 Matthew Meszaros
|
d8bb10bf8f
|
ci: fix Bad-credentials + bump deps to clear Trivy CVEs
Workflow:
- Add explicit `permissions: contents: read, pull-requests: read`
so dorny/paths-filter can list PR files via the GitHub API. Without
it the "Detect Changes" job dies with "Bad credentials" on PRs and
every downstream language CI gets skipped.
Go:
- google.golang.org/grpc v1.78.0 → v1.79.3 (CVE-2026-33186 — HTTP/2
path validation authorization bypass).
Elixir (realtime):
- cowboy 2.14.2 → 2.15.0 (CVE-2026-8466)
- cowlib 2.16.0 → 2.16.1 (CVE-2026-43970, CVE-2026-7790)
- phoenix 1.8.3 → 1.8.7 (CVE-2026-32689 — long-poll memory blow-up)
- plug 1.19.1 → 1.19.2 (CVE-2026-8468 — multipart header overflow)
- plug_cowboy 2.7.5 → 2.8.1 (CVE-2026-32688 — unauth DoS)
- postgrex 0.22.0 → 0.22.2 (CVE-2026-32687 — channel-name SQLi)
Rust (tracking):
- aws-lc-rs 1.15.4 → 1.17.0 (pulls aws-lc-sys to 0.41.0 — fixes
GHSA-394x-vwmw-crm3, GHSA-65p9-r9h6-22vj, GHSA-9f94-5g5w-gf6r,
GHSA-hfpc-8r3f-gw53, GHSA-vw5v-4f2q-w9xf)
- openssl 0.10.75 → 0.10.80 (CVE-2026-41676/8/81/898, -42327)
- rustls-webpki 0.103.9 → 0.103.13
- Add .trivyignore for GHSA-82j2-j2ch-gfr8 on the old rustls-webpki
0.101.7 path that aws-smithy-http-client / hyper-rustls 0.24 still
pulls in. AWS SDK hasn't migrated to rustls 0.23+ yet; the CRL
parsing path the advisory covers isn't reachable from our usage
(SSM + Secrets Manager at startup over the public CA chain).
|
2026-05-23 16:13:39 +00:00 |
|