the approach from fix(deps): clear 7 osv advisories blocking the merge queue #870.Verification:
osv-scanner scan -L yarn.lock -L agent/uv.lock -L integrations/jira-forge-app/package-lock.jsonreports No issues found, and a fullmise run buildpasses (CDK 4781/4781 tests).Acknowledgment
By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of the project license.