mirror of
https://github.com/warmbly/warmbly.git
synced 2026-08-20 08:01:26 +00:00
Matthew Meszaros
d8bb10bf8f
Workflow: - Add explicit `permissions: contents: read, pull-requests: read` so dorny/paths-filter can list PR files via the GitHub API. Without it the "Detect Changes" job dies with "Bad credentials" on PRs and every downstream language CI gets skipped. Go: - google.golang.org/grpc v1.78.0 → v1.79.3 (CVE-2026-33186 — HTTP/2 path validation authorization bypass). Elixir (realtime): - cowboy 2.14.2 → 2.15.0 (CVE-2026-8466) - cowlib 2.16.0 → 2.16.1 (CVE-2026-43970, CVE-2026-7790) - phoenix 1.8.3 → 1.8.7 (CVE-2026-32689 — long-poll memory blow-up) - plug 1.19.1 → 1.19.2 (CVE-2026-8468 — multipart header overflow) - plug_cowboy 2.7.5 → 2.8.1 (CVE-2026-32688 — unauth DoS) - postgrex 0.22.0 → 0.22.2 (CVE-2026-32687 — channel-name SQLi) Rust (tracking): - aws-lc-rs 1.15.4 → 1.17.0 (pulls aws-lc-sys to 0.41.0 — fixes GHSA-394x-vwmw-crm3, GHSA-65p9-r9h6-22vj, GHSA-9f94-5g5w-gf6r, GHSA-hfpc-8r3f-gw53, GHSA-vw5v-4f2q-w9xf) - openssl 0.10.75 → 0.10.80 (CVE-2026-41676/8/81/898, -42327) - rustls-webpki 0.103.9 → 0.103.13 - Add .trivyignore for GHSA-82j2-j2ch-gfr8 on the old rustls-webpki 0.101.7 path that aws-smithy-http-client / hyper-rustls 0.24 still pulls in. AWS SDK hasn't migrated to rustls 0.23+ yet; the CRL parsing path the advisory covers isn't reachable from our usage (SSM + Secrets Manager at startup over the public CA chain).
14 lines
663 B
Plaintext
14 lines
663 B
Plaintext
# Trivy ignore list — vulnerabilities we've consciously accepted.
|
|
#
|
|
# Each entry must include the CVE/GHSA, the package, and a reason
|
|
# we're not patching it. Re-evaluate on dependency upgrades.
|
|
|
|
# rustls-webpki 0.101.7 — DoS via panic on malformed CRL.
|
|
# Pulled in transitively by hyper-rustls 0.24, which is pinned by
|
|
# aws-smithy-http-client / aws-config. The AWS Rust SDK hasn't yet
|
|
# migrated to rustls 0.23+, so we can't bump this without forking
|
|
# the SDK. tracking/ only uses the AWS SDK for SSM + Secrets Manager
|
|
# fetched at startup over the public CA chain; the affected code
|
|
# path (CRL parsing) is not reachable in our usage.
|
|
GHSA-82j2-j2ch-gfr8
|