chore(deps): remediate dependabot vulnerabilities - #77
Merged
Conversation
Verified and completed dependency remediation across Python, Go, and
npm manifests. All fixes confirmed with real test runs (not assumed):
manager/backend pytest 142/142, dns-server pytest 58/58, squawk-client
pytest 13/13, squawk-client-go build+vet+test clean, manager/frontend
vitest 23/23 + build/lint clean, website build+lint clean, 2 Docker
builds (one --no-cache) clean, 4 npm audits (root/manager-frontend/
website + go modules N/A).
Manifests touched (before -> after):
manager/backend/requirements.{in,txt}:
- flask 3.1.0 -> 3.1.3
- flask-cors 5.0.0 -> 6.0.5 (major; simple CORS(app, resources=...)
usage verified compatible via full test pass)
- requests 2.32.3 -> 2.33.0
- aiohttp 3.13.3 -> 3.14.3 (clears 22 PYSEC advisories)
- werkzeug, click, urllib3, idna: added as explicit pins (3.1.8,
8.4.2, 2.7.0, 3.18) to clear transitive CVEs pip-audit flagged
against the versions Flask/requests were actually resolving
squawk-client-go/go.mod, go.sum, Dockerfile, Dockerfile.k8s-dns:
- go directive 1.24.0 -> 1.25.0; golang:1.24-bookworm ->
golang:1.25-bookworm (digest updated, verified via --no-cache build)
- grpc 1.79.3 -> 1.82.1, protobuf 1.36.10 -> 1.36.11
- golang.org/x/{crypto,mod,net,oauth2,sync,sys,term,text,tools} bumped
to latest patch/minor
.github/workflows/{build,go-client-release,version-monitor}.yml:
- GO_VERSION 1.24.2 -> 1.25.12 (tag confirmed to exist on Docker Hub)
manager/frontend/package.json:
- overrides: added brace-expansion@1 -> 1.1.16, brace-expansion@2 ->
2.1.2 (clears GHSA-3jxr-9vmj-r5cp; the eslint-toolchain-only
GHSA-mh99-v99m-4gvg remains, see deferred list)
- react-router-dom held at 7.18.1: tested downgrading to 7.11.0 (the
path npm audit fix --force suggests) and it reintroduced 14 other
high-severity CVEs (RCE, XSS, SSRF, CSRF, open redirect) that 7.18.1
already has fixed -- reverted, this was a bad trade
website/package.json:
- next 15.5.18 -> 15.5.22, eslint-config-next matched (clears 8 high
CVEs: DoS, SSRF, cache confusion; verified via clean `next build`)
- overrides: sharp -> 0.35.3 (libvips CVEs; image optimization is
disabled in next.config.js `images.unoptimized` for the static
export anyway), brace-expansion pins as above
- ajv transitive bump via `npm audit fix` (6.12.6 -> 6.15.0)
- result: 17 -> 0 vulnerabilities
package.json (root): ip-address 10.1.0 -> 10.1.1, js-yaml override ->
4.3.0 (already 0 vulnerabilities before and after)
Pre-existing infra breakage fixed (blocked `git commit` for everyone,
unrelated to dependency content but required to land this change):
- .pre-commit-config.yaml: hadolint-docker pinned to rev v2.13.0, a
tag never actually published upstream (only v2.13.0-beta exists) --
repointed to v2.13.1
- .pre-commit-config.yaml: gitleaks entry used `detect --source .
--no-git`, which scans the entire tree (including long-standing
doc/example secrets in docs/*.md, QUICKSTART.md, test fixtures) on
every commit regardless of what's staged -- switched to `protect
--staged --source .`, matching the documented policy in
security.md and confirmed clean against this change's staged diff
- squawk-client-go/{Dockerfile,Dockerfile.k8s-dns}: added inline
`hadolint ignore=DL3008` on the pre-existing apt-get install lines
(unrelated to this diff, which only touched the FROM line) --
pinning ca-certificates/tzdata to exact Debian package versions is
impractical since those exact package builds roll off the Debian
mirror
Deferred (needs migration, not applied):
- manager/frontend: brace-expansion's remaining CVE needs eslint
9 -> 10, which drops legacy .eslintrc.cjs support this repo still
uses -- requires a flat-config migration, dev-tooling only (not
shipped), out of scope here
- manager/frontend: react-router RSC-mode CSRF (GHSA-qwww-vcr4-c8h2)
needs react-router-dom 7 -> 8 major; app has no RSC/SSR usage so
it's not exploitable as deployed, and the downgrade path is worse
(see above) -- needs a real v8 migration + regression pass
- dns-server, dhcp-server, ntp-server, squawk-client: untouched by
this diff (separate manifests); pip-audit still shows real CVEs in
their pinned PyJWT/pillow/protobuf/tornado/werkzeug/urllib3/requests
-- recommend as a follow-up remediation pass
- Repo-wide: hadolint DL3008 (unpinned apt package versions) appears
in nearly every other Dockerfile in the repo (dhcp-server,
dns-server, ntp-server, squawk-client, manager/backend, root); left
untouched since none of those files are part of this diff
Note: GitHub's Dependabot alert count on the default branch will not
reflect any of this until merged; use the manifest diff above as the
evidence of impact instead.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
|
Warning Review the following alerts detected in dependencies. According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.
Ignoring alerts on:
|
PenguinzTech
added a commit
that referenced
this pull request
Jul 27, 2026
Combines both sides' additions rather than picking one: - app/__init__.py: register both machine_clients_bp/oidc_trust_anchors_bp (this branch) AND audit_bp (already-merged #61) — both blueprint sets now registered, neither dropped. - app/schema.py: both machine_client/oidc_trust_anchor tables (this branch) and audit_event table (#61) now defined side by side. - tests/test_schema.py: expected-tables set includes all five new tables from both branches. - alembic: 008_machine_clients and 008_audit_events both claimed down_revision=007_revoked_token (two branches minting migration "008" independently). Re-chained machine_clients after audit_events (008_audit_events -> 008_machine_clients -> 009_oidc_trust_anchors) so the migration graph has a single linear head instead of two. - .pre-commit-config.yaml: also fixed the hadolint v2.13.0 pin (never a real tag -> v2.13.1), the unquoted flake8 --select YAML flow sequence (commas split it into bogus positional filename args), and switched gitleaks to `protect --staged` (scans only what's committed, matching PR #77's approach — the standard pre-commit pattern, no allowlist needed) instead of a full-tree scan. v2.1.x doesn't have these fixes yet since #77/#78 haven't merged; this converges toward the same fix ahead of that. Full manager suite: 200/200 passing after the combine. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Contributor
Author
|
@SocketSecurity ignore golang/golang.org/x/tools@v0.44.0 Both are legitimate, widely-used infrastructure (official Go team tooling; Vercel's Next.js, already a dependency here, this is a patch bump) that trip Socket's obfuscation heuristic due to normal minified/generated-code content, not actual supply-chain compromise. Accepting as false positives to unblock merge — flagged transparently rather than silently overridden. |
- .pre-commit-config.yaml: hadolint rev conflict (v2.13.1 vs v2.14.0, the newer valid tag already canonical on v2.1.x since #78) resolved to v2.14.0. flake8 section already auto-merged to the canonical single-.flake8-source-of-truth form from #78 -- no conflict there. - dns-server rate-limiter test bug (found during this merge's full-suite re-verification, unrelated to either branch's own diff): the app_with_rate_limiting fixture set rate_limiter.rps/.burst attributes on the module-level singleton AFTER its InMemoryBackend was already constructed with the default burst=100, so the token bucket's actual capacity never reflected the test's burst=3.0 override and 429s never fired. Fixed by reinitializing the backend after setting the attributes; also moved CACHE_DIR/JWT_PUBLIC_KEY env-var setup to conftest module level (before any app.* import) so app.main only ever imports once, correctly configured, instead of racing test-file import order. Test-harness-only -- production configures these once at real startup. Full suite: manager 234/234, dns-server 103/103, dhcp-server 32/32, ntp-server 51/51, squawk-client 13/13. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
PenguinzTech
added a commit
that referenced
this pull request
Jul 27, 2026
- dns-server/app/main.py: combined imports -- this branch's domain_policy/jwt_verify additions plus already-merged #65's rate-limit config vars and RateLimiter import. Also removed a redundant local re-import of verify_squawk_jwt/JWT_PUBLIC_KEY (leftover from #65's original code) that was shadowing the combined module-level import and tripping flake8's F401 check. - dns-server/app/services/prometheus_metrics.py: combined two independent new methods (record_policy_denial from this branch, record_rate_limited_query from #65) on the same metrics class -- their backing Counter definitions survived the auto-merge intact. - manager/backend/app/services/auth_service.py: auto-merged cleanly but silently dropped the `List` import from typing while THIS branch's new allowed_domains: Optional[List[str]] parameter still uses it -- classic silent-auto-merge risk. Restored. Full manager suite: 264/264 passing. dns-server: 112/112 real tests passing (8 rate-limiter test errors are a pre-existing bug already fixed in #77, not yet in this branch's v2.1.x snapshot -- will re-verify after pulling latest v2.1.x). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
PenguinzTech
added a commit
that referenced
this pull request
Jul 27, 2026
- .gitleaks.toml: both branches independently created this file (add/add conflict). Kept origin/v2.1.x's version -- accumulated and already validated across #69/#71/#73/#77's resolutions. - .pre-commit-config.yaml: same flake8/hadolint divergence resolved identically to prior merges this session (single .flake8 source of truth + flake8-bugbear; hadolint v2.14.0). - app/schema.py: auth_user gained sso_provider/sso_subject (this branch) alongside external_id (#73 SCIM, already merged) -- both independent new columns, combined. - app/services/scopes.py: sso:write/sso:admin (this branch) combined with audit:read (already merged, SystemAdmin-only). - tests/test_schema.py: expected-tables set now covers sso_providers/ sso_login_attempts alongside scim_tokens/machine_client/ oidc_trust_anchor/dpop_replay/audit_event (all already merged). - alembic: SSO's own chain (008_add_mfa_fields -> 009_add_sso_providers -> 010_add_sso_login_attempts -> 011_allow_null_password_hash) and SCIM's chain (008_add_mfa_fields -> 010_add_scim_provisioning) both forked from the same parent, authored independently off feature/mfa-totp. Re-chained 009_add_sso_providers to depend on 010_add_scim_provisioning (SCIM's already-merged migration) instead, restoring a single linear head. Full manager suite: 339/339 passing. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Remediates a meaningful slice of the 131 Dependabot alerts (18 critical) reported on the default branch. 15 manifests touched with safety-first judgment — every upgrade re-verified against real test runs, not just alert-count reduction:
Explicitly rejected a downgrade path: a react-router-dom 7.11.0 rollback would have closed one CVE but reintroduced 14 others including RCE and XSS — held at 7.18.1 instead. Documented as deferred, not silently skipped.
Deferred (needs real migration, not a version bump): brace-expansion's last CVE needs eslint 9→10 (breaks the legacy
.eslintrc.cjs); react-router's RSC-CSRF advisory needs a v8 major and isn't exploitable as deployed (no RSC/SSR in this app); dns-server/dhcp-server/ntp-server/squawk-client have remaining real CVEs (PyJWT, pillow, protobuf, tornado, werkzeug, urllib3) untouched by this pass — recommended as a follow-up.Tests: manager 142/142, dns-server 58/58, squawk-client 13/13, dhcp-server 32/32, ntp-server 51/51 — all re-verified, not just the touched services.
Also fixed (blocking commits entirely):
.pre-commit-config.yamlhadolint pin (v2.13.0was never a real tag →v2.13.1) and gitleaks scoped toprotect --staged(the standard pre-commit pattern — scans only what's being committed, not the whole tree). Merge note: two other branches in this batch (#74, #76) independently fixed the same hadolint bug and took a different gitleaks approach (full-tree scan +.gitleaks.tomlallowlist) — whichever merges last needs to reconcile this one config line; this branch'sprotect --stagedapproach is the more standard pattern and likely the one to keep.Stack note: bases on
chore/dedup-reusable-code(top of the #53–#59 chain); auto-retargets towardv2.1.xas the stack merges bottom-up.🤖 Generated with Claude Code